Privacy Policy

This Privacy Policy explains what personal information Inkference collects, why, who we share it with, how long we keep it, and the choices and rights you have. It covers the Inkference website at https://inkference.com, the Inkference apps, the Inkference API and AI connector (the "Service").

Inkference is operated by a sole proprietor based in Ontario, Canada ("Inkference", "we", "us"). We are responsible for your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, other privacy laws such as the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). You can reach our privacy contact at inkference@gmail.com.

The short version

• We don't sell your personal information, and we don't share it for advertising.
• There are no ads on Inkference, and no third-party analytics or ad trackers.
• We don't train AI models on your content.
• You choose who sees your posts, projects and galleries.
• You can delete your account and your content at any time in Settings.

1. What we collect

Information you give us

• Account: your name, username, email address and password. Passwords are stored only as a secure hash (Argon2id), never as text.
• Sign in with Google, GitHub, Apple or WeChat (where offered): your account id at that service, your name, email address and profile picture. If you use Apple's "Hide My Email", we get a private relay address instead of your real one.
• Profile (optional): profile picture, banner, bio, birthday, a location you type, social links, education, work experience, skills, awards and a resume file.
• Your content: posts, projects, photos and galleries, videos, stories, comments, reactions, messages and chats (with any photos, polls and reactions in them), Drive files (docs, sheets, notes, LaTeX, planners, trackers, to-do lists and uploaded files), Library binders, communities, enterprises, booths, orders and reviews, songs, albums and playlists, tools, custom emoji, transfers, your room and study character, your schedule, tasks and goals, and focus sessions.
• People: who you follow, friends, blocks, and people you hide your content from.
• Payments: when you pay on the website, Stripe collects your card details. We only receive the card brand, last 4 digits and expiry date, receipts, and the status of your plan. If you receive money (coffees or binder sales), Stripe collects the identity and bank details needed for payouts. We keep only the id of your payout account.
• Messages to us: what you send when you email us or report something.

Information we collect when you use Inkference

• Sign-in and security: for each signed-in device, the IP address, browser or device type and when it was used. We also use IP addresses to limit how many accounts or attempts come from one network, to stop spam and abuse.
• Activity: views, likes, saves and comments, counted once a day per item, to show counts and Trending and to sort your feed. Posts you've seen, files you opened recently, and the last page you were on.
• Presence: while Inkference is open, whether you're online or away, and which chat you're reading (so we don't notify you about it). What you play in Inkference Music and, if you allow it, what you listen to on Spotify, can show on your profile.
• Settings: language, theme, time zone, menus, notification choices and privacy choices. Your time zone sets the times you see and the country flag shown at study spots.
• Notifications: a push token for each device or browser where you turn on notifications.
• Accepting our terms: which versions of the Terms of Service and Privacy Policy you accepted, when, and the IP address and browser you used.

Location

We don't use GPS or your device's precise location. When you type a place (for example in a post or your profile), the text you type is sent to Google Places or to Photon (an OpenStreetMap search service) to suggest places. What you pick is saved with that item and shown to the people who can see it.

Information from other services you connect

• Spotify: if you connect it, we store access tokens (encrypted) and read what you're playing now, what you played recently and your playlists, to show on your profile and in your activity.
• GitHub: if you add your GitHub username, we read your public GitHub profile and public activity.
• Claude API key: if you add your own Anthropic key for the desk Assistant, we store it encrypted (AES-256-GCM).
• Developer API keys and AI connector links: we store only a secure hash of each key.
• Apple In-App Purchase: when you buy in the iPhone app, Apple and RevenueCat tell us which product you bought and whether it's active. Apple handles the payment. We don't get your card details.

2. How we use it

• To run the Service: create your account, show your content to the people you choose, send messages, sync your files, and keep your settings.
• To keep Inkference safe: verify emails, stop spam, fraud and abuse, enforce our Terms and Community Guidelines, review reports, and protect people.
• To take payments and pay out money people earn.
• To send you service emails (verification, password reset, receipts, important changes) and the notifications you turn on.
• To improve Inkference, using totals and counts (for example how many people use a feature).
• To follow the law and answer valid legal requests.

Your feed and Trending are sorted by automatic rules using activity like views and likes. We don't make automated decisions that have legal or similarly important effects on you.

Legal bases (GDPR)

Where the GDPR applies, we rely on: performing our contract with you (running your account and the features you use), our legitimate interests (security, preventing abuse, improving the Service, and talking to you about it), your consent (for example push notifications, connecting Spotify, and optional profile details, which you can withdraw at any time), and legal obligations (for example tax records).

3. Who we share it with

• Other people on Inkference, based on your settings. Your username, name, profile picture and profile page are public. Posts, projects and galleries follow the audience you pick. Anything shared by link can be opened by anyone with the link while it works.
• Service providers who run parts of Inkference for us, only as needed to provide it:

• Links you post: to show a preview of a link, our server visits that page. The site sees our server, not you.
• For legal reasons: when the law requires it, or to protect people from harm, to investigate abuse, or to protect our rights.
• If Inkference changes hands: if Inkference is sold or reorganized, your information may move to the new owner, who must follow this policy.
• With your consent in other cases.

4. Where it is stored

We are based in Canada. Our service providers store and process information in Canada, the United States and other countries. Those countries may have different privacy laws, and their authorities may be able to access it under their laws. When we transfer personal information out of the European Economic Area, the UK or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses, or an adequacy decision (Canada has one for organizations covered by PIPEDA).

5. How long we keep it

• Your account and content: until you delete them, or until you delete your account.
• When you delete your account: your account and content are deleted from our live systems right away. Copies in backups are deleted within [BACKUP RETENTION PERIOD, e.g. 30 days].
• Stories disappear after 24 hours unless you save them to a Star. Transfers end at the time you pick.
• Sign-in sessions end after 30 days without use, or when you sign out.
• Payment records are kept as long as tax and accounting laws require (in Canada, generally 6 years).
• Reports and moderation records are kept as long as needed to keep Inkference safe and to handle appeals.
• Records of accepting our terms are kept while your account exists.

6. Your choices and rights

• See and change your information in Settings (profile, account, privacy, notifications and more).
• Choose who sees your content: a default audience in Settings > Privacy, an audience for each post, project and gallery, a list of people to hide everything from, blocking, who can message you, and who sees your activity. You can also appear offline.
• Notifications: turn them off in Settings or on your device.
• Connected services: disconnect Spotify or remove your GitHub username or Claude key at any time in Settings.
• Delete your account in Settings > User > Delete account, on the website or in the app.
• Get a copy of your information: email inkference@gmail.com. There is no self-serve export yet, so we send it to you.

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, to object to or limit how we use it, and to withdraw consent. To use these rights, email inkference@gmail.com. We may need to confirm it's you. We answer within 30 days, or sooner if the law where you live requires it. We won't treat you differently for using your rights.

California: we don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information for anything beyond what the CCPA allows. The categories we collect are listed in section 1 and the purposes in section 2. You can use an authorized agent to make a request.

Complaints: you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), to your local data protection authority in the EU or UK, or to your state's attorney general in the US. Please contact us first so we can try to help.

7. Cookies and storage on your device

We use cookies and device storage only to run Inkference. We don't use advertising or analytics cookies.

The website also keeps some data in your browser (local storage, IndexedDB and a service worker) so pages, binders and songs you saved can open offline. Stripe's card form, shown only when you pay, may set its own cookies to prevent fraud. The iPhone app keeps your session in the device's secure storage (Keychain).

8. Security

We protect your information with HTTPS everywhere, secure password hashing, encryption of connected service tokens and API keys you give us, access limited to the people who run Inkference, rate limits and regular updates. No system is perfectly secure. Uploaded files are stored at addresses that are hard to guess, but anyone who has a file's address can open it, so don't upload anything you need to keep secret. Messages are stored on our servers and are not end-to-end encrypted. If a breach puts you at real risk of significant harm, we will tell you and the authorities as the law requires.

9. Children

Inkference is not for children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child under 13 has an account, email inkference@gmail.com and we will delete it. If you are under the age of majority where you live, you need a parent's or guardian's permission to use Inkference.

10. Changes to this policy

We may update this Privacy Policy. When we do, we post the new version here with a new date and version number, and we keep a record of past versions. If a change is important, we tell you in the app or by email before it takes effect and may ask you to accept it.

11. Contact

Questions or requests about your privacy? Email inkference@gmail.com.