Privacy Policy

This policy explains what Inkwrite collects, why, and the choices you have. We built Inkwrite to keep your writing close to you — but using the AI features means parts of your manuscript are sent to AI providers to generate text. Section 5 explains exactly how.

1Who is responsible for your data

Inkwrite (“Inkwrite,” “we”) is the controller of the personal information described here. If you have questions, contact privacy@inkwrite.app.

2Information we collect

• Account information. When you sign up, our authentication provider, Clerk, collects your email address and, depending on how you sign in, your name and a profile from a connected provider (such as Google). We receive a user identifier and your email.
• Your manuscripts and writing. The text you write, your World (characters, places, notes), and related project data. These are saved in your browser, on your device. When you are signed in they are also synced to our cloud database, so you can open them on your other devices and get them back if this browser's copy is lost (see Section 4).
• Account-wide writing settings. When you are signed in, your voice profile (the style card Ink builds of how you write, with any sample passages saved in it) and your Custom Tools are stored in our database so they follow your account.
• AI prompts and content. When you use an AI feature, the portions of your manuscript and the instructions involved in that request (see Section 5).
• Subscription and payment information. If you subscribe, payments are processed by Stripe through Clerk Billing. We receive your subscription status and limited billing details (such as plan and renewal date) — we do not receive or store your full card number.
• Usage records. The number of AI credits you have used in the current period, which we store to enforce plan limits.
• Technical and log data. Standard information your browser sends and that our hosting provider (Vercel) logs — such as IP address, device and browser type, and timestamps — used for security, debugging, and reliability. Our fonts are served from our own host, so loading a page does not contact Google.
• Page analytics. Vercel Web Analytics and Vercel Speed Insights record page views and page-load timings, with the page address, referrer, country, browser, operating system and device type. Vercel describes these records as anonymous: they are not tied to an individual or to an IP address. We also send three events about getting started (see Section 12), with any campaign tags you arrived with.

3How we use your information

• to provide and maintain the Service, including saving and syncing your work;
• to generate AI assistance that you request;
• to operate accounts, subscriptions, and credit limits;
• to secure the Service, prevent abuse, and debug problems;
• to communicate with you about your account or important changes; and
• to comply with our legal obligations.

Where the law requires a legal basis (for example, under the GDPR), we rely on performance of our contract with you, our legitimate interests in operating and securing the Service, your consent where applicable, and compliance with legal obligations.

4Where your manuscripts live

Inkwrite is local-first: as you write, your work is saved immediately in your browser’s storage on your device. When you are signed in, your projects are also copied to our cloud database (Neon), scoped to your account. Changes are sent about every 15 seconds while you’re online, and queued while you’re offline. Inkwrite on your other devices downloads them when it checks for changes, which it does when you switch back to it or reconnect. A project larger than 3.5 MB is not synced and stays in this browser only. Keep your own backups as well: export your work regularly.

Deleting a project removes it from this browser and deletes its content from our database. We keep only an empty record (its identifier, revision number and timestamps) so that your other devices know to remove their copies too. If you are offline at the time, Inkwrite finishes deleting it from our database once you're back online, signed in to the same account. If another of your devices has changes to that project it hasn't synced yet, it keeps them as a separate conflicted copy rather than lose them, and that copy syncs like any other project. To delete your account and everything in our database that belongs to it, email privacy@inkwrite.app.

5AI processing and your content

When you use an AI feature — drafting, rewriting, brainstorming, consistency checks, import analysis — the relevant portions of your manuscript and your instructions are transmitted through our servers to a third-party AI provider, which generates text in response.

• Our primary AI provider is DeepSeek (an AI inference provider), which hosts the DeepSeek model family. DeepSeek is operated from China (the People’s Republic of China), so when you use the AI features the relevant portions of your request are transferred to and processed there.
• The Unbound engine, on plans that include it, sends its requests to OpenAI. A request OpenAI declines can be retried with our fallback text-generation provider, which serves the GLM model family.
• Content moderation. The text of each AI request, and the text the model writes back, is also sent to our content-moderation provider. It runs an automated safety classifier that answers with a verdict (safe or unsafe, and a category code when unsafe); this is how we enforce our content policy. The voice-match score is the one AI feature that is not moderated.
• We do not use your content to train our own models, and we do not sell it. Each provider processes your requests under its own terms and privacy policy — including how long it retains a request and whether it uses submitted content to improve its services. Please review their policies before using the AI features.
• The trust posture you can rely on from us: AI requests are sent only to generate the text you asked for and to check it against our content policy, we do not keep your prompts beyond what is needed to run the request, and the AI features are entirely optional.

6Service providers we share data with

We share personal information only with the service providers (“subprocessors”) that help us run Inkwrite, under contracts that require them to protect it. The current list:

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of our users and the Service. If we are ever involved in a merger or acquisition, we will require the successor to honour this policy. We do not sell your personal information.

7International data transfers

We and our providers may process your information in countries other than your own, including the United States and China. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers. By using the AI features you understand that your submitted content is transferred to and processed by the relevant AI provider.

8How long we keep data

We keep your account and synced manuscripts for as long as your account is active. When you delete a project or your account, we delete the associated data from our active systems; residual copies in backups are removed in the ordinary course (typically within 30 days). We keep limited records (such as billing and usage logs) for as long as needed to meet legal, accounting, and security obligations.

9Security

We use reasonable technical and organisational measures to protect your information, including encryption in transit and access controls scoped to your account. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security — please keep your own backups of important work.

10Your rights

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the processing of your personal information, and to object to certain processing. You can edit or delete your projects directly in the app and export them at any time. To exercise other rights, or to delete your account, contact privacy@inkwrite.app. If you are in the EEA or UK, you may also lodge a complaint with your local data-protection authority. If you are a California resident, you have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. If you are in Australia, you may also complain to the Office of the Australian Information Commissioner.

11Children’s privacy

Inkwrite is not intended for children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, please contact us and we will delete it.

12Cookies

Our authentication provider (Clerk) sets secure session cookies to keep you signed in.

If you arrive from a link that carries campaign tags (the utm_ parameters, or ref), we store those tags, the page you landed on and the time in your browser’s local storage, and copy the tags into a first-party cookie called iw_attr. Both last 30 days. While they are present, the tags are attached to three events we send to Vercel Web Analytics: viewing the home page, clicking one of its sign-up buttons (and which one), and finishing the app’s first-run setup. That tells us which campaigns bring people who start writing. Arriving without campaign tags sets neither.

Vercel Web Analytics itself does not use third-party cookies; Vercel recognises a visit by a hash of the request, which it discards after 24 hours. We do not use advertising cookies.

13Changes to this policy

We may update this policy from time to time. We will change the date above and, for material changes, take reasonable steps to notify you. Your continued use of the Service after an update means you accept it.

14Contact

For any privacy question or request, email privacy@inkwrite.app.