1. Controller
We are not required to appoint a data protection officer. For any privacy question, reach us at the email address above.
2. Hosting and infrastructure (Cloudflare)
Inkside runs entirely on infrastructure of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Workers, D1 database, storage, content delivery network and email sending). Cloudflare processes data on our behalf under a data processing agreement (Art. 28 GDPR).
Every request involves technically necessary data: IP address, date and time, requested URL, browser identifier (user agent) and referrer. This is used to deliver the site, fend off attacks and detect abuse (rate limits). The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We do not store IP addresses themselves in our database; the country is derived from them. For rate limits and the free allowances while logged out (exports, photos) we only store a hash of your network (IPv4 address or IPv6 /64 prefix) made with a secret key, i.e. a pseudonym. Rate-limit entries are deleted after one day at the latest.
Cloudflare is certified under the EU-US Data Privacy Framework. EU Standard Contractual Clauses apply in addition (Art. 46(2)(c) GDPR).
3. Account and login
An account only needs your email address. We email you a one-time 6-digit code; there are no passwords. We store: email address, language, time of sign-up and last login, an optional display name and your plan (Free or Pro). Login codes are only stored as a hash and deleted when they expire (by the next day at the latest). To protect against guessed codes we count sign-in attempts per email address (stored as a hash, deleted after one day).
After login we set the cookie "ink_session" (HttpOnly, 90 days) to keep you logged in. It is strictly necessary.
The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). You can delete your account yourself at any time (Account → "Your data" → "Delete account"). We then immediately delete your account, your handwritings including their preview images, your library, sessions, connections to apps such as ChatGPT including their access keys, usage counters, export metadata and waitlist entries; running subscriptions are cancelled immediately and your customer record at Stripe is deleted. Files from the ChatGPT app are not linked to your account and therefore stay downloadable until they expire: they expire within 24 hours and are then deleted (section 6b). Invoice and payment records that must be kept (section 7) remain until the statutory period ends. You can also just email us.
4. Your handwriting (fonts)
In the Fast Scan you draw letters. This creates a handwriting file with stroke coordinates, a name and the supported languages. While you're logged out it only lives on your device (browser storage). When you save it to your account, it is stored on our servers at Cloudflare.
Your handwriting is private by default. Only if you turn on "Share in the Library" can other users see it and use it to write their own texts; we then show the display name you chose, never your email address. You can stop sharing at any time. Files that others exported before stay with them.
The legal basis is the performance of our contract (Art. 6(1)(b) GDPR), and for sharing also your decision to publish.
5. Texts and exports
We only process the text you have written for you to generate the Goodnotes or PDF file. The text itself is not stored in our database. Exception: files from the ChatGPT app are kept for download for 24 hours (section 6b).
For each export we store metadata: time, format, number of pages and characters, the number of fonts used and your account or, when logged out, the network hash from section 2 (no device ID; nothing is stored on your device for this while logged out). We need this to enforce the Free plan limits and prevent abuse (Art. 6(1)(b) and (f) GDPR). Export metadata and daily counters are deleted after at most 400 days.
6. AI variations (Google Gemini)
The "AI variation" feature slightly rewords your text. Only when you actively use it do we send that text to the Gemini API of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, USA). Google processes the text as our processor to generate the variations. We don't send your email address or account ID.
The legal basis is the performance of our contract (Art. 6(1)(b) GDPR). Transfers to the USA are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. If you don't use the feature, no text is sent to Google.
6a. Photo to ink (OpenAI)
"Photo to ink" turns a photo of a handwritten page into text, on the website and in the ChatGPT app (section 6b). Only when you actively use it (on the website: choose a photo and tap "Read handwriting"; in ChatGPT: pass a photo to Inkside) do we send the image to the API of OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (parent company OpenAI, L.L.C., USA). OpenAI reads the handwriting and returns the text; we then check the text with OpenAI's moderation service for prohibited content. OpenAI processes the data as our processor (Art. 28 GDPR) on the basis of OpenAI's Data Processing Addendum.
Only the image and our instructions are sent, no email address and no account ID. On the website your browser first scales the photo down to at most 1600 pixels and saves it again as JPEG, which drops metadata such as the location. Please don't photograph pages with sensitive data about other people.
We store neither the photo nor the text read from it. On the website the text only goes into your editor (your browser's local storage, section 10); in ChatGPT it is written into the file (section 6b). We only store counters (number of photos per day per account or network hash from section 2) and technical logs without content (result, image size, duration, compute used). Under its terms OpenAI does not use API data for training and keeps it for at most 30 days to detect abuse; after that it is deleted.
The legal basis is the performance of our contract (Art. 6(1)(b) GDPR). Transfers to the USA are covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of OpenAI's Data Processing Addendum. If you don't use the feature, no images are sent to OpenAI.
6b. Inkside in ChatGPT (ChatGPT app)
When you use Inkside in ChatGPT, ChatGPT sends us what each call needs: the text, the chosen handwriting, paper, format and title, and for "Photo to ink" a download link from OpenAI that we use once to fetch the image (section 6a). OpenAI is responsible for ChatGPT's own processing; OpenAI's privacy policy applies to it.
We store the generated file for 24 hours in our Cloudflare storage under a random, unguessable link so you can download it; after that we delete it (at the latest in the daily cleanup). For each file we store the export metadata from section 5. Without a connected account the logged-out allowances apply, counted by the network hash from section 2; for ChatGPT that is OpenAI's network, which many users share.
Connecting your account: you can connect your Inkside account to ChatGPT (OAuth). You sign in on an Inkside page with your email code and allow access. ChatGPT then receives access keys that let it read the names of your handwritings and create files within your plan's limits; we do not pass your email address to ChatGPT. We store the connection (app name, permissions, time of connecting and of last use) and the keys only as a hash. Access keys are valid for 1 hour, refresh keys for 30 days and are replaced on every use. We delete expired keys by the next day at the latest, and the connection as soon as its last key has expired, i.e. no later than 30 days after its last use. You can disconnect at any time under Account → "Connected apps"; deleting your account deletes the connection too.
The legal basis is the performance of our contract (Art. 6(1)(b) GDPR), and for the logged-out allowances also our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
7. Payments (Stripe)
Payments for Pro and the Exam Week Pass are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your payment details directly on Stripe's checkout page; we never see card or bank details. Depending on the method (e.g. PayPal, Apple Pay, Google Pay, SEPA), that provider's privacy notice also applies.
From Stripe we receive a customer ID, the plan you bought, the payment or subscription status and its term. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); we keep invoice and booking records for up to 10 years because the law requires it (Art. 6(1)(c) GDPR with § 147 AO, § 257 HGB).
When you delete your account, we cancel every running subscription immediately and delete your customer record at Stripe. Invoices and payments stay stored at Stripe as far as they must be kept.
8. Analytics
We use our own privacy-friendly analytics on our servers, no third-party analytics tools.
Without consent we only count anonymous page views: page, time, language, referring site (domain only), country and device type. Nothing is stored on your device and no identifier is created (Art. 6(1)(f) GDPR, legitimate interest in measuring reach).
Only if you consent to "Analytics" do we create a random identifier in your browser's local storage ("ink_aid") and a session ID ("ink_sid", for the session only), and record clicks, scroll depth, error messages and which variant of an A/B test you saw. Certain steps (sign-up, login, export, starting a purchase, purchase) are recorded by our server with this identifier when they actually happen; when you start a purchase we pass the identifier to Stripe as metadata for this. Analytics events are not linked to your account. If you withdraw consent, we delete "ink_aid" and "ink_sid" from your device. The legal basis is your consent (Art. 6(1)(a) GDPR) and § 25(1) TDDDG. Raw events are deleted after 180 days.
9. Ads (Google AdSense)
On the Free plan we show ads on some pages (home, pricing, writing, export, library) through Google AdSense, a service of Google Ireland Limited (address above). Pro has no ads.
What loads when: ads only run on inkside.app; on other Inkside addresses no Google ad script is loaded. Only after our server has confirmed that you are not on Pro does your browser load Google's AdSense script (pagead2.googlesyndication.com) on a page with an ad space. It is not loaded for Pro users; if you become Pro after it loaded (sign-in or purchase), the page reloads without it. If you open a page without an ad space directly, it is not loaded. If you move within Inkside from a page with ads to a page without an ad space, the script that already loaded stays active until the next full page load (or until you close the page); no ads appear there, because Google's automatic ads are switched off for Inkside. When the script loads, Google technically receives, among other things, your IP address, browser and device data and the page you visit.
Consent at Google: where required (e.g. in the EU), the script first shows you a consent message from Google, a consent management platform certified under the IAB Transparency & Consent Framework. There you decide whether Google and its advertising partners may store or read information on your device (cookies and similar identifiers) and personalize ads. Depending on your choice Google shows personalized, non-personalized or limited ads. Google's consent platform stores your choice in the cookie "FCCDCF". Google sets it for the domain .inkside.app. You can change or withdraw your choice at any time with the "Ad privacy settings" link in the footer (it appears once the ad script has loaded), which reopens Google's message. Our own cookie banner only asks about analytics (section 8).
Google also processes this data under its own responsibility, including in the USA; details: https://policies.google.com/technologies/ads and https://business.safety.google/privacy/. The legal basis for storing and reading information on your device (§ 25(1) TDDDG) and for personalized ads is your consent in Google's message (Art. 6(1)(a) GDPR). Where Google or individual advertising partners state in that message that they rely on their legitimate interest for certain purposes (Art. 6(1)(f) GDPR), you can object to that directly in the message, and later via "Ad privacy settings" in the footer. Loading the ad script on the Free plan and the technically necessary transfer to Google that comes with it (see above) are based on our legitimate interest in funding the free plan (Art. 6(1)(f) GDPR); you can object to this under Art. 21 GDPR (section 13). We ourselves do not request personalized ads from Google; whether ads are personalized depends only on your choice in Google's message. Transfers to the USA are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
11. Waitlist
If you join a waitlist (e.g. for Pro or "Photo to ink"), we store your email address and the feature to notify you once at launch. The legal basis is your consent (Art. 6(1)(a) GDPR). We delete the entry afterwards, after 180 days at the latest, or earlier whenever you ask.
12. Retention
We keep personal data only as long as needed for its purpose: account data and fonts until your account is deleted, sessions until they expire (max. 90 days), login codes until they expire (deleted by the next day at the latest), photos and the text read from them not at all (at OpenAI for at most 30 days, section 6a), files from the ChatGPT app 24 hours, connections to apps until you disconnect them or at most 30 days after their last use, their access keys until they expire (1 hour or 30 days), rate-limit entries 1 day, raw analytics events 180 days, waitlist entries max. 180 days, export metadata and daily counters max. 400 days, invoice records for the statutory periods (up to 10 years).
13. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).
You can download a copy of your account data and delete your account yourself at any time (Account → "Your data"). For everything else email us at luka@lukaloehr.com; we answer within one month (Art. 12(3) GDPR). You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (https://www.baden-wuerttemberg.datenschutz.de).
14. Children and teenagers
Inkside is intended for users aged 16 and over; younger users may only use Inkside with their parents' consent (terms section 3). You can only give consent to analytics (with us) and to cookies and personalized ads (in Google's message) yourself from the age of 16 (Art. 8 GDPR, § 25 TDDDG). If you're younger, decline both unless your parents have agreed; Google then only shows non-personalized or limited ads. We don't ask for your age and therefore don't know it; we ourselves don't request personalized ads from Google for anyone; whether Google personalizes depends only on the choice made in its message (section 9). Pro has no ads.
15. No automated decisions
We don't make automated decisions within the meaning of Art. 22 GDPR and we ourselves don't build profiles about you. If you agree to personalized ads in Google's message, Google and its advertising partners may build profiles for that (section 9).
16. Changes
As Inkside evolves we will update this policy. You'll always find the current version here.