1. Controller
We are not required to appoint a data protection officer. For any privacy question, reach us at the email address above.
2. Hosting and infrastructure (Cloudflare)
Inkside runs entirely on infrastructure of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Workers, D1 database, storage, content delivery network and email sending). Cloudflare processes data on our behalf under a data processing agreement (Art. 28 GDPR).
Every request involves technically necessary data: IP address, date and time, requested URL, browser identifier (user agent) and referrer. This is used to deliver the site, fend off attacks and detect abuse (rate limits). The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We do not store IP addresses themselves in our database; the country is derived from them. For rate limits and the free export allowance while logged out we only store a hash of your network (IPv4 address or IPv6 /64 prefix) made with a secret key, i.e. a pseudonym. Rate-limit entries are deleted after one day at the latest.
Cloudflare is certified under the EU-US Data Privacy Framework. EU Standard Contractual Clauses apply in addition (Art. 46(2)(c) GDPR).
3. Account and login
An account only needs your email address. We email you a one-time 6-digit code; there are no passwords. We store: email address, language, time of sign-up and last login, an optional display name and your plan (Free or Pro). Login codes are only stored as a hash and deleted when they expire (by the next day at the latest). To protect against guessed codes we count sign-in attempts per email address (stored as a hash, deleted after one day).
After login we set the cookie "ink_session" (HttpOnly, 90 days) to keep you logged in. It is strictly necessary.
The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). You can delete your account yourself at any time (Account → "Your data" → "Delete account"). We then immediately delete your account, your handwritings including their preview images, your library, sessions, usage counters, export metadata and waitlist entries; running subscriptions are cancelled immediately and your customer record at Stripe is deleted. Invoice and payment records that must be kept (section 7) remain until the statutory period ends. You can also just email us.
4. Your handwriting (fonts)
In the Fast Scan you draw letters. This creates a handwriting file with stroke coordinates, a name and the supported languages. While you're logged out it only lives on your device (browser storage). When you save it to your account, it is stored on our servers at Cloudflare.
Your handwriting is private by default. Only if you turn on "Share in the Library" can other users see it and use it to write their own texts; we then show the display name you chose, never your email address. You can stop sharing at any time. Files that others exported before stay with them.
The legal basis is the performance of our contract (Art. 6(1)(b) GDPR), and for sharing also your decision to publish.
5. Texts and exports
We only process the text you have written for you to generate the Goodnotes or PDF file. The text itself is not stored in our database.
For each export we store metadata: time, format, number of pages and characters, the number of fonts used and your account or, when logged out, the network hash from section 2 (no device ID; nothing is stored on your device for this while logged out). We need this to enforce the Free plan limits and prevent abuse (Art. 6(1)(b) and (f) GDPR). Export metadata and daily counters are deleted after at most 400 days.
6. AI variations (Google Gemini)
The "AI variation" feature slightly rewords your text. Only when you actively use it do we send that text to the Gemini API of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, USA). Google processes the text as our processor to generate the variations. We don't send your email address or account ID.
The legal basis is the performance of our contract (Art. 6(1)(b) GDPR). Transfers to the USA are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. If you don't use the feature, no text is sent to Google.
7. Payments (Stripe)
Payments for Pro and the Exam Week Pass are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your payment details directly on Stripe's checkout page; we never see card or bank details. Depending on the method (e.g. PayPal, Apple Pay, Google Pay, SEPA), that provider's privacy notice also applies.
From Stripe we receive a customer ID, the plan you bought, the payment or subscription status and its term. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); we keep invoice and booking records for up to 10 years because the law requires it (Art. 6(1)(c) GDPR with § 147 AO, § 257 HGB).
When you delete your account, we cancel every running subscription immediately and delete your customer record at Stripe. Invoices and payments stay stored at Stripe as far as they must be kept.
8. Analytics
We use our own privacy-friendly analytics on our servers, no third-party analytics tools.
Without consent we only count anonymous page views: page, time, language, referring site (domain only), country and device type. Nothing is stored on your device and no identifier is created (Art. 6(1)(f) GDPR, legitimate interest in measuring reach).
Only if you consent to "Analytics" do we create a random identifier in your browser's local storage ("ink_aid") and a session ID ("ink_sid", for the session only), and record clicks, scroll depth, error messages and which variant of an A/B test you saw. Certain steps (sign-up, login, export, starting a purchase, purchase) are recorded by our server with this identifier when they actually happen; when you start a purchase we pass the identifier to Stripe as metadata for this. Analytics events are not linked to your account. If you withdraw consent, we delete "ink_aid" and "ink_sid" from your device. The legal basis is your consent (Art. 6(1)(a) GDPR) and § 25(1) TDDDG. Raw events are deleted after 180 days.
9. Ads (Google AdSense)
On the Free plan we show ads on some pages (home, pricing, writing, export, library) through Google AdSense, a service of Google Ireland Limited (address above). Pro has no ads.
What loads when: only after our server has confirmed that you are not on Pro does your browser load Google's AdSense script (pagead2.googlesyndication.com) on a page with an ad space. For Pro users and on pages without an ad space no Google ad script is loaded. When the script loads, Google technically receives, among other things, your IP address, browser and device data and the page you visit.
Consent at Google: where required (e.g. in the EU), the script first shows you a consent message from Google, a consent management platform certified under the IAB Transparency & Consent Framework. There you decide whether Google and its advertising partners may store or read information on your device (cookies and similar identifiers) and personalize ads. Depending on your choice Google shows personalized, non-personalized or limited ads. Google stores your choice on your device; you can change or withdraw it at any time through the privacy settings Google shows on the page for this. Our own cookie banner only asks about analytics (section 8).
Google also processes this data under its own responsibility, including in the USA; details: https://policies.google.com/technologies/ads and https://business.safety.google/privacy/. The legal basis for storing and reading information on your device and for personalized ads is your consent in Google's message (Art. 6(1)(a) GDPR, § 25(1) TDDDG); otherwise, for showing ads on the Free plan, our legitimate interest in funding the free plan (Art. 6(1)(f) GDPR). Transfers to the USA are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
11. Waitlist
If you join a waitlist (e.g. for Pro or "Photo to ink"), we store your email address and the feature to notify you once at launch. The legal basis is your consent (Art. 6(1)(a) GDPR). We delete the entry afterwards, after 180 days at the latest, or earlier whenever you ask.
12. Retention
We keep personal data only as long as needed for its purpose: account data and fonts until your account is deleted, sessions until they expire (max. 90 days), login codes until they expire (deleted by the next day at the latest), rate-limit entries 1 day, raw analytics events 180 days, waitlist entries max. 180 days, export metadata and daily counters max. 400 days, invoice records for the statutory periods (up to 10 years).
13. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).
You can download a copy of your account data and delete your account yourself at any time (Account → "Your data"). For everything else email us at luka@lukaloehr.com; we answer within one month (Art. 12(3) GDPR). You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (https://www.baden-wuerttemberg.datenschutz.de).
14. Children and teenagers
Inkside is also used by school students. In Germany you can only give consent to analytics (with us) and to personalized ads (in Google's message) yourself from the age of 16 (Art. 8 GDPR). If you're younger, please decline both or ask your parents.
15. No automated decisions
We don't make automated decisions within the meaning of Art. 22 GDPR and we don't build profiles about you.
16. Changes
As Inkside evolves we will update this policy. You'll always find the current version here.