Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account information: When you create an account, we collect your email address, username, and display name.
• Journal content: The entries, comments, and other content you create on the Service, including associated metadata such as mood tags, music metadata, and timestamps.
• Profile information: Any optional information you add to your profile, including biography text, avatar images, and custom CSS/HTML profile themes.
• Payment information: If you subscribe to Inkwell Plus, payment information is collected and processed by our third-party payment processor, Stripe. We receive limited information such as the last four digits of your card, billing address, and transaction history. We do not store full payment card numbers on our servers.
• Communications: If you contact us for support, we collect the contents of your messages and any attachments.

1.2 Information Collected Automatically

• Log data: When you use the Service, our servers automatically record information including your IP address, browser type and version, operating system, referring URL, pages visited, and timestamps.
• Device information: We collect information about the device you use to access the Service, including device type, screen resolution, and unique device identifiers.
• Cookies and similar technologies: We use essential cookies to maintain your session and preferences. See Section 7 for more details.

1.3 Information from Federation

When users on other ActivityPub-compatible platforms interact with Inkwell (for example, by following an Inkwell user or commenting on an entry), we may receive profile information and content from those external servers, including usernames, profile pictures, avatars, and message content.

2. How We Use Your Information

We use the information we collect for the following purposes:

3. How We Share Your Information

• Federation (ActivityPub): When you publish content with public or federated visibility, your content, username, display name, and avatar are shared with other servers in the ActivityPub network. This is a core function of the Service and is necessary for federation to work. Content marked as friends-only, private, or using custom filters is not federated.
• Payment processor: We share necessary billing information with our payment processor Stripe to process subscription transactions.
• Hosting and infrastructure providers: Your data is stored on and processed by servers operated by Fly.io (application hosting and database), Cloudflare (DNS, content delivery, and email routing), and Resend (transactional email delivery). These providers process data on our behalf in accordance with their respective data processing terms.
• Legal requirements: We may disclose your information if required to do so by law, or if we believe in good faith that such disclosure is reasonably necessary to comply with legal process, respond to claims, or protect the rights, property, or safety of Inkwell, our users, or the public.
• Business transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice of any such transfer and any choices you may have regarding your information.

4. Data Retention

We retain your data only as long as necessary to provide our services. Here's how long we keep different types of information:

• Account Data. Your profile information, journal entries, and other content are retained for as long as your account is active. You may delete individual entries at any time, and they are removed immediately.
• Sessions. Login sessions expire after 90 days of inactivity. If you use Inkwell regularly, your session renews automatically. Magic link tokens used for sign-in expire after 15 minutes and can only be used once.
• Notifications. Read notifications are automatically deleted after 90 days. Unread notifications are retained until you read or dismiss them.
• Drafts. Unpublished draft entries that have not been edited in over 12 months are automatically deleted.
• Uploaded Images. Images uploaded to journal entries that are not included in any entry are automatically deleted after 24 hours.
• Account Deletion. You may delete your account at any time from your Settings page. When you delete your account, we immediately and permanently delete your profile, journal entries, images, relationships, notifications, and all other personal data. Community contributions such as feedback posts and comments are preserved in an anonymized form with no personally identifiable information attached.
• Automated Cleanup. We run automated processes daily to remove expired sessions, orphaned files, old notifications, and abandoned drafts in accordance with the retention periods described above.

5. Your Rights and Choices

5.1 All Users

• Access and correction: You can access and update your account information at any time through your account settings.
• Deletion: You can delete individual entries and comments, or delete your entire account through your account settings.
• Data export: You can export your journal entries, comments, profile data, and account information in a standard, machine-readable format through your account settings.
• Privacy controls: You can control the visibility of each journal entry (public, friends-only, private, or custom friend filters).
• Email preferences: You can manage your email notification preferences in your account settings. Service-critical emails (such as security alerts) cannot be opted out of.

5.2 European Economic Area (EEA) and UK Users (GDPR)

If you are located in the EEA or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR), including:

• Legal basis for processing: We process your personal data based on: (a) your consent (e.g., when you create an account); (b) the performance of our contract with you (the Terms of Service); (c) our legitimate interests in operating and improving the Service; and (d) compliance with legal obligations.
• Right to access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request correction of inaccurate personal data.
• Right to erasure: You have the right to request deletion of your personal data, subject to certain exceptions.
• Right to restrict processing: You have the right to request that we limit the processing of your personal data in certain circumstances.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to our processing of your personal data based on our legitimate interests.
• Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, please contact us at hello@inkwell.social. We will respond to your request within 30 days.

5.3 California Users (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights:

• Right to know: You have the right to request information about the categories and specific pieces of personal information we have collected about you.
• Right to delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to correct: You have the right to request correction of inaccurate personal information.
• Right to opt out of sale/sharing: Inkwell does not sell your personal information and does not share it for cross-context behavioral advertising purposes.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your rights, contact us at hello@inkwell.social.

6. Data Security

We implement reasonable technical and organizational measures to protect your personal information, including encryption of data in transit (TLS/HTTPS), hashed password storage, and access controls on our infrastructure.

However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of your information. If we become aware of a security breach that affects your personal data, we will notify you and applicable authorities as required by law.

7. Cookies and Similar Technologies

Inkwell uses the following types of cookies:

• Essential cookies: These are required for the Service to function, including session management and authentication. These cookies cannot be disabled.
• Preference cookies: These remember your settings and preferences (such as theme or display preferences).

Inkwell does not use advertising cookies or tracking pixels. We do not participate in third-party ad networks.

8. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to delete that information.

If you believe we may have collected information from a child under 16, please contact us at hello@inkwell.social.

9. International Data Transfers

Inkwell's servers are located in Chicago, IL, USA. If you access the Service from outside this jurisdiction, your information may be transferred to, stored, and processed in a country that may not provide the same level of data protection as your jurisdiction.

10. Third-Party Links and Federated Content

The Service may contain links to third-party websites or display content from federated servers. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you interact with.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting a notice on the Service and, where possible, by email at least 14 days before the changes take effect.

We encourage you to review this Privacy Policy periodically. The “Last Updated” date at the top of this policy indicates when it was most recently revised.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Inkwell
Email: hello@inkwell.social
Address: 1127 Pennington Ln, Westfield, IN 46074