Draft for review
Your writing
stays yours.
This privacy draft describes Ink’s foundation and intended data handling. Rewriting, payments and voice training are not open yet.
Identity and account records
Ink verifies your shared ego.ist session with Supabase. Ink reads the session cookie and never writes or refreshes it. We store an Ink account and a receipt for the version of Ink terms you accept. Identity alone grants no Passport memory access.
Rewrite content
We do not train on your rewrites. Customer text is never sent to external detectors as part of rewriting, retries or background work. The planned retention for rewrite text is 30 days. Retention is configurable and the deletion schedule must be implemented before rewriting opens.
Voice data
Voice training needs separate permission and your choice of writing. Ink never retains chat or email text. Training from those sources is planned inside Passport’s temporary extraction window, keeping only the adapter. Pasted samples and uploads require an authorship declaration and exclusion controls.
Payments
Stripe will process card payments. Ink will keep subscription and usage metadata. Ink will not store full card details. Payment processing is not connected in this milestone.
Analytics and errors
PostHog measures page visits and account setup when configured. It respects Do Not Track. All inputs and marked private elements are masked. Network request bodies and headers are not recorded. Sentry reports errors when configured, with request bodies, cookies and content fields removed. Neither receives rewrite, sample or evidence text.
Reports, export and deletion
A detector report does not grant permission to send text to another service or train a model. Reports will require separate evidence retention rules. The database provides a metadata-only export function for Passport. The complete account deletion hook and customer controls are still to come.
This draft needs final processor, retention, backup, contact and rights-request details before public launch.