Privacy Policy

1. Who We Are

Inkwell ("Inkwell", "the App", "we", "us", "our") is a mobile application, designed for writers to draft books, keep a daily diary, manage to-do lists, and take notes. This Privacy Policy explains what information the App collects, how it is used, where it is stored, and what choices you have. It applies to the App and any related services we operate (such as optional cloud sync).

Data controller: Shivam Kushwah, Gwalior Madhya Pradesh, India. Contact: shivamkushwah@gmail.com.

2. Information We Collect

Inkwell is built to work fully offline by default. The table below distinguishes content you create from technical/account data.

2.1 Content you create

We treat all of the above as sensitive personal content. Diary entries in particular can reveal personal thoughts, health, relationships, or beliefs — we do not scan, analyze, or use this content for advertising, profiling, or AI model training.

2.2 Account information (only if you create an account)

• Email address and/or sign-in identifier (e.g., Google/Apple Sign-In token)
• A hashed password, if you use email/password sign-in (we never store passwords in plain text)
• Display name or username, if provided
• Subscription/purchase status, if you buy a premium plan (handled by the app store, see Section 2.4)

2.3 Automatically collected technical data

• Device type, operating system version, app version (for crash reports and compatibility)
• Crash logs and basic performance diagnostics (e.g., via Firebase Crashlytics or a similar service, if enabled)
• Anonymous, aggregated usage events (e.g., "note created", "export used") if you have not opted out of analytics — see Section 6

We do not collect: contacts, precise GPS location, microphone/camera data, biometric data, or browsing history from other apps.

3. How We Use Your Information

We do not use your writing content to train AI models, build advertising profiles, or sell it to data brokers, ever.

4. Where Your Data Is Stored

• Local-first storage: By default, all books, diary entries, notes, and to-dos are stored only in the App's local database on your device (e.g., using SQLite/Hive via Flutter). Nothing leaves your device unless you explicitly enable sync, backup, or sharing.
• Optional cloud sync: If you enable sync, your content is encrypted in transit (TLS) and stored on servers operated by [e.g., Firebase / Supabase / your backend provider], located in [region, e.g., the EU/US].
• Device backups: If you use your phone's built-in backup (iCloud Backup or Android Backup), Inkwell's local data may be included in that backup, governed by Apple's or Google's own privacy policies, not this one.

5. Sharing and Disclosure

We do not sell your personal data. We share data only in these limited cases:

• Service providers ("processors"): companies that host our backend, send transactional emails, or process crash reports, under contracts that restrict them to providing the service to us — e.g., [Firebase, Supabase, SendGrid, Crashlytics — list the ones you actually use].
• App stores: Apple and Google process purchases and may share anonymized install/crash analytics with us per their own developer terms.
• Legal requirements: if required by law, court order, or to protect rights, safety, or prevent fraud.
• Business transfers: if Inkwell is acquired or merged, data may transfer to the new owner, who must honor this Policy or notify you of material changes.

We never share diary or manuscript content with advertisers, data brokers, or unrelated third parties.

6. Your Choices and Controls

• Work fully offline: skip account creation; all features work locally with no data ever leaving your device.
• Analytics opt-out: available in Settings → Privacy → "Share anonymous usage data" (toggle off at any time).
• Export your data: Settings → Export lets you export books, diary entries, notes, and to-dos as .txt, .md, or .pdf files at any time.
• Delete your data: delete individual entries in-app, or fully erase local data via Settings → Reset App, or delete your cloud account per the Data Deletion page.
• Notification permissions: if Inkwell offers daily journaling reminders or to-do alerts, you can deny or revoke notification permission at any time in your device settings.

7. Data Retention

• Local content remains on your device until you delete it or uninstall the App.
• Cloud-synced content is retained while your account is active, plus up to [30 days] after deletion to allow for recovery from accidental deletion, after which it is permanently erased.
• Crash logs are retained for up to [90 days] for debugging purposes, then deleted.
• Billing records may be retained longer where required by tax or accounting law.

8. Children's Privacy

Inkwell is not directed at children under 13 (or the minimum age required in your country, e.g., 16 in parts of the EU). We do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, contact us at shivamkushwah@gmail.com and we will delete it.

9. Your Rights (GDPR, CCPA/CPRA, and similar laws)

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time (e.g., for analytics)
• Lodge a complaint with your local data protection authority

California residents have additional rights under the CCPA/CPRA, including the right to know what categories of data are collected and to opt out of "sale" or "sharing" — we do not sell or share personal data as defined under CCPA.

To exercise any of these rights, email shivamkushwah@gmail.com. We will respond within the timeframe required by applicable law (typically 30 days).

10. Security

• Local data is stored in the App's sandboxed storage, isolated from other apps by iOS/Android.
• Cloud sync traffic is encrypted in transit via TLS.
• Passwords are hashed using industry-standard algorithms (e.g., bcrypt/argon2); we never store plain-text passwords.
• Access to production systems is restricted to authorized personnel only.

No system is 100% secure. If we become aware of a data breach affecting your personal data, we will notify affected users and relevant authorities as required by applicable law.

11. Third-Party Services Used

List and update this section to match what you actually integrate:

12. International Data Transfers

If you are located outside the region where our servers are hosted, your data may be transferred internationally. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) for transfers from the EU/UK.

13. Changes to This Policy

We may update this Privacy Policy as the App evolves. Material changes will be announced via an in-app notice and/or by updating the "Last updated" date above. Continued use of the App after changes take effect constitutes acceptance of the revised Policy.

14. Contact Us

Questions, requests, or complaints about this Policy or your data: shivamkushwah@gmail.com
Shivam Kushwah
Gwalior Madhya Pradesh, India