Privacy Policy

This privacy policy describes how Inklyne, published by Inklyne SAS, collects, uses and protects your personal data in accordance with the General Data Protection Regulation (GDPR).

1. Data controller

The data controller is: Inklyne SAS
French simplified joint-stock company (SAS)
22 rue Rosa Bonheur, 33000 Bordeaux, France
contact@inklyne.app

2. Data collected

• Account: if you sign in with Google, the information passed on by Google at sign-in (email address, name, Google account identifier, profile picture where applicable). If you sign up with an email address: that address, your password, kept only as a salted Argon2id hash that cannot be read back, and the name you choose to give, if any.
• Content: the texts, projects, notes, journal entries and comments you save, together with their version history.
• Subscription: the state of your trial and subscription, and the customer identifier assigned by Stripe. Payment details (card numbers) are collected and stored by Stripe, never by Inklyne.
• Usage: writing sessions, progress, onboarding steps, preferences (language, theme).
• Technical: technical logs needed for the security and operation of the service (IP address, browser, timestamps).
• Audience measurement: browsing data collected by Google Analytics, only with your consent.
• Advertising measurement: data collected by Reddit (Reddit Ads Pixel and Conversions API), only with your consent.
• Error reports: technical error reports (error message, page address, browser user agent) sent to Sentry.

3. Google user data

When you sign in with Google, Inklyne requests only the openid, email and profile scopes.

• Data accessed: your email address, your name, your Google account identifier and, where applicable, your profile picture. Inklyne accesses no other Google data: no Gmail, Drive, Contacts or Calendar.
• Use: solely to create your account, to sign you in, to show your name and picture in the application, and to send you emails about the service.
• Who sees your name and picture: other Inklyne members, on your profile and in search results according to your profile visibility setting (by default, members can find you), and next to the sessions and comments you publish, for whoever can read them; and the beta readers and circle members you choose, and anyone you send your profile link to.
• Sharing: Google user data is never sold. It is never used for advertising or to measure advertising: it is not sent to Reddit or to Google Analytics. It is never used to train artificial intelligence models, and Inklyne does not send your email or profile picture to the AI tool you connect to it. It is shared only with the providers needed to run the service: Hostinger International Ltd (hosting), Scaleway (encrypted backups), Resend (email delivery) and Stripe (when you subscribe, email address only).
• Protection: Google user data is encrypted in transit (HTTPS), its offsite backups are encrypted, and access to it is restricted to the Publisher and the people it authorises to administer the service.
• Retention and deletion: Your account data is kept for as long as your account is active. It is erased from the Inklyne database 30 days after you delete your account, then disappears from backups as they expire: encrypted offsite backups are kept at most 400 days (about 13 months). If you subscribed, Stripe keeps the email address for its billing records. If you signed in with Google, you can also revoke Inklyne's access at any time from your Google account permissions.

Inklyne's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Purposes and legal bases

5. Service providers and recipients

Your data is not sold. It is processed by the following providers, each for the sole purpose stated:

Readings through your own Claude account. If you connect Claude (or any other compatible tool) to Inklyne through the connector, it can access the texts you ask it to read: you control what it reads. That processing is governed by the terms and privacy policy of Anthropic, or of the provider of the tool you chose; Inklyne is not responsible for it.

Beta readers and circles. When you share a manuscript or take part in a writing circle, the texts and comments concerned are visible to the people you have chosen.

6. Transfers outside the European Union

Some providers (Google, Stripe, Resend, Anthropic, Reddit) are established in the United States or may process data there. These transfers are covered by the safeguards provided for in Chapter V of the GDPR (adequacy decision or standard contractual clauses), according to each provider's contractual commitments.

7. Retention periods

• Account data and content: for as long as the account is active.
• Account deletion: the account is deactivated immediately, then its data is erased from the Inklyne database 30 days after the deletion, a period during which the deletion can be cancelled on request.
• Encrypted backups: encrypted offsite copies are kept 60 days for daily copies and 400 days (about 13 months) for monthly copies, then deleted automatically.
• Billing data: your subscription record is erased from the Inklyne database with the account; if you subscribed, Stripe keeps the customer record, including the email address, and your invoices, which Inklyne must keep for the statutory accounting retention period.
• Audience measurement: according to the retention period configured in Google Analytics.
• Advertising measurement (Reddit Ads, only with your consent):
  • the ad's click identifier, copied by Inklyne into the rdt_cid cookie: 30 days;
  • conversion event identifiers: 30 minutes;
  • the _rdt_uuid and _rdt_cid cookies (the latter only if you arrive from an ad), set by Reddit's script: 90 days, renewed on each visit where that script loads;
  • at a payment, _rdt_uuid, the click identifier and the event identifier are copied into the Stripe checkout session and kept by Stripe with that payment;
  • data received by Reddit (these identifiers, your hashed IP address and your browser information): according to Reddit's privacy policy.

8. Security

Exchanges with the service are encrypted (HTTPS). Database backups are encrypted before being stored off the main server. Access to the data is restricted to the Publisher and the people it authorises to administer the service.

9. Your rights

At any time, you can:

• access your data and export it (exporting your texts is available directly in the application),
• request its rectification or erasure (account deletion is available in your settings),
• object to processing based on legitimate interest,
• withdraw your consent (through the "Manage cookies" link at the bottom of the site or, once signed in, in Settings > Account, for audience measurement and advertising),
• exercise your right to data portability.

For any request: contact@inklyne.app

You may also lodge a complaint with the French supervisory authority (CNIL) if you believe your rights are not respected.

10. Audience and advertising measurement

Inklyne measures two different things, through two separate choices in the cookie banner. Nothing below runs until you have accepted the matching choice, and refusing either has no effect on how you use Inklyne.

• Audience measurement (Google Analytics, "Analytics cookies" choice). It counts visits to our public pages (home page, articles, pricing, FAQ, legal pages, the anonymous writing page) and to the sign-in and sign-up pages, and records the steps of the sign-up path, up to the moment a sign-in or sign-up completes. It collects the pages viewed and those steps, together with the identifiers and technical data Google Analytics sets with your consent (such as a cookie identifier and browser information). It never runs inside the application, and it receives no writing content and no email address. Before you accept, the Google Analytics script is not even loaded. We also test two versions of the home page: which one you saw is attached to these Google Analytics events, and remembered in the cookie described in section 11.
• Advertising measurement (Reddit, "Advertising cookies" choice). It tells us whether a Reddit campaign led to a sign-up. The Reddit Ads Pixel runs on the same public pages as Google Analytics. When you sign up, start a trial or subscribe, Inklyne also reports that event to Reddit from its own servers (Reddit Conversions API), only if you had accepted advertising when you arrived. What is sent: the type of event (and, for a subscription, the amount and currency), the Reddit identifiers collected by the pixel or the campaign link, your browser's user agent and your IP address in hashed form. Your email address, your name and your writing are never sent.
• Legal basis: your consent. You can withdraw it at any time with the "Manage cookies" link at the bottom of the site or, once signed in, in Settings > Account (section "Cookies and measurement"); the change applies from then on.
• Where the data goes: Google and Reddit are service providers listed in section 5; their transfers outside the European Union are covered in section 6. The retention periods are in section 7.

Separately, when the application fails, a technical error report (error message, page address, browser user agent) is sent to Sentry, our error-monitoring provider, so that we can fix the problem. It contains no writing content and does not depend on the cookie banner; its legal basis is our legitimate interest in keeping the service working.

11. Cookies

Inklyne uses:

• technical cookies necessary for operation (session, preferences, security),
• audience-measurement cookies (Google Analytics), only with your consent,
• the hero-variant cookie, only if you have accepted the analytics choice: it remembers which of the two versions of the home page you saw (a or b) for 30 days, so that you keep seeing the same one and so that this version is attached to the Google Analytics events. It is erased if you withdraw your consent,
• advertising cookies (Reddit Ads), only with your consent, to measure the performance of Reddit campaigns.

A banner lets you customise your preferences at any time, with the "Manage cookies" link at the bottom of the site or, once signed in, in Settings > Account.

Your choice, whether you accept or refuse, is kept for 6 months; after that, the banner asks you again. For a choice made before this update, the 6 months run from your first visit after it.

12. Changes to this policy

The Publisher may modify this policy. In case of substantial changes, users are informed by email or via the site.