Inklings Privacy Policy — DRAFT

DRAFT DOCUMENT — NOT YET IN EFFECT

This privacy policy is a working draft and has not been reviewed by legal counsel. It must undergo professional legal review before publication or enforcement. Do not publish or rely on this document as-is.

Effective Date: [TBD — to be set upon legal review and publication]

Last Updated: [TBD]

1. Introduction

Inklings (“we,” “our,” or “us”) is a desktop writing and note-taking application developed by Overlund Media Group. This Privacy Policy explains what data we collect, how we use it, and your choices regarding your information.

Inklings is designed with a local-first architecture. Your content is stored on your device by default, and cloud features are entirely opt-in.

2. What Data We Collect

2.1 Data Stored Locally on Your Device

When you use Inklings, the following data is created and stored locally on your computer:

• Your content: Pages, blocks, and notes you create, stored in a local SQLite database.
• Workspace metadata: Workspace names, page hierarchy, and organizational structure.
• Application settings: Your preferences and configuration choices.
• Content history: Event log entries and CRDT operation history for undo/versioning purposes.

This data never leaves your device unless you explicitly enable cloud sync (see Section 3).

2.2 Data Collected When You Create an Account

If you choose to create an account for cloud sync, we collect:

• Email address: Used for authentication and account recovery.
• Authentication credentials: Managed securely through our authentication provider (see Section 5).
• Account identifiers: A unique user ID associated with your account.

2.3 Data We Do Not Collect

• We do not use third-party analytics or tracking services.
• We do not collect usage telemetry by default.
• We do not serve advertisements or share data with advertisers.
• We do not sell your personal information to any third party.

2.4 Future Analytics (Planned)

We plan to introduce optional, pseudonymous analytics in a future release. This system is designed to be:

• Offline-first: Events are queued locally and only transmitted when you are online.
• Pseudonymous: No personally identifiable information is attached to analytics events.
• Opt-out: You will be able to disable analytics entirely from application settings.

This section will be updated when analytics features are implemented.

3. Data You Choose to Sync

3.1 Cloud Sync Is Opt-In

Cloud sync is an optional feature. If you do not create an account or enable sync, none of your content is transmitted to our servers.

3.2 What Is Synced

If you enable cloud sync, the following data is transmitted to and stored on our cloud infrastructure:

• Page content and metadata: The pages, blocks, and organizational structure you choose to sync.
• CRDT operations: Conflict-free replicated data type (CRDT) operations that enable multi-device editing.
• Sync metadata: Timestamps, device identifiers, and cursor positions needed to keep devices in sync.

3.3 How Synced Data Is Protected

• Data is transmitted over encrypted connections (TLS/HTTPS).
• Cloud data is stored in a managed database with row-level security policies ensuring that only you can access your data.
• Authentication tokens are required for all cloud operations.

4. How We Use Your Data

We use the data described above solely for the following purposes:

• Providing the application: Storing and displaying your content locally.
• Cloud sync: If enabled, keeping your content synchronized across your devices.
• Authentication: Verifying your identity when you sign in to cloud features.
• Improving the application: If you opt in to future analytics, understanding aggregate usage patterns to improve Inklings.

We do not use your content for training machine learning models, advertising, or any purpose unrelated to providing and improving the Inklings application.

5. Third-Party Services

5.1 Supabase (Authentication and Cloud Sync)

We use Supabase to provide authentication and cloud sync services. When you create an account or enable cloud sync, your authentication credentials and synced content are processed by Supabase’s infrastructure. Supabase’s privacy practices are governed by their own privacy policy.

5.2 OAuth Providers

If you choose to sign in using a third-party OAuth provider (such as Google or GitHub), that provider may share limited profile information (such as your email address) with us in accordance with their own privacy policies. We only use this information for authentication purposes.

5.3 No Tracking Services

We do not use any third-party tracking, advertising, or analytics services (such as Google Analytics, Mixpanel, or similar).

6. Data Retention and Deletion

6.1 Local Data

Your local data is stored on your device and is entirely under your control. You can delete it at any time by:

• Deleting individual pages or workspaces within the application.
• Removing the application data directory from your computer.
• Uninstalling the application.

6.2 Cloud Data

If you have enabled cloud sync:

• You can delete synced content through the application, and deletions will propagate to the cloud.
• You can request deletion of your cloud account and all associated data by contacting us (see Section 10).
• Upon account deletion, your synced content will be removed from our cloud infrastructure.

6.3 Authentication Data

If you delete your account, your authentication credentials and associated account information will be removed from our authentication provider.

7. Data Security

We implement reasonable technical and organizational measures to protect your data, including:

• Local data is stored in SQLite databases on your device, protected by your operating system’s file permissions.
• Cloud communications use TLS/HTTPS encryption in transit.
• Cloud data is protected by row-level security policies.
• Authentication uses industry-standard protocols (OAuth 2.0, magic links, or email/password with secure hashing).

No method of storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Children’s Privacy

Inklings is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

9. Your Rights

Depending on your jurisdiction, you may have rights regarding your personal data, including:

• Access: The right to know what data we hold about you.
• Correction: The right to correct inaccurate data.
• Deletion: The right to request deletion of your data.
• Portability: The right to export your data in a usable format.
• Objection: The right to object to certain data processing activities.

Because Inklings is local-first, most of your data is already under your direct control on your device. For cloud data, contact us to exercise these rights (see Section 10).

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will:

• Update the “Last Updated” date at the top of this document.
• Notify you of significant changes through the application or other reasonable means.

Your continued use of Inklings after changes take effect constitutes acceptance of the updated policy.

11. Contact Information

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Overlund Media Group

Reminder: This document is a DRAFT and requires professional legal review before use. It is provided as a starting point and should not be treated as legal advice or a finalized policy.