Privacy Policy

Last updated 20 September 2026

This explains what Inkprint collects, why, and what we deliberately do not collect. The short version: we process your document to produce a report, we do not keep it, and we run no advertising trackers.

1. What we collect

• Documents you upload. Read in memory to extract metadata and compute statistics, then discarded. We do not write your document to disk and we do not retain its contents.
• Writing Room sessions. Your draft is held in your own browser's local storage. When you choose to certify, your browser sends us a hash chain of timing events and the statistics derived from it, plus a SHA-256 hash of the finished text. The text of your draft is not transmitted to us.
• Certificate records. For each certificate: a document hash, the file name you supplied, evidence signals, statistics, timestamps, and the signature. This is what makes a certificate verifiable, so it is retained permanently.
• A visitor identifier. A random value in a first-party cookie, used only to track the free certificate allowance and any credits you have purchased. It is not linked to your identity unless you buy something.
• Payment information. Handled entirely by Stripe. We never see or store your card number. We receive your email address and the plan purchased.
• Anonymous aggregate counters. How many times the Writing Room was opened, how many sessions were completed, total words, longest session, and sessions per day. No content, no identifiers, no IP addresses.
• Standard server logs. Retained briefly by our hosting provider for security and debugging.

2. What we do not do

• We do not sell or rent your data to anyone.
• We do not run third-party advertising or cross-site tracking scripts.
• We do not use your documents to train models.
• We do not publish your document, your file names, or your identity in the registry.
• We do not build profiles of you.

3. Why we are allowed to process it

Where the GDPR or UK GDPR applies: processing a document you upload is necessary to perform the service you requested (contract). Issuing and logging a certificate is necessary for the same reason, and for our legitimate interest in making marks verifiable and tamper-evident. Payment records are processed to meet legal and accounting obligations. Aggregate counters rely on our legitimate interest in understanding whether the product works. We rely on your consent where required, and you may withdraw it.

4. Who else is involved

• Stripe - payment processing and receipts.
• Our hosting provider - servers located in HOSTING REGION.
• Let's Encrypt - TLS certificates for the site.

We do not use an email marketing platform, because we do not send marketing email.

5. How long we keep things

Uploaded documents: not at all. Writing Room drafts: in your browser until you clear them. Certificates and log entries: permanently, because a verifiable record that can be deleted is not verifiable. Payment records: as long as tax law requires.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to complain to a supervisory authority. Because uploaded documents are not retained, there is usually nothing to delete but a certificate record; where a certificate contains your name or file name and you want that removed, contact us and we will discuss what is possible without breaking the log's integrity - the cryptographic entry cannot be removed, but the identifying detail can.

7. Security

The site is served over TLS. Certificates are signed with an Ed25519 key held on the server and never exposed. We cannot protect against everything, and you should not upload material whose disclosure would cause you serious harm.

8. Children

The Service is not directed at children under 16.

9. Changes and contact

We will update the date above if this policy changes. Questions or requests: CONTACT EMAIL.