Privacy notice

1. Controller and contact

This notice applies to inkForm Studio. Contact us by email with questions about your data or requests for deletion.

2. Visiting the website

The website is delivered through OpenAI's Sites platform and its Cloudflare infrastructure. This involves data such as your IP address, requested address, time, browser and device information, and technical errors where applicable. These are processed to deliver, troubleshoot and protect the website.

To select the interface language automatically, the studio requests a country code from a technical endpoint on the same website. It does not request precise location access or GPS for this purpose. Your manual language choice takes priority.

Further information: OpenAI privacy policy and Cloudflare privacy policy.

3. Handwriting, input and local storage

The studio processes captured pen strokes, letter and word variants, pasted text and formulae, and selected diagram images in your browser. Photo text recognition runs locally; its software and language models are loaded from this website. The current application does not send this studio content to an AI or cloud storage service.

Handwriting, worksheets, import history and preferences are saved in your browser, particularly in localStorage. They generally remain until you or the browser delete them. An image in the recognition workspace is initially processed in memory; inserted strokes may become part of your saved worksheet.

Local data belongs to this browser profile, not to your Inkform account. On shared devices it may therefore remain visible after signing out. Back up important content before clearing website data. Files you export and content you send to another app using “Share” are also subject to that app's processing and your settings there.

Sign-in stores session credentials separately in your browser’s localStorage so you can stay signed in for up to 14 days. If this storage is blocked, sign-in lasts only for the browser session. Explicitly sign out on shared devices. The current application does not embed its own advertising pixels or marketing analytics tools.

4. Accounts and email codes

Signing in is optional: you can use the studio without an account. An account requires your email address. Supabase Auth manages your account ID, email confirmation, sessions and technical authentication events, such as times and IP addresses. Sign-in codes are delivered by email. This method does not require you to choose a password.

The data is used to create and manage the account you request, verify sign-in and prevent abuse. If you sign in with Google, Supabase Auth receives your email address and a Google account identifier to link your sign-in to your account. Creating an account does not automatically upload your locally saved handwriting or worksheets.

5. Authentication services and recipients

• Supabase Auth: Supabase Pte. Ltd., Singapore, processes account and authentication data for us. International operations and support access are possible. Processing and transfer safeguards are described in its Data Processing Addendum and privacy notice.
• Resend: Plus Five Five, Inc., USA, delivers sign-in emails. It processes recipient and sender addresses, message content including the code, and delivery information. Ireland is the sending region; this does not mean EU-only storage. Resend stores customer data in the USA. Further information and transfer safeguards: Resend GDPR information and Data Processing Addendum.
• Cloudflare Turnstile: Opening sign-in loads a security check from Cloudflare, Inc., USA. It processes IP addresses, browser and connection signals, and the website origin. The result is passed to Supabase. Cloudflare also processes signals as an independent controller to improve bot detection. See the Turnstile Privacy Addendum.

These services may process data outside the European Economic Area. The providers explain their safeguards, including EU Standard Contractual Clauses and applicable adequacy decisions, in the linked privacy and contractual documents. You can also request a copy of the safeguards relevant to the processing through our contact address.

6. Purposes and legal bases

We rely on Article 6(1)(b) GDPR to provide the studio and account functions you request. Secure delivery, troubleshooting and protection against automated attacks rely on Article 6(1)(f) GDPR. Our legitimate interest is reliable and secure operation of the studio and sign-in.

Where device storage or access is strictly necessary for functions you explicitly request, particularly saving your work and managing authentication, it is based on section 25(2)(2) of Germany's TDDDG. This does not authorise advertising tracking.

An email address is required for an account, but is not a statutory requirement or a prerequisite for guest use. The security check may block sign-in if it detects suspected bots. The application does not provide advertising profiling or other automated decisions producing legal or similarly significant effects.

7. Retention and deletion

• Local work and preferences: until you delete them in the application or through your browser's website data controls, the browser removes them, or new content replaces them. Account deletion does not automatically remove this data.
• Account data: while the account exists. Request deletion by emailing the address above. If particular data is still needed to fulfil a legal obligation or investigate a specific security incident, it is retained only for that purpose and its duration.
• Codes and sessions: codes stop working after the validity period configured in the authentication service. This does not delete emails already sent. The app removes session credentials from browser storage when you sign out or when it first checks the session after 14 days. Server security logs are separate.
• Email delivery: Resend specifies 30 days for email and log data on its regular Free, Pro and Scale plans. Messages in your own mailbox remain according to its settings.
• Technical operations and security data: needed to troubleshoot errors, detect attacks and investigate specific incidents. Retention follows those purposes and the operational and backup retention periods of the services used. Contact us for information about a particular processing event.

8. Contact and external services

If you email us, we process your sender address, message and any voluntary information to handle your request. The email providers of the mailboxes involved also process the communication. Article 6(1)(b) GDPR applies to service or account requests; otherwise Article 6(1)(f) GDPR applies to handling correspondence. We keep the request for as long as needed to handle it and resolve follow-up questions; statutory retention obligations remain unaffected.

If you use an additional prompt in an external AI service or open an external link, that provider's notices apply. Copying a prompt alone does not send your studio content to that provider. Payments are not integrated into this version.

9. Your privacy rights

Subject to the legal conditions, you have rights of access, rectification, erasure, restriction and data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may withdraw any consent you have given at any time for the future.

Contact arda.guendogankr@gmail.com. Do not send sign-in codes or passwords. Handling an account request may require appropriate verification that you are entitled to make it.

You may complain to a data protection supervisory authority, particularly where you live or work. For the operator in North Rhine-Westphalia, you can contact the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information.