Privacy Policy

1. Introduction and Scope

InkForge ("we", "our", or "us"), developed and operated by Rivaan Kapoor, is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, store, share, and safeguard your information when you access or use the InkForge platform, including our website and all related services (collectively, the "Service").

By accessing or using the Service, you agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree, please discontinue use of the Service immediately.

This policy applies to all users of InkForge globally. Where applicable, we comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: When you register, we collect your name and email address.
• Profile Information: Display name, biography, location, website, social media handles, profile avatar, writing genres, and published books you optionally add.
• Writing Content: All text, drafts, projects, ideas, notes, and world-building entries you create and store in the Service.
• Communications: Messages, feedback, or support requests you send to us.
• Security Credentials: A locally-hashed vault PIN you optionally set to protect your writing space. This PIN is stored only on your device and is never transmitted to our servers.

2.2 Information Collected Automatically

• Usage Data: Writing session duration, word counts, session frequency, daily streaks, experience points (XP), currency, achievements, and challenge completions.
• Device and Technical Data: Browser type and version, operating system, device type, IP address, time zone, and general geolocation (country/region).
• Log Data: Pages visited, features accessed, errors encountered, and timestamps of interactions.
• Local Storage: We use your browser's localStorage to store autosave data, version history, vault PIN hashes, session preferences, and notification preferences. This data is stored solely on your device.

2.3 Information from Third Parties

• If you authenticate via a third-party identity provider (e.g., Google), we receive basic profile data (name, email) as authorized by that provider and your consent.
• We do not purchase or broker personal data from third-party data brokers.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve the InkForge platform and its features.
• Account Management: To create and manage your account, authenticate your identity, and process your requests.
• Personalization: To personalize your experience, including displaying your writing stats, progress, and recommendations.
• Gamification Features: To calculate XP, streaks, level progression, achievements, and daily challenges based on your writing activity.
• Email Notifications: To send you security alerts (e.g., new sign-in notifications, failed vault access attempts), streak risk alerts, daily challenge reminders, and achievement unlocks — subject to your notification preferences.
• Security and Fraud Prevention: To detect, investigate, and prevent unauthorized access, abuse, and other harmful activities.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.
• Analytics and Improvement: To understand how users interact with the Service and improve functionality, performance, and user experience.
• Communications: To respond to your inquiries, provide support, and send important service-related notices.

We do not sell, rent, or otherwise share your writing content or personal information with third parties for their marketing purposes.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases to process your personal data:

• Contractual Necessity: Processing necessary to provide the Service to you under our Terms of Service.
• Legitimate Interests: Processing for our legitimate business interests, such as security monitoring, fraud prevention, and service improvement, provided these interests do not override your fundamental rights.
• Consent: Where we rely on consent (e.g., marketing emails or optional notifications), you may withdraw that consent at any time via your account settings or by contacting us.
• Legal Obligation: Processing required to comply with applicable legal requirements.

5. Data Storage and Security

Your data is stored on secure servers operated by our infrastructure provider, Base44. We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of sensitive data at rest
• Access controls and authentication requirements
• Regular security reviews

Your vault PIN is hashed locally and stored only on your device. It is never transmitted to our servers and cannot be recovered by us. If you forget your PIN, you may reset it using your registered email address.

While we take commercially reasonable steps to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide you with the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, unless we are required by law to retain it longer, or unless it is necessary to resolve disputes, enforce our agreements, or comply with legal obligations.

Certain aggregated, non-identifying analytics data may be retained indefinitely.

7. Sharing of Information

We do not sell your personal information. We may share your information in the following limited circumstances:

• Service Providers: With third-party vendors and service providers who perform services on our behalf (e.g., infrastructure hosting, email delivery, AI processing). These parties are contractually obligated to use your information only as necessary to provide the requested services and to maintain appropriate security.
• AI Services: When you use AI-powered features (e.g., the Story Engine), your prompts and relevant context may be processed by a third-party AI model provider. We do not use your writing content to train AI models without your explicit consent.
• Legal Requirements: When required by law, subpoena, court order, or other governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred. We will notify you via email or a prominent notice on the Service prior to your information becoming subject to a different privacy policy.
• With Your Consent: In any other circumstances where you have given us explicit consent to share your information.

8. Cookies and Tracking Technologies

InkForge uses cookies and similar technologies to authenticate your session, remember your preferences, and analyze usage patterns. These include:

• Essential Cookies: Required for authentication and basic functionality. These cannot be disabled without impairing Service functionality.
• Preference Cookies: Remember your settings (e.g., theme, notification preferences).
• Analytics Cookies: Used to understand how users interact with the Service. This data is aggregated and not used to identify you personally.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

9. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal information we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal information.
• Erasure ("Right to be Forgotten"): Request deletion of your personal information, subject to certain legal exceptions. You may delete your account at any time from your Dashboard settings.
• Data Portability: Request a machine-readable copy of your personal data in a structured, commonly used format.
• Restriction: Request that we restrict processing of your personal data in certain circumstances.
• Objection: Object to processing based on legitimate interests, including for direct marketing.
• Withdraw Consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
• Opt-Out of Sale (CCPA): California residents have the right to opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, please contact us at the address below. We will respond within 30 days (or within the timeframe required by applicable law).

10. Email Notifications

We send transactional and security-related emails (such as sign-in alerts, failed vault access notifications, and PIN reset codes) as necessary for the security and operation of your account. These cannot be fully opted out of while your account is active, as they are essential to account security.

Optional notifications (streak reminders, challenge alerts, achievement emails) can be enabled or disabled at any time in your Dashboard under Email Notifications settings.

11. Children's Privacy

InkForge is not directed to individuals under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child without parental consent, we will take steps to delete that information promptly. If you believe we have collected data from a child, please contact us immediately.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home country. Where required, we implement appropriate safeguards (such as Standard Contractual Clauses) to ensure adequate protection of your personal data when transferred internationally.

13. Third-Party Links and Services

The Service may contain links to third-party websites, services, or resources (e.g., your verified social media profiles). We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you by updating the "Last updated" date at the top of this Policy and, where required by law, by providing additional notice (e.g., via email or a notice within the Service).

Your continued use of the Service after the effective date of any updates constitutes your acceptance of the revised Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: