Privacy Policy

Where your writing lives

Documents are stored in your browser (OPFS and IndexedDB) and, when you save or sync, in the destinations you pick: a local file or folder, your OneDrive, or your Google Drive. Cloud sync writes to your account under your login — the file goes from your browser to Microsoft or Google, not to us. OneDrive sync uses the standard file-access permission (Files.ReadWrite) so you can choose any folder; Google Drive uses the narrower per-file permission (drive.file). PDFs you attach to sources are stored the same way — on your device and in your own drives — and reading or annotating them happens entirely in your browser.

Your ledger (session tracking)

Inkwave can keep a ledger of how you work: when a writing session started and ended, how many minutes you were actively editing, word counts before and after, how many edits you made, the breaks between sessions, and whether the session was a Pomodoro block. It is off by default — you turn it on yourself, and can turn it off again, on the ledger page.

The ledger is a file kept in your own storage, exactly like your documents, and it is never sent to us. It records how you worked, not what you wrote: it contains no text from your documents.

We do not collect your location. Inkwave never asks for, reads, or stores your device's location, and asks for no location permission. You may optionally type a place label for yourself — "library", "home" — and, at the end of a session, a note about what you did. Those are words you choose to write, stored in your ledger on your device.

If you later use an AI report on your ledger, the times, word counts and edit counts are what it sees. Your session notes and place labels are not included unless you explicitly opt in, and the text of your documents is only included if you tick it on, per document.

What passes through our servers — and why

A few features need a server. Ours are stateless functions that process each request and keep nothing: no databases of your content, no logging of what you send. In each case this is the minimum the feature needs to work:

• Provenance signing — receives cryptographic hashes only: never your text, your words, or your identity. Hashes cannot be reversed into writing.
• Bitcoin timestamping — relays a single document hash to public OpenTimestamps calendars. Nothing personal is anchored.
• Optional AI features — see the next section; these are off until you switch them on.

We host on Vercel, which — like any web host — keeps standard, short-lived request logs (IP address, browser type) for its platform operations. We add no logging of our own on top of that.

Optional AI features (off by default)

Two features use AI, and both are explicit opt-ins — nothing is sent until you switch them on, and you're asked the first time before anything leaves your device:

• Snapshot summaries — sends snapshot text through our server to Anthropic (Claude) to describe what changed between versions.
• URL citation lookup — sends a cited page's address and content through our server to Anthropic to fill in citation details; it can also read a few pages of an attached PDF to detect printed page numbers.

In both cases our server processes the request transiently — nothing is logged or retained — and Anthropic does not train on data sent through its API. Both settings are switched off by default and can be adjusted at any time in Settings. As Inkwave develops we are also exploring browser-local AI models for these features, so that this data truly never leaves your device.

AI Integrity (developer preview only)

AI Integrity is still under development and is only intended for Inkwave’s developer at this stage. It is not an active public monitoring service. A developer build must show this warning before it asks for any account or browser permission. AI Integrity itself requires an Inkwave sign-in; ordinary Inkwave writing does not.

When deliberately enabled, the planned local browser extension observes only the memory or preference page of each AI account the developer explicitly connects. The developer-preview interval is once per minute while the browser is running and the provider remains signed in. It does not read conversations, browsing history, other tabs, or undisclosed accounts. Missed observations, sign-out, browser shutdown, and permission loss are recorded as gaps rather than guessed away.

Exact memory text, screenshots, account identifiers, and the provider login session stay on the developer’s own device. They are not sent to or retained by Inkwave’s servers. Unchanged observations reuse the existing local evidence instead of making another screenshot or copy every minute. Only cryptographic commitments may be sent to OpenTimestamps calendars for Bitcoin timestamping; those commitments do not contain the readable memory text.

An AI Integrity-enrolled document may require a short-lived signed monitor-health lease before it can be edited. If monitoring, permission, or the matching Inkwave login is unavailable, that document becomes read-only; reading and exporting remain available. The developer may deliberately continue in a new unprotected document identity and save destination; the original remains at its last certified state and Inkwave permanently records the fork rather than presenting it as continuous. A health service may receive the Inkwave account identifier, monitor-device public key, selected account fingerprints, chain-head hashes, counts, and lease times—never the memory text, screenshots, provider session, or document prose.

To connect the always-on Watcher computer to a separate Writer computer, the planned developer service retains a narrow cryptographic activity record: the Inkwave account ID, random AI Integrity document and device identifiers, public keys, signed memory-set and document hashes, chain heads, health/gap states, sequence numbers, lease/checkpoint receipts, and their times. This is server-retained metadata and can reveal when a monitored document changed or monitoring failed. It contains no document title, path, prose, readable memory, screenshot, provider response, or provider login token.

If a document changes across a monitoring gap, the service may refuse to certify that checkpoint. Inkwave still preserves already-accepted bytes locally and keeps reading, download, and export available; it does not destroy work because a monitor or network failed. Optional evidence viewing on the Writer uses device-to-device encryption, with the Watcher encrypting before upload so the relay cannot read it.

The resulting timeline can show what Inkwave observed on the connected accounts at particular times. It cannot prove that the provider applied a memory to a response, that nothing changed between observations, or that the user had no other AI account, device, or tool. Inkwave will not offer a cloud-hosted account monitor without a new consent design and a corresponding update to this policy.

Your work report

Inkwave can keep a record of how you work — how long you wrote for, how many words you added and deleted, when you took breaks — and, if you use them, a short note and a place label you type yourself at the end of a session. All of it stays on your device, in your own storage, exactly like your documents. A place is only ever the word you typed: Inkwave has no access to your location and never asks for it.

To get an AI's read on that record, Inkwave compiles a prompt and you run it in your own AI, then paste the reply back. Inkwave sends nothing — this path needs no account and no key, and it is free. You see the exact prompt before you copy it, and you choose what goes in it:

• Always included — how you worked: minutes, word counts, edits, breaks, and which document each session was in.
• Your notes and places — off unless you tick them. These are your own words about your day.
• The text of your documents — off unless you tick them, one document at a time, so you can share the essay and keep the journal to yourself.

The figures in your report are worked out and drawn by Inkwave on your device. They are never sent to an AI to be recalculated, and nothing an AI says can change them — its contribution is the written reflection, which is labelled as its assessment wherever it appears.

Other services your browser talks to

• Thesaurus — word suggestions come from the public Datamuse API: individual flagged words (never sentences or passages) are sent as lookups from your browser. We are exploring an on-device thesaurus in the coming weeks so these lookups never leave your machine.
• Citation registries — DOI, ISBN, arXiv and PubMed lookups go directly from your browser to CrossRef, Open Library, Google Books, arXiv and PubMed; each learns only the identifier you looked up. CrossRef and PubMed requests include our contact email, as those services request.
• Verification — checking a record at /verify runs entirely in your browser; nothing is uploaded. Confirming a Bitcoin timestamp queries two public block explorers for block information only.
• Citation styles — choosing a non-default citation style downloads the style file from a public CDN (jsDelivr).

What's in your exported file

A .studio file is self-contained by design — that's what makes it verifiable. It includes your full text, your complete snapshot history (including passages you later deleted), your word-swap record, signed receipts, and a random device identifier used to group sessions. Share it knowingly: anyone you give the file to can read all of it. Embedded PDFs can be stripped with one click before sharing.

The Inkwave extension

The extension is a separate, optional install. When you capture a page — by clicking the icon, pressing the keyboard shortcut, or revisiting a page you asked it to watch — it reads that page's address and content and sends them through our server to Anthropic to extract citation fields (title, author, date, publisher). As above, nothing is logged or retained on our servers, and Anthropic does not train on it. Identifier lookups (DOI, ISBN, arXiv, PubMed) go directly to the public registries. Captured citations are held in local extension storage until delivered to your Inkwave tab; a short-lived local history that powers "already in library" expires after five minutes. Unless you turn on web capture (below), the extension never reads your browsing history or other tabs' content.

If you turn on page fetching — a separate permission, offered once when you install it and revocable in your browser at any time — the extension fetches the sources you open in the reader from your own connection instead of from our server. Our server is then not involved at all and never sees those addresses. Nothing about what you read is sent anywhere, stored by the extension, or visible to us.

The same permission lets the reader show pages that would otherwise refuse to be displayed inside another page. To do that the extension removes those pages' framing headers — but only for frames Inkwave itself opens, only in the tab your reader is open in, and only while it is open. Pages you visit in your own tabs are untouched. One consequence is worth knowing rather than discovering: a site you are signed in to will appear signed out in the reader, because a browser does not send your session to a page shown inside another page.

Web capture is off unless you turn it on, both in the extension and for each document you want it for. While it is on, the extension records the searches and pages you visit while you are typing in that document (and for 30 minutes after), how long you spent on each page, and the text that was on your screen — leaving out menus, ads, anything you type into a page, and any page with a password box. Webmail and chat sites are recorded as the site name only. Private (incognito) windows are never recorded. This record is kept in your browser and in that document's own file, and travels wherever the document goes — your own OneDrive, Google Drive or folder. It is never sent to our servers. The exports marked safe to share leave it out. You can delete any entry, or the whole record, from the document's web trail.

Accounts and payments

Ordinary use needs no account. If you choose to sign in — through Clerk, our authentication provider — the only personal information we hold is your email address, used solely to identify your subscription; we never email you except to help you recover your account. Signing in supports Insignia, our paid deep-provenance tier, which is still in development. Payments are handled entirely by Stripe and PayPal; we never see your card or billing details.

What we don't do

No analytics, no tracking cookies, no advertising, no crash reporting, no telemetry. The app never reports anything about you or your session, and there is no usage data to sell or share. The only external services contacted are the ones named on this page, each receiving the minimum needed to do its job.

Contact

Questions about this policy: petergibson127@gmail.com