Privacy Policy for Inkwell

Rundquist Tech LLC ("we", "us", or "our") respects your privacy and is committed to protecting it through this Privacy Policy. This policy describes the types of information we collect, how we use it, and your rights.

This policy applies to your use of the Inkwell apps — the Inkwell macOS application and the Inkwell Reader for iPhone and iPad — along with their connected features and services (collectively, "Inkwell") — to our website, inkwell.app (Section 1d), and to the pages where people read drafts shared with them, share.inkwell.app (Section 2d).

The Inkwell apps do not track you across other companies' apps or websites. We do not sell your data, and we do not use your scripts to train any AI model. Our website measures whether our ads lead to downloads; Section 1d explains exactly what that involves and how to turn it off.

1. Information We Collect

a) Required Telemetry

We collect a minimal set of technical signals essential for operating and improving Inkwell. This includes:

• App launches, quits, and unexpected terminations
• App version and version-install events
• Crash reports, hang reports, and error logs
• Platform and device model (e.g., "iPhone 17 Pro", "macOS 14")
• Performance diagnostics
• Writing-session counts and durations (how long a session lasted and why it ended). Never the words you write

These signals are collected automatically and cannot be disabled, as they are necessary for app stability, debugging, version-adoption tracking, and understanding overall product engagement. They never include the content of your scripts.

Activation counts from the Mac app. The Inkwell macOS app always sends a few anonymous counts about getting started, such as whether setup finished, whether a first page was written, and whether Quill was opened. These are sent even if you decline analytics (Section 1b). Each one carries only what happened, your app version, roughly how long ago Inkwell was installed, and a random token. Each install carries that random token so we can tell how many installs reached each step. It is not tied to your account, your device or your name, it is created fresh on a new install, and none of your writing is attached. They are relayed through Inkwell's own server, so our analytics provider never receives your IP address, and our server doesn't store it. We only look at totals, like how many new installs finished setup this week, so we can see where new writers get stuck.

If you are signed in, your writing sessions are also saved to your account so we can show your writing time and streaks back to you. That record contains more than the anonymous signal above — see Section 1c.

b) Optional Usage Analytics

Inkwell collects anonymized usage data to help us understand how the apps are used. This includes:

• Feature usage (e.g., which tools are accessed most frequently)
• File-format breakdown (e.g., proportion of .ink vs .fountain vs .pdf vs .fdx opened)
• UI interaction patterns (e.g., which themes and reading sizes are selected)
• Quill AI prompt types (kinds of queries, never the prompt text itself)

These analytics are tracked using PostHog and are tied to a non-personally identifiable, randomly generated install ID. They never include the content of your scripts.

Default behavior: Inkwell Reader for iPhone and iPad has anonymous analytics enabled by default on first launch; the Inkwell macOS app has them disabled by default. In both apps you may enable or disable usage analytics at any time in the app's Settings → Privacy panel. Disabling analytics fires a one-time opt-out event so we have an audit trail of your choice.

Analytics never include your script content. Disabling analytics does not affect the required-telemetry signals listed above, which we need to keep the app stable.

c) Writing Activity on Your Account

When you are signed in, Inkwell records each writing session to your account. This is what powers the writing time, daily streak, and per-script breakdown shown on your Inkwell profile. Unlike the analytics in Section 1b, this is a first-party record tied to your account rather than an anonymous ID, and it is not affected by the analytics toggle — turning analytics off does not stop it, because it is a feature you are using rather than measurement we are doing.

Each session record contains:

• When the session started and ended, and how much of it was active vs. idle
• Your document's word count at the start and end of the session, and the difference between them
• The title of the script you were working on, so your profile can show what you have been writing
• An identifier for the document, so we can tell one script apart from another and group your sessions by project. The app determines this from the file's location on your device, but that location is scrambled before it is stored — what we keep is a fixed-length code that cannot be turned back into a path, folder name, or the account name on your computer. We cannot read it, and neither could anyone who obtained the database.
• Your platform and app version

We never record the words you write. Session records are kept for as long as your account exists and are deleted when you delete your account (Section 6).

If you are signed out, none of this leaves your device — writing time is tracked locally only.

d) Our Website (inkwell.app)

The website uses a few cookies and similar browser storage. What runs before you make a choice in the cookie banner depends on where you appear to be. We work that out from your browser's time zone; we don't look up your location ourselves. Google's tag also applies Google's own check based on your IP address, so for Google's tag either check placing you in Europe is enough. Our other tags — PostHog and advertising tags without a cookieless mode — rely on the time-zone check alone.

• If your browser's time zone is in the EU, the wider EEA, the UK, or Switzerland — or doesn't tell us where you are — no analytics or advertising cookies are set and PostHog doesn't load until you choose "Accept all". Google's tag, which has a cookieless mode, still loads, but sets no cookies and sends only cookieless signals; advertising tags without a cookieless mode don't load at all. We also remove ad click identifiers from the page address before any of these tags load, so none reach our analytics.
• If your time zone is anywhere else, website analytics and ad measurement are on until you choose "Necessary only" or "Reject" — in the banner or in the Cookie preferences at the top of this page. We remember that choice. Google's tag still treats you as in Europe if Google's IP check says so, but our other tags don't: if you are in Europe and your device uses a non-European time zone, choose "Necessary only" or "Reject" to turn them off.

What we measure. Which pages you visit and whether you click Download, using PostHog (product analytics) and Google Analytics. Until you choose "Accept all", PostHog keeps its visitor ID in memory only — it is forgotten when you close the tab — and sets no cookies. Google Analytics and our advertising partners' tags set their own cookies when the rules above allow it.

Ad measurement. We advertise Inkwell on ad platforms — our "advertising partners", the ad networks we run campaigns on (Section 4). If you arrive from one of our ads, the link carries a click identifier that the ad platform created. That platform's tag on our site keeps the identifier in a cookie and, when you download Inkwell or create an account, tells the platform that happened, so we can see which ads work. Reddit's tag also reports each page you visit on our site where ad measurement is allowed (never the sign-in, account, purchase, or gift-link pages), so Reddit can tell which ad visits arrived and build audiences of site visitors. The platform receives: that a download, sign-up, or (for Reddit) page visit happened; the address of the page you were on and of the page you came from (Google's tag receives the full address, including its query parameters; other partners' tags receive only our site and the page path, plus — for Reddit's tag — the campaign details and its click identifier from the link); its click identifier and a random browser ID its tag set; and the standard information every browser sends (such as your IP address and browser type). Gift-link codes are never included. Our site blocks, or has switched off in each partner's settings, automatic form and user-data matching, so they don't receive your name, your email, or anything you write. Google's tag runs on every page, in its cookieless mode until you consent. Advertising tags without a cookieless mode load only with advertising consent under the rules above, never report from sign-in, account, purchase, or gift-link pages, and never load when Global Privacy Control is on. We also keep the click ID and campaign name in your browser's session storage for the rest of your visit (it is gone when you close the tab) and attach them to our own download analytics. The download link itself carries only a coarse label — such as "ads", "referral", or "direct" — and the campaign name, never a click ID. We don't let advertising partners use your visit for ad personalization (remarketing) unless you choose "Accept all".

Turning ad measurement off. Choose "Necessary only" or "Reject" in the banner or in the Cookie preferences at the top of this page. From then on our advertising partners' tags send no further measurement; where a tag supports it, we also tell it to delete the identifiers it stored (it keeps a small record that you said no). A tag that has already loaded stays in the open page's memory until you leave or reload, but sends no further measurement. On later visits, advertising tags without a cookieless mode don't load at all, and Google's tag runs only in its cookieless mode.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of sharing for advertising: advertising cookies stay off, advertising tags without a cookieless mode don't load, any that do load send only cookieless signals, and we remove ad click identifiers from the page address before they load — even if you choose "Accept all". PostHog waits until you choose "Accept all". Global Privacy Control does not turn off website analytics; to do that, choose "Necessary only" or "Reject".

Server logs. Like any website, our web server's request logs record your IP address, your browser, and the full address of the page or file you requested — including any parameters in an ad link, such as an ad click identifier or campaign name. We use them for security and operations, and to count downloads by that coarse label. They are deleted automatically after 30 days.

Download counts. When you download Inkwell, we also keep a counter record: the date, which version, the coarse label and campaign name from the link, and your device type (such as Mac, Windows, or iPhone). It contains no IP address, no browser details, no click ID, and nothing that identifies you, and it can't be linked to an Inkwell account.

How you found us. When you create an Inkwell account on our website, we save with your account how that visit began: the coarse label, the campaign details in the link (such as source and campaign name), the page you landed on, and the name of the website that sent you (never the full address). If you chose "Accept all" and your browser isn't sending Global Privacy Control, we also save the ad click ID. We use this only to understand which of our marketing works, and it is deleted when you delete your account. The one exception: if that ad click ID is Reddit's, our server tells Reddit that an account was created, sending only the click ID, a random event ID and the time — never your name or email.

2. Content and Data Handling

a) Script Content

Inkwell is local-first, and that has not changed. Your scripts live on your device as ordinary files. Nothing is uploaded to our servers unless you explicitly turn sync on, and you turn it on per document.

There are three exceptions to "we don't store your scripts," and we want to be specific about each rather than leave them under a blanket claim. The first is encrypted sync, described just below. The second is the small conversation memo we keep when you chat with Quill — see Section 2c. The third is an encrypted shared draft, stored when you share a draft with readers — see Section 2d.

If you turn sync on for a document, we store a copy of that document on our servers. It is encrypted on your device before it is sent, and it stays encrypted in transit and at rest on our servers. The key that unlocks it is derived on your own devices and never leaves them — we do not have it, cannot ask for it, and cannot read your script. But the encrypted bytes are on our servers, and we would rather say that plainly than keep describing this as though nothing is stored.

This is not the same as your files being encrypted on your Mac or iPhone. A synced document that has been downloaded to a device is an ordinary, unencrypted file there, protected by your operating system and whatever disk encryption you use (e.g. FileVault), the same as every other file you own. What our encryption protects is the copy we hold.

What we can see about a synced document. The contents, title, folders, and tags are encrypted and opaque to us. Some things are deliberately not encrypted, because a device that has not been unlocked yet still has to be able to show you an honest picture of your library:

• How many documents you have synced
• The size in bytes of each document, and of each saved version
• When each was created, changed, and last synced
• How many versions of it we hold
• The names you give the devices you enroll (e.g. "James's MacBook Pro"), and which device saved which version

So we can tell that an account has 14 documents totalling 6 MB and that one of them changed on Tuesday from a laptop. We cannot tell what any of them say, or even what they are called.

Removing a synced document. There are two separate actions. Remove from sync stops syncing the document and keeps everything, and is reversible. Delete from cloud destroys our copy immediately — there is no grace period, no retention window, and no way to undo it. Every encrypted version of it is erased from our servers on the spot; what remains is a receipt noting that a document of that size was deleted and when, so we can answer "what happened to my script?" later. Deleting your account destroys your synced copies the same way (Section 6).

In every one of those cases, the file on your own device is left exactly where it is. Inkwell never moves, renames, or deletes a document file on your disk.

Separately, when you use Quill:

• Portions of your script may be transmitted to third-party language-model providers (e.g., OpenAI, Google Gemini) so the model can respond to your questions about the script.
• Those providers may temporarily retain the content as required for processing, subject to their own privacy policies.
• We do not use your content to train or fine-tune any model.
• Quill on iPhone and iPad is read-only — it discusses the script but cannot edit it. The agentic editor lives on macOS.

Quill is opt-in: it activates only when you sign in and chat. Sync is opt-in too, and also requires an account. If you never sign in, no script content leaves your device.

b) AI Responses

We may store the results of your AI interactions (e.g., suggestions, completions) for the purpose of:

• Debugging
• Crash reproduction
• Product improvement

c) Quill Conversation Memos

Quill conversations themselves stay on your device — we do not keep a copy of every message. But so that a long conversation does not lose its thread, we store a small summary for each Quill thread on our servers, updated as you chat. It is written by a language model from your recent turns and can include:

• Characters that have come up, and short notes about them
• Story beats and decisions you and Quill have settled on
• Open questions the conversation has not resolved
• Preferences you have expressed about how you want to work

This is derived from your creative work, and it is stored against your account and the thread it belongs to. We are calling that out directly because an earlier version of this policy said stored AI results were "not linked to your script content or identity," and for these memos that was not accurate.

Memos are used only to give Quill continuity within your own conversation. They are not used to train models, are not shared between accounts, and are deleted when you delete your account (Section 6). If you never use Quill, no memo is ever created.

d) Shared Drafts

From the Inkwell macOS app you can share a draft with readers for notes. Each reader gets their own link, opens it in a web browser at share.inkwell.app, and can leave notes on the script. Readers do not need an Inkwell account and never sign in. Sharing requires the writer to be signed in; it does not require sync. This section covers both the writer who shares and the people who read.

The draft and the notes are encrypted. When you share, the Mac app makes a fixed copy of the script's pages and encrypts it on your Mac before uploading it. Readers' notes, and your replies, are encrypted the same way. The key needed to read them is carried in the part of the link after the "#", which browsers do not send to any server, and on your Mac. We store only the encrypted copy and encrypted notes, and we cannot read either. If you set a passphrase on a link, we store only a value derived from it that lets us check a reader's attempt; we cannot recover the passphrase from it, and it is not enough on its own to read the script. The shared copy leaves out your inline notes, revision marks, unaccepted Quill suggestions, and authorship history.

What we can see about a shared draft. Some information is not encrypted, because we need it to run the links:

• The reader name you give each link (for example, "Sam"). We store it in plain text so it can be shown on that reader's notes. Choose a name or nickname you are comfortable with us holding.
• Which account created each link, which document it came from (as an internal identifier, not a file path or title), the number of pages and size of the encrypted copy, and when each link was created, when it expires, and whether it was revoked or protected by a passphrase
• For each note: when it was posted, changed, resolved, or deleted, whether it came from a reader or the writer, and which link it belongs to — but not what it says or which passage it is on

Read receipts. The reader page reports a small set of events for each link: that the draft was opened, the furthest page reached, that the reader finished, that a note was posted, and that one of the page's small links to Inkwell was clicked — recorded only by where that link sits (the cover, the end of the draft, or the one-time message after a reader's first note). These carry no script content. We store them against the link so the writer can see, in the Mac app, when each reader opened the draft, how far they read, whether they finished, and how many notes they left; link clicks are counted but not shown to the writer. The reader is told this on the draft's cover before they start reading. We also forward each event to our product analytics provider, PostHog, from our own server, attached to the writer's account identifier with a shortened one-way hash of the link, the page numbers and, for a link click, where the link was placed. We never send PostHog the link, the reader's name, any part of the URL, or the reader's IP address. Because these receipts are part of the feature, they are not affected by the app's analytics toggle (Section 1b).

IP addresses. To stop abuse and password guessing, our server uses the IP address of each request to a shared draft to apply rate limits — for example, a cap on wrong passphrase attempts per hour. These counters are kept briefly in memory and are not stored with the draft, the notes, or the receipts. Separately, our hosting provider's request logs record the address of each request, which includes the part of the link that identifies it (never the part after the "#" that holds the key), along with the IP address; these are kept for security and operations.

The reader page runs nothing from anyone else. It sets no cookies and loads no third-party scripts, analytics, fonts, or ads; it talks only to Inkwell's own server. It keeps a few things in the reader's own browser storage so a returning reader isn't asked for the passphrase again and can pick up where they left off: the key for that link, their text size and theme, their reading position, and any note they started but didn't send. Clearing the browser's site data removes them.

Keeping the title out of view. While a draft is open, the browser tab reads "Draft from" and the writer's first name, not the script's title, so the title stays out of the reader's browser history; previews of a shared link in messaging apps say only "A script draft, shared with you". Links from the reader page to inkwell.app open in a new tab, carry only a label for where the link was placed, and never pass on the shared link, its key, or anything about the script.

Who can read a shared draft. Anyone who has the full link (and the passphrase, if one is set) can read the draft and leave notes. A forwarded link works for whoever receives it, and notes left through it carry the reader name you chose for that link. Revoking or letting a link expire stops it from opening again, but cannot remove a copy someone has already read. If a link has notes set to "visible to all readers", readers of the draft's other shared links can see those notes and the reader names on them.

How long we keep it. Links last 7, 30, or 90 days (the writer chooses, and can extend or revoke them). Once every link to a shared copy has expired or been revoked, we delete the encrypted copy 14 days later. We keep the notes for a further 90 days so the writer can still receive late ones, then delete the notes, the links, the reader names, and every remaining record of that share. A reader can delete their own note at any time, which erases its encrypted text right away. Deleting your account deletes everything you have shared, immediately (Section 6). Notes the writer has already received are stored on the writer's Mac, separately from the script file.

3. On-Device Data (Inkwell Reader for iPhone & iPad)

The iOS Reader stores the following entirely on your device. None of it is uploaded to our servers:

• Recents list — file names and last-opened timestamps for documents you've opened, plus a security-scoped bookmark so the file can be re-opened.
• Scroll position — the last-viewed paragraph in each document, so you return to where you left off.
• Sides selection — which character(s) you've chosen for the sides view, per document.
• Reading preferences — your theme and reading-size choices.

Files opened from Files.app, iCloud Drive, or AirDrop are accessed in place via Apple's security-scoped bookmark system. We never copy a script's contents into our servers.

4. Use of Third-Party Services

Inkwell uses the following service providers:

• Google Firebase – for authentication, account management, and messaging
• Sign in with Apple and Sign in with Google – optional authentication providers. We receive only your email and a user identifier; we never see your provider password.
• PostHog – for anonymous product analytics. In the apps, subject to your in-app Privacy toggle (Section 1b); on the website, subject to your cookie choice (Section 1d). Read receipts for shared drafts are forwarded from our server as described in Section 2d; the share page itself never loads PostHog.
• Google Analytics – website analytics on inkwell.app, subject to your cookie choice and Global Privacy Control (Section 1d). Not used in the apps.
• Advertising partners (currently Google Ads, OpenAI's ChatGPT ads, and Reddit Ads) – ad conversion measurement (and, for Reddit, page visits) on inkwell.app, only with advertising consent and never with Global Privacy Control (Section 1d). Not used in the apps.
• OpenAI, Google Gemini, Anthropic, and other LLM providers – for Quill AI-driven features. Engaged only when you actively use Quill chat.
• Stripe – for subscription billing if you choose to subscribe. Payment-card details are handled by Stripe and never touch our servers.

These providers may collect or process information subject to their own privacy policies. We do not control their practices.

5. Data Security

We use reasonable administrative, technical, and physical safeguards to protect your information. However, no system can be 100% secure, and we cannot guarantee the absolute security of your data.

6. Your Rights & Choices

You have the following rights, depending on your jurisdiction:

• To know what information we collect
• To request deletion of your anonymized telemetry ID
• To disable optional analytics in the app's Settings → Privacy panel
• To turn off website analytics and ad measurement by choosing "Necessary only" or "Reject" in the Cookie preferences at the top of this page, and to opt out of ad measurement and sharing for advertising by sending Global Privacy Control from your browser
• To decline AI features and use Inkwell entirely offline
• To delete your account. Deletion is initiated from within the apps (Settings → Manage Account → Delete Account) and completes on the web for verification.

What account deletion removes. Your sign-in, subscription records, credit history, writing-session history (including script titles and document identifiers, per Section 1c), and Quill conversation memos (Section 2c) are all deleted. Every screenplay you had synced is destroyed as well — the encrypted copies, all of their versions, and the wrapped keys and device records that go with them, including documents you had already removed from sync. Every draft you shared is deleted too: the encrypted copies, the links, the reader names, and readers' notes (Section 2d), so the links stop working. The files on your own devices are untouched; they are yours and we never had a way to reach them. If that purge cannot be completed we stop and delete nothing, and tell you so, rather than leave your encrypted work behind an account that no longer exists. Three things are deliberately kept: records of payment events, which we retain as financial history in a form no longer pointing at you, administrative audit entries recording that the deletion happened, and the deletion receipts described in Section 2a, which are how we can later prove your screenplays were in fact destroyed. If you unsubscribed from marketing email, we keep a one-way hash of your address after account deletion so we never email you again, and nothing else. We also keep a one-way hash of your account's internal ID and the time it was deleted, so if a device is still signed in to the deleted account, any further writes from it are refused; it holds nothing else about you. Any active subscription is cancelled as part of the process.

If you have questions or requests, contact us at privacy@rundquist.tech.

7. Updates to This Policy

We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date and may notify you in-app or via our website at https://inkwell.app/privacy.

8. Contact Us

If you have questions about this policy or our data practices, contact:

Rundquist Tech LLC
4546 El Camino Real B10 #781
Los Altos, CA 94022

Email: privacy@rundquist.tech

© 2026 Rundquist Tech LLC. All rights reserved.