Sign in Start free
Legal

Privacy Policy

Effective date: May 1, 2026 · Last updated: May 1, 2026

This Privacy Policy describes how InkStak ("we," "us," or "our") collects, uses, and discloses information about you when you use our website at inkstak.ai and our web application at app.inkstak.ai (together, the "Service").

Note: This policy has not yet been reviewed by a lawyer. It is provided as a draft framework. Before you accept payments or allow real users to sign up, please have qualified legal counsel review and approve this document, particularly the COPPA, PIPEDA, and GDPR sections.

CONTENTS

1. Overview

InkStak is a service designed for parents and guardians to generate personalised, illustrated stories for their children. We take privacy seriously, particularly with respect to children.

Children do not have accounts on InkStak. Only adults (parents and guardians) create accounts. We do not knowingly collect personal information directly from children. Story content — such as character names and plot ideas — is provided by the account holder (the adult) on behalf of their family.

2. Information we collect

2.1 Information you provide

  • Account information: Your email address and authentication credentials when you sign up via Clerk.
  • Story content: Character names, species, personality descriptions, story prompts, genre preferences, and illustration style choices you enter when creating stories.
  • Payment information: Billing details processed by Stripe. We do not store your full payment card number — Stripe handles all payment data under their own PCI-DSS compliance program.
  • Support communications: Messages you send to our support email.

2.2 Information collected automatically

  • Log data: IP address, browser type, pages visited, referrer URL, and timestamps, collected by our hosting provider (Cloudflare).
  • Usage data: Story generation events, export actions, and feature usage, used to understand how the Service is used and to improve it.
  • Cookies and local storage: Session authentication tokens and user preferences. See Section 12 (Cookies).

2.3 Information from third parties

  • Authentication providers: If you sign in with Google, Apple, or another federated identity provider via Clerk, we receive a user identifier, email address, and display name from that provider.

3. How we use your information

We use the information we collect to:

  • Create and manage your account and authenticate you
  • Generate stories, illustrations, and exports you request
  • Process payments and manage your subscription or token balance
  • Send transactional emails (receipts, password resets, account notices)
  • Respond to your support requests
  • Detect and prevent fraud, abuse, or violations of our Terms of Service
  • Comply with legal obligations
  • Improve the Service (in aggregate, anonymised form)

We do not sell your personal information. We do not use your story content or character data to train AI models without your explicit consent.

4. Sharing your information

We share information only in the following circumstances:

  • Service providers: We share data with third parties that help us operate the Service, including Cloudflare (hosting and CDN), Clerk (authentication), Stripe (payments), and Google (AI generation via Gemini API). These providers are contractually bound to protect your data and use it only as directed by us.
  • Community sharing: If you choose to share a story publicly through the Community feature, the story text and illustrations become visible to other InkStak users. Personal details from your prompt (including any names you entered that are not character names) are not displayed publicly. Sharing is always voluntary and opt-in.
  • Legal requirements: We may disclose information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, safety, or property of InkStak, our users, or the public.
  • Business transfers: If InkStak is acquired by or merged with another company, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

5. Children's privacy

InkStak is designed for parents and guardians, not for children to use directly. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK).

You, as the account holder, may enter information about your child (such as a child's name as part of a character) to personalise stories. We treat this information as belonging to your account and subject to your rights as described in this policy.

If you believe a child has created an account or submitted personal information to us without parental consent, please contact us at privacy@inkstak.ai and we will promptly delete that information.

6. COPPA (United States)

The Children's Online Privacy Protection Act (COPPA) applies to the online collection of personal information from children under 13 in the United States.

InkStak does not direct its Service to children under 13, and we do not knowingly collect personal information from children under 13. Our sign-up flow requires account holders to be at least 13 years of age.

If we discover that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly. To report such a case or request deletion, contact us at privacy@inkstak.ai.

7. PIPEDA (Canada)

InkStak is operated from Canada. The Personal Information Protection and Electronic Documents Act (PIPEDA) governs how we handle personal information of Canadian residents.

Under PIPEDA, we are committed to the following principles:

  • Accountability: We are responsible for personal information under our control and have designated a privacy officer. Contact: privacy@inkstak.ai.
  • Identifying purposes: We identify the purposes for which personal information is collected at or before the time of collection (see Section 3).
  • Consent: We obtain your knowledge and consent before collecting, using, or disclosing your personal information, except where not required by law.
  • Limiting collection: We collect only the information necessary for identified purposes.
  • Limiting use, disclosure, and retention: We use personal information only for the purposes for which it was collected and retain it only as long as necessary.
  • Accuracy: We keep personal information accurate, complete, and up-to-date as necessary for its purposes.
  • Safeguards: We protect personal information with security safeguards appropriate to its sensitivity.
  • Openness: We make our policies and practices for managing personal information available.
  • Individual access: You may request access to your personal information and challenge its accuracy. See Section 11.
  • Challenging compliance: You may challenge our compliance with PIPEDA by contacting our privacy officer or by filing a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

8. GDPR (EEA and UK)

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data.

8.1 Legal bases for processing

Processing activityLegal basis
Account creation and managementContract performance (Art. 6(1)(b))
Story generation and exportsContract performance (Art. 6(1)(b))
Payment processingContract performance (Art. 6(1)(b))
Fraud detection and securityLegitimate interests (Art. 6(1)(f))
Service improvement (aggregated)Legitimate interests (Art. 6(1)(f))
Legal complianceLegal obligation (Art. 6(1)(c))
Marketing communications (if any)Consent (Art. 6(1)(a))

8.2 International transfers

Some of our service providers are located outside the EEA (including in the United States and Canada). Where we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or rely on adequacy decisions where applicable.

8.3 Data subject rights

Under the GDPR and UK GDPR you have the rights described in Section 11 below. To exercise these rights, contact privacy@inkstak.ai. You also have the right to lodge a complaint with your national supervisory authority.

9. Data retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. Specifically:

  • Account data: Retained until you delete your account, then deleted within 30 days (except where we must retain it for legal obligations).
  • Story content: Retained in your library until you delete individual stories or your account.
  • Payment records: Retained for 7 years to comply with tax and accounting regulations.
  • Log data: Retained for up to 90 days.
  • Support communications: Retained for up to 2 years.

10. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include encryption in transit (TLS), access controls, and infrastructure managed through Cloudflare's security platform.

No security measure is 100% effective. If you have reason to believe your account has been compromised, please contact us immediately at security@inkstak.ai.

11. Your rights and choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate or incomplete personal information.
  • Deletion: Request deletion of your personal information (subject to legal retention requirements).
  • Portability: Request your personal data in a structured, machine-readable format (GDPR/UK GDPR).
  • Restriction: Request that we restrict processing of your personal data in certain circumstances (GDPR/UK GDPR).
  • Objection: Object to processing based on legitimate interests (GDPR/UK GDPR).
  • Withdraw consent: Where processing is based on consent, withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, email privacy@inkstak.ai. We will respond within 30 days (or within 1 month for GDPR requests). We may need to verify your identity before acting on a request.

You can also delete your account directly from the account settings screen within the app.

12. Cookies and similar technologies

We use the following types of cookies and local storage:

  • Essential cookies: Authentication session tokens set by Clerk. These are required for the Service to function and cannot be disabled.
  • Preference storage: We store your illustration style and story preferences in your browser's local storage for convenience.

We do not use tracking or advertising cookies. We do not use third-party analytics services that set cookies (such as Google Analytics).

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to the address associated with your account) at least 14 days before the changes take effect, and we will update the "Last updated" date at the top of this page. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

14. Contact us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us:

InkStak · inkstak.ai · Canada