Privacy Policy

Inkflow Studio — how we handle your data. Last updated 27 October 2026.

This policy explains what we collect, why, who we share it with, and what you can ask us to do about it. We have tried to write it in plain English rather than legal padding. If anything here is unclear, email us and we will explain it.

1. Who we are

Inkflow Studio (“we”, “us”) operates inkflowstudio.org and the Inkflow writing and AI-model service. Inkflow Studio is a trading name of Dean Jung, based in Birmingham, United Kingdom, who is the data controller for the personal data described in this policy. For anything to do with your data — including a request for our full registered postal address — contact [email protected].

2. What we collect

• Your account. Your email address. If you use Google Sign-In, Google also gives us the basic profile information attached to that account (name, email, profile picture). We never receive or see your Google password.
• What you write and create. Books, chapters, notes, character and world entries, covers and reference material you create or upload. This is your work — see section 5.
• Orders and payments. Payments are processed by Stripe. We never see or store your card number. We keep a record of what was ordered, when, and whether it was delivered or refunded.
• Usage. A log of AI generation activity on your account, used to apply plan limits and to bill accurately.
• Technical information. Ordinary server logs, and your IP address and browser user-agent. For counting downloads of our free model we convert your IP into a one-way hash and store that instead of the address itself, together with whether you were on mobile or desktop.
• Affiliate applications. If you apply to become an affiliate, we keep what you send on the form: your name, email address, website or channel, where you will promote Inkflow, your approximate audience size, your country, your note and the time you ticked the two confirmations. We use it only to decide on your application and to email you about it, and we ask for no bank or payment details on the form. If your application is rejected, it is deleted automatically 3 months after we reject it. If we have not decided on it within 3 months, it is deleted automatically 3 months after you sent it. If it is approved, it becomes your affiliate record, kept while you are an affiliate, and payout records are kept for as long as the law requires.
• Addresses used for an account before. To stop the free chapters being claimed again by closing an account and signing up afresh, we keep a one-way hash of every email address that has had an Inkflow account (the address in lower case, with dots and +tags removed for Gmail, put through SHA-256). The hash cannot be turned back into the address. It is kept after an account is closed, and it is the only thing kept for that purpose. If you sign up again with that address, sign-up asks you to email us.
• Affiliate links. If you arrive through an affiliate’s link and choose Allow, we keep which affiliate referred your account, so the affiliate can be paid. We count clicks on affiliate links as a daily total only, with no address or visitor identifier.

3. What we do NOT do

We do not run advertising trackers, analytics pixels or third-party marketing scripts on this site — there is no Google Analytics, no Meta pixel, no session-recording tool. We do not sell your personal data, and we do not sell or share your writing. There is no advertising cookie.

Cookies

These are every cookie the site sets. Only the referral cookie is optional, and it is set only if you tap Allow on the notice shown when you arrive through an affiliate’s link.

• Sign-in (names starting sb-, set by Supabase): keeps you signed in. Essential. Lasts while you stay signed in, renewed as you use the site.
• inkflow_lang: remembers the language you chose. Essential to show the site in your language. 1 year.
• bcc_demo_used: records that this browser has used the free demo chapter today, so the free allowance is shared fairly. Essential. 24 hours.
• if_confirm_csrf: protects the “confirm your email” and password-reset link against forgery. Essential. 1 hour, and only on that page.
• yt_book: remembers which book you are connecting a YouTube channel for, while you sign in to Google. Essential to that step. 15 minutes.
• inkflow_aff_self: set only on an affiliate’s own browser when they redeem their reviewer code, so their own link never counts as a referral. Essential to that rule. 1 year.
• inkflow_ref (optional): which affiliate’s link you followed, so the person who referred you gets credit if you sign up. Set only if you tap Allow; “No thanks” sets nothing. 60 days. You can delete it in your browser at any time.
• inkflow_admin_gate and inkflow_andy_gate: staff sign-in to our own admin pages only; never set for customers.

4. Who we share it with

We use a small number of suppliers to run the service. They only receive what they need, and only to do the job we have asked them to do:

• Supabase — accounts, sign-in and database storage.
• Stripe — payment processing. Stripe handles your card details directly.
• Anthropic (Claude) and Google (Gemini) — the AI models that generate text, and, for audiobooks, speech. Please read section 5.
• Google Sign-In — only if you choose to sign in with Google.
• YouTube (Google) — only if you connect your YouTube channel to post your videos. Inkflow then uses the YouTube API Services to upload the videos you choose, and nothing else: it cannot see, change or delete anything else on your channel. We keep only the permission token, encrypted, and a list of what you posted. Disconnect on the promo page, or remove Inkflow at myaccount.google.com/permissions; we then delete the token. YouTube’s Terms of Service and Google’s Privacy Policy apply to your use of YouTube.
• Cloudflare and RunPod — website delivery, security and the servers the service runs on.
• Resend — sends our emails (sign-up confirmations, receipts, order and refund emails). It receives your email address and the email we send you.
• Telegram — sends Inkflow’s owner alerts about orders, payments and faults. An alert can include an order number, the product and, where needed to sort a problem out, the customer’s email address. Your writing is not sent.
• Hugging Face and Pollinations.ai — make book cover images when you ask for one. They receive only a picture description that our AI writes from your cover brief, title, genre, main character and setting; never your chapters. We use Hugging Face’s inference service and image apps hosted on Hugging Face Spaces (Z-Image Turbo, FLUX.2 Klein by Black Forest Labs and Tongyi-MAI Z-Image), and Pollinations.ai in its private mode, which keeps the image out of its public feed.

Google user data (YouTube)

This part applies only if you choose to connect a YouTube channel to Inkflow. Inkflow asks Google for one permission, youtube.upload (“Manage your YouTube videos”), the narrowest permission that lets an app post a video to a channel.

• What we access. The permission token Google gives us when you connect, and, after each upload, what YouTube returns about that upload: the video’s id and link, and the id and name of the channel it was posted to. We do not read your other videos, comments, subscribers, playlists, analytics, email or any other Google data, and the permission does not allow it.
• How we use it. Only to do what you ask: upload the promo videos you choose, with the title and description you approve, and show you which videos were posted and where. Nothing else.
• Who we share it with. No one. Google user data is never sold, never used for advertising, never shared with data brokers or any other third party, and never sent to our AI model providers. It is not used to develop, improve or train any AI or machine-learning model.
• How we protect it. The token is encrypted before it is stored (AES-256), it is only ever sent to Google over HTTPS, it is held on our own servers and not in your browser, and only the code that performs your uploads can decrypt it. Staff do not view it.
• How long we keep it, and deletion. We keep it only while your channel is connected. When you disconnect on the promo page, Inkflow revokes its access at Google and deletes the token, the channel name and the record of what was posted. If you remove Inkflow at myaccount.google.com/permissions instead, Google stops the token working at once, and we delete all of it the next time Inkflow tries to use it. You can also ask us at [email protected] to delete it, or to close your Inkflow account, at any time, and we will. Deleting it from Inkflow does not delete the videos from YouTube; you manage those in YouTube Studio.
• Limited Use. Inkflow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Your writing and the AI models — the bit that matters

To generate, continue, edit or narrate your work, the text you submit is sent to our AI model providers (Anthropic and Google) so they can produce the output you asked for. There is no way to run the service without this: it is what generation is. Your work remains yours, we do not publish it, and we do not sell it. If you would prefer particular material never to leave your own machine, do not put it into the hosted service.

We check what is made on Inkflow. To keep the service safe and the quality high, a small number of Inkflow staff may look at books, chapters and videos created on the service - to check they meet our content rules, to fix a problem you report, or to improve quality. We only do this for those purposes, we keep a record of each time it happens, and we never publish or share what we see.

6. Why we are allowed to hold it

Under UK GDPR we rely on: performance of a contract (running your account, delivering what you bought), legitimate interests (keeping the service secure, preventing abuse, checking content meets our rules, understanding how many people download a free sample), and legal obligation (keeping tax and payment records). Where we ever rely on consent, you can withdraw it at any time.

7. Where your data goes

Some of our suppliers are based outside the UK, including in the United States. Where personal data is transferred outside the UK we rely on the safeguards those providers offer for international transfers, such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

8. How long we keep it

We keep your account and your work for as long as your account is open. To close your account, email [email protected] and we will erase your data within 30 days, keeping only the payment records the law requires. That removes your account, your books and other stored work, your usage records, your reviewer-code and referral records, and the fingerprints of free chapters; order and payment records are kept with your personal details removed, and an affiliate’s commission records are kept as anonymous totals. The one-way hash of your email address described in section 2 is kept. Hashed download counters contain no name or address and are kept as aggregate statistics.

Affiliate applications that we reject are deleted automatically 3 months after we reject them, and applications still waiting for a decision are deleted automatically 3 months after they were sent.

9. Your rights

You can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable format, or stop a particular use of it. Email [email protected] and we will respond within one month. If you think we have got it wrong you can complain to the UK Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can fix it.

10. Children

This service is not intended for children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, tell us and we will delete it.

11. Changes

If we change this policy we will update the date at the top of this page. If a change materially affects how we use your data, we will tell account holders directly rather than quietly editing the page.

Terms & Refund Policy · ← Back to Inkflow Studio