Inkpaper
Guest ·

门 · INKPAPER

Privacy Policy

Effective July 26, 2026

This Privacy Policy explains how the Inkpaper mobile app (“Inkpaper”, “we”, “us”) collects, uses, and protects your personal data when you learn Chinese with the app. The data controller is Jonny Kahle (contact: jonnydschingiskahle@gmail.com).

1. Data we collect

  • Account & sign-in. When you create an account we store your email address. If you sign in with Google or Apple, we receive your account email (with Apple, possibly a private relay address Apple creates) and basic profile from them. Passwords are handled and stored in hashed form by our authentication provider (Supabase) — we never see your plaintext password.
  • Learning data. To provide and sync the service we store the content you create in the app: saved vocabulary, reading progress, review history and schedule, practice and grammar activity, bookmarks, and your app settings.
  • Microphone & speech. Speaking practice uses your microphone. Pronunciation and tone scoring runs entirely on your device; those recordings are not uploaded to us or stored. Word-recognition during speaking practice may use your device’s built-in speech recognition (Apple on iOS, Google on Android), which can process the audio on their servers under their own privacy policies. We only receive the resulting score, never the audio.
  • How speaking practice works on Android. So that we can tell whether speech practice works on different phones, the Android app reports how it went: for example that the speech service was ready, that it heard Chinese, or how it failed. Each report holds your Android version, phone model, app build and the name of your phone’s speech service. It holds no audio, no text and nothing that links it to you or your account. We keep daily totals and delete them after 180 days.
  • Purchases. If you buy a subscription, the purchase is processed by Apple or Google, and subscription status is managed through RevenueCat. We receive whether your subscription is active — never your card or payment details.
  • Technical data. Our backend keeps basic logs (such as IP address and timestamps) needed to operate the service securely and reliably. Chinese fonts are fetched at runtime from Google Fonts, which may receive your device’s IP address to serve the font files.
  • Device & app information. So that we know which platforms and versions to support and roughly where our readers are, the app records against your account: the country your device’s language settings report, its time zone, its operating-system version, and the app build you are running. We do not collect a device identifier, an advertising ID, or your device model, and none of this is used to track you across other apps or websites. We look at it only as totals — how many accounts are on each platform, version or country.
  • How stories load. So that we can tell whether stories reach you quickly, the app records against your account how long the story list and a story’s text took to arrive, whether it failed and how (for example no network or a timeout), and your platform and app build. It does not record which story. We look at it only as totals, and delete it after 90 days.

We do not use third-party advertising or analytics trackers in the app, and we do not sell your personal data.

The website (inkpaper.app) counts visits, with Vercel Web Analytics and with a counter of our own: which pages are opened, from which country and kind of device and browser, which site linked there, and which controls on a page are used (for example playing a sentence or finishing a lesson). It sets no cookies and stores nothing on your device for this. To tell one visitor from another within a day, our counter keeps a code made from your IP address and browser together with a random value that is replaced every day and then deleted; the IP address itself is never stored, and the code cannot be linked to you, to your account, or across days. The counts are kept for at most 13 months.

2. How and why we use your data

Under the GDPR, our legal bases are:

  • Performance of a contract — to create your account, provide the app, and sync your learning data across devices.
  • Consent — to access your microphone for speaking practice. You can withdraw this at any time in your device settings.
  • Legitimate interests — to keep the service secure, prevent abuse, diagnose problems, and count visits to the website so we know which pages are useful.
  • Legal obligation — where we must retain or disclose data to comply with the law.

3. Who we share data with

We share data only with service providers that process it on our behalf:

  • Supabase — authentication, database, and storage (hosted in the European Union).
  • Google — Google Sign-In, Google Fonts, Google Play billing, and Android speech recognition.
  • Apple — Sign in with Apple, App Store distribution, in-app purchases, and iOS speech recognition.
  • RevenueCat — subscription management.
  • Email delivery — transactional emails (such as sign-up confirmation and password reset) are sent through our email provider.

Some of these providers are based outside the European Economic Area. Where data is transferred internationally, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

4. Where your data is stored, and for how long

Your account and learning data are stored in the European Union. We keep your data for as long as your account is active. You can delete your account yourself at any time, in the app under Stats › Settings › Delete account; this removes your personal data immediately and cannot be undone. See Delete your account for exactly what is removed. We keep nothing afterwards except where we must keep limited records to comply with the law.

5. Your rights

If you are in the EU/EEA, you have the right to access, correct, delete, restrict, or export your personal data, to object to certain processing, and to withdraw consent at any time. Deletion you can carry out yourself, in the app — see Delete your account. For anything else, email us at jonnydschingiskahle@gmail.com. You also have the right to lodge a complaint with your local data protection supervisory authority.

6. Children

Inkpaper is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us personal data, please contact us and we will delete it.

7. Security

We use industry-standard measures to protect your data, including encryption in transit and access controls that restrict each account to its own data. No method of transmission or storage is completely secure, but we work to protect your information.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.

9. Contact

Questions about this policy or your data? Email jonnydschingiskahle@gmail.com. Our full provider details are in the Impressum.