Privacy Policy

Oleksandr Hubin, an individual based in Poland, operates Inkzi and is the controller of personal data processed to provide the service. For privacy questions or to exercise your rights, contact:

[email protected]

Inkzi processes the content and settings you provide to run its learning tools. When you use an account, we also process:

• Your email, name, profile image when available, and account creation and update dates.
• For Google or X sign-in and account linking: the provider’s account identifier, email and verification status, basic profile information, and authentication tokens supplied by the provider. Inkzi does not receive your Google or X password.
• If you add a passkey, Inkzi stores its public key, credential identifier, your chosen name, its link to your account, creation date, and technical authenticator metadata, such as device type, supported transports, backup status, authenticator model identifier, and signature counter. These records let us verify sign-in requests. Inkzi does not receive your private key, fingerprint, face scan, or device PIN; any biometric or PIN check is handled by your device or authenticator.
• Session records, including IP address, browser information, and sign-in and expiry times. Email sign-in codes are stored as hashes and expire after five minutes.
• Saved worksheet names, text, and visual settings; writing completions, repetitions, mistakes, assistance used, and practice dates; vocabulary marked as known; practice settings and current sessions; personal word blocks.
• Technical logs needed to operate, secure, and troubleshoot the service.
• If you contact us, your contact details and the information you include in your message. Avoid sending passwords, sign-in codes, or unnecessary sensitive information.

We process account details, sign-in information, and saved learning activity to provide the services you request under our Terms, including account linking, saving and syncing work, and calculating progress. The legal basis is performance of our agreement with you (Article 6(1)(b) GDPR). Account information is necessary for these features; without it, you can still use tools that do not require sign-in.

We process limited security and diagnostic information, maintain recovery backups, and respond to general enquiries based on our legitimate interests in operating a reliable, secure service and assisting users (Article 6(1)(f) GDPR). These interests must be balanced against your rights. Processing required to comply with applicable legal duties, including handling data-protection requests, is based on Article 6(1)(c) GDPR.

We do not sell personal information. Google and X access is used for authentication and account linking. Inkzi does not use these connections to publish posts, read direct messages, or analyze your social activity.

If you choose Google or X, that provider processes your authentication request under its own terms and privacy policy and shares the information authorized for sign-in. Connecting a provider does not send your saved worksheets or learning progress to that provider.

Your device or password manager manages the private part of a passkey and may sync it across your devices under its own settings, terms, and privacy policy. Inkzi does not operate that synchronization service.

Resend processes your email address and sign-in message to deliver one-time codes. Hetzner provides server hosting, and Cloudflare provides network and security services. These providers process information needed to perform their respective services. Google and X also process information independently for their own services, as explained in their privacy policies.

Using these providers may involve processing outside the European Economic Area. The applicable locations and transfer arrangements depend on the provider and service. Contact us for information about the arrangements and safeguards applicable to your data.

Character stroke data may be requested from the hanzi-writer-data CDN, which receives ordinary network information such as your IP address. Dictionary glosses are shipped with Inkzi from CC-CEDICT-derived data.

Inkzi uses cookies to maintain your session and protect authentication flows. Your browser also stores drafts, practice settings, word blocks, and pending updates so you can continue working and retry synchronization.

You can clear cookies and site storage through your browser. This may sign you out and remove work that has not yet synced. You can use the learning tools without an account; work kept only in your browser is not automatically saved to an account.

Account data and saved learning activity are retained while your account exists so we can provide the service. You can delete individual saved worksheets or permanently delete your account in Account → Settings. Account deletion requires confirming your email and may require signing in again.

Account deletion removes your profile, active sessions, connected Google/X records and stored tokens, registered passkey records, saved worksheets, vocabulary, writing history, practice state, personal word blocks, email-code records, and pending account-linking requests from the active database.

You can remove an individual passkey in Account → Settings. Removing it or deleting your account prevents that key from signing in to Inkzi, but does not erase the saved copy in your device or password manager; you can remove that copy there separately.

The deletion flow also clears account-specific drafts and pending updates in the browser where you delete the account, when browser storage is accessible. It cannot remotely erase storage on other devices, downloaded files, or printed copies. Clear site data on other browsers or devices if needed.

Data is removed from the active database when account deletion succeeds. Residual copies in backups and technical logs under Inkzi’s control are removed within a maximum of 30 days after deletion. Backup copies are retained for no more than 30 days from creation and are used only for recovery. If a backup is restored during that period, account deletions must be reapplied before the restored data is used to provide the service.

Support messages are kept while handling your enquiry and any necessary follow-up. Records needed to meet a specific legal obligation or handle a legal claim are limited to what is necessary and retained for the applicable legal period; these are separate from the account content deleted through Settings.

Deleting Inkzi does not delete your Google or X account or data those providers hold independently. You can also manage Inkzi’s access in your Google or X account settings.

You can use email codes without connecting Google or X, and view connected sign-in methods in Account → Settings. Passkeys are optional; you can add and remove them there while keeping email or connected providers available for sign-in. For access, correction, deletion, or other requests concerning your personal data, contact us. We may need to verify that the request concerns your account.

Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction of processing, and a portable copy of data you provided. You may object to processing based on legitimate interests. If processing relies on your consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

We normally respond within one month of receiving a request. Where the GDPR permits an extension, we will explain the reason and inform you within that month. Inkzi does not make solely automated decisions that have legal or similarly significant effects on you; learning scores and milestones are informational.

You may complain to the President of Poland’s Personal Data Protection Office (UODO), or to a supervisory authority in the EU country where you live, work, or believe an infringement occurred. You do not have to contact Inkzi first. Contact us at:

[email protected]

How to lodge a complaint with UODO

Inkzi uses HTTPS for the production service, hashed email sign-in codes, and session and authorization checks to protect account access. No online service can guarantee absolute security. If you believe your account or personal data has been compromised, contact us. Where required by law, we will notify the relevant authority and affected individuals about a personal-data breach.

This notice describes data processing; it does not ask you to waive privacy rights or provide blanket consent. If a feature requires consent, it must be requested separately. We may update this notice as the service or applicable requirements change. The date above identifies the latest version, and material changes will be highlighted through the service.