Privacy Policy

Last updated: July 2, 2026

At Inky, operated by Total Ventures LLC, we are committed to protecting your privacy and the privacy of your children. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our mobile app, website, and related services (collectively, the "Service").

1. Information We Collect

We collect information necessary to provide and improve the Service.

1.1 Account Information

  • Email address (for authentication and account management)
  • User ID (Firebase Auth UID) — used to link your account to stories, profiles, and preferences
  • If you use Sign in with Apple: we may receive an anonymized email and your name

1.2 Profile and Reader Data

  • Display names (for reader profiles)
  • Birthdate (optional, for age-appropriate content)
  • Profile avatar (emojis or in-app selections)
  • Reading preferences (age range, reading level, font size, theme, voice settings)

1.3 User Content

  • Stories you create (text, images, metadata)
  • Story preferences and interests (themes, styles, genres)
  • Favorites and "Want to Read" lists

1.4 Usage and Analytics Data

  • Anonymous story view counts (for trending and discover features)
  • App usage data (if Firebase Analytics or similar is enabled)
  • Crash data and performance metrics (for app stability and functionality)

1.5 Purchase Information

  • Purchase history and credit balance (processed by RevenueCat and Apple)

1.6 Audio Data

If you use voice input: audio is processed locally on your device using Apple's Speech framework. We do not store or transmit your voice recordings. Only the transcribed text is used (e.g., for story idea input).

2. How We Use Your Information

  • Service delivery: Generate personalized stories, manage profiles, store and display your content
  • Personalization: Tailor stories to reading level, age, and preferences
  • Analytics: Understand usage patterns, improve algorithms, measure engagement
  • Communication: Account-related emails, support, and (if you opt in) marketing
  • Security: Protect against unauthorized access, fraud, and abuse

3. Children's Privacy (COPPA)

Inky is directed to children ages 4 and up used under parental supervision, and we run a full COPPA program. We obtain verifiable parental consent — using the "email-plus" method (an affirmative consent plus a confirmatory second step sent to the parent), or a payment-card method in connection with a purchase — before we collect a child's personal information, at the point you create the first child reader profile. We never sell or share a child's personal information, never use it for advertising or profiling, and never use a child's photos, voice, likeness, or stories to train, fine-tune, or evaluate AI. A child's photo, voice, and stories are used solely to generate that account's own stories and are deleted on the timeframes in our Data Retention section. Parents may review, correct, refuse further collection of, or delete a child's data in Settings → Privacy or by emailing legal@inkyverse.io, and parents control whether any of a child's content is ever published or shared. See Section 16 of our Terms of Service (Data Rights, De-Identification & AI Improvement) for the full, binding treatment.

4. Data Sharing and Disclosure

We do not sell your personal information. We share data only with service providers acting on our behalf, named here with their category and purpose, and not with any third party for that party's own purposes:

  • Firebase / Google Cloud (infrastructure) — authentication, database, storage, and AI generation via Google Gemini, to operate and generate the Service
  • RevenueCat and Apple (payments) — to process credit purchases
  • Resend (email) — to send account and, if you opt in, marketing emails
  • Legal requirements: when required by law or to protect our rights
  • With your consent: when you explicitly authorize sharing

These are integral service-provider disclosures, not disclosures to third parties for their own purposes. We do not disclose a child's personal information to any third party for targeted advertising or AI-training purposes.

5. Third-Party Services

6. Data Retention

We maintain a written data-retention policy and do not retain children's personal information indefinitely. We delete or irreversibly disassociate uploaded photos, voice, and likeness-derived outputs within 7 days of fulfilling the generation purpose (and aim not to persist them beyond the generation session); we delete identifiable user content and a child's personal information within 30 days of account, profile, or content deletion; we retain purchase records only for the minimum period the law requires; and we retain consent records for the life of the account plus the applicable limitations period to prove lawful consent and deletion. Notwithstanding these timeframes, we may retain limited personal information beyond a deletion request where, and only for as long as, a legal obligation or a lawful preservation duty requires it — for example, to comply with a child-safety reporting or evidence-preservation obligation under applicable law; any such retained data is quarantined, used for no other purpose, and deleted once the obligation lapses. We state, for each category, the purpose, the business need, and the deletion timeframe (see the retention table in Section 16.8 of our Terms of Service).

7. Data Security

We implement strict security measures including encryption, access controls, and secure storage. Your information is stored on Firebase (Google Cloud) infrastructure. We do not guarantee absolute security; you use the Service at your own risk.

8. Your Rights

Depending on your location, you may have the right to:

  • Access: Request a copy of your personal information
  • Correct: Update inaccurate information (via app settings or by contacting us)
  • Delete: Request deletion of your account and data (Settings → Account → Delete Account, or email us)
  • Opt out: Opt out of sale/sharing of personal information by contacting us at legal@inkyverse.io or using our Privacy Choices page
  • Portability: Request a portable copy of the personal information and user content you provided and your interaction signals (which we treat as provided-by-you). Company-generated inferences, profiles, embeddings, model weights, and de-identified data are not exported because they are not "provided by" you

    • Deleting your account deletes your personal information on the timeframes above; only data already de-identified to our standard (and, for EEA/UK users, irreversibly anonymized) survives deletion, because it is no longer about you. Nothing here limits your legal deletion or erasure rights, or our duty to destroy a dataset or model if the law or a regulator requires it.

    For privacy requests, contact legal@inkyverse.io

    9. State Privacy Laws (U.S.)

    California, Virginia, Colorado, Connecticut, Texas, and other states grant residents additional rights. See our Privacy Choices page and our US State Privacy Rights notice for details.

    10. International Users

    Our servers are located in the United States. If you access the Service from outside the U.S., your data may be transferred to and processed in the U.S. By using the Service, you consent to such transfer.

    11. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website or through the app. Your continued use of the Service constitutes acceptance of the revised policy.

    12. Data Rights, De-Identification & AI Improvement

    We never sell your personal information, and we never use your child's photos, name, voice, likeness, or stories to train AI — not for us, and not for any company that might acquire Inky. There are no ads, no third-party advertising trackers, and no subscriptions.

    How we improve Inky. To make Inky safer and better, we learn only from de-identified usage patterns — never from your child's content. Before any usage data is used to improve Inky, we remove all direct and indirect identifiers, exclude all uploaded photos, voice, and any content that originated from a child's profile, and use aggregated or statistical outputs as the default. We apply a de-identification methodology consistent with NIST SP 800-188 and the definition of "deidentified" information in California Civil Code § 1798.140(m). We describe this data as de-identified (meaning not reasonably linkable to you or your child) — we do not call it "anonymous," "untraceable," or "industry-standard," and we do not claim it can never be defeated.

    Our public commitment. We publicly commit to maintain and use de-identified data only in de-identified form, and we will not attempt to re-identify it, except solely to test that our de-identification is effective. We contractually require any recipient of de-identified data — including any service provider and any company that acquires Inky — to make and keep the same commitment.

    Your choice — improvement is off by default. Using your account's de-identified usage patterns to improve Inky is off unless you, the Account Holder, turn it on with a separate, clearly-labeled choice, and you can turn it off anytime. A child's photos, voice, and stories are never used to improve Inky regardless of this setting — they are categorically excluded.

    Teens (under 18). For any user we know to be under 18, we do not sell or share their personal information, serve targeted advertising, profile them for decisions with legal or similarly significant effects, or use their data for cross-customer improvement beyond aggregate de-identified data. We do not sell or share the personal information of any user we know to be under 16, and we treat such information as sensitive.

    AI transparency. Inky stories and illustrations are generated by an AI system (Google Gemini); you are interacting with AI, and all story text and images are AI-generated. We mark AI-generated images and text in a machine-readable, detectable format consistent with Article 50 of the EU AI Act, maintained no later than 2 August 2026.

    EU and UK users. Improvement is off for EEA/UK accounts and their content and usage are excluded from de-identified and training datasets unless you separately, specifically, and revocably opt in — and even then we use only irreversibly anonymized data. We rely on your consent (not legitimate interest) for any such processing, you can withdraw it anytime, and we apply high-privacy-by-default settings to everyone under 18. On an erasure request we delete your personal data, including de-identified-but-relinkable data; only truly anonymized data is retained. Our AI processor (Google Gemini) operates under data-processing terms, with Standard Contractual Clauses for any transfer outside the EEA/UK.

    Business transfers / change of control. Inky's data may be transferred only as part of a sale of the whole business as a going concern — never as a standalone data sale or financing collateral — and only to a buyer that is bound to this Privacy Policy and to protections at least as protective, that continues the same line of business or obtains fresh consent, that obtains fresh parental consent before any new or materially different use of a child's data, and that gives you prior notice and a chance to opt out or delete before any transfer that changes who controls your data. We disclose this permitted pathway so that, including in any insolvency, a transfer can be made consistently with this policy.

    Governing law. This Service is operated by Total Ventures LLC, a Wyoming company; our practices are governed by federal COPPA and the FTC Act and by the privacy laws of your state or country of residence, which we honor regardless of any governing-law clause in our Terms. The full, binding treatment of these rights is in Section 16 of our Terms of Service.

    13. Contact Us

    Questions about privacy?

    © 2025 Total Ventures LLC. All rights reserved.