Privacy Policy

Last updated: January 25, 2026

Inkwell ("we," "our," or "the extension") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights regarding that data.

1. Information We Collect

Account Information

• Email address — used for account creation and identification via Google OAuth
• Name and profile picture from your Google Account (optional)
• We authenticate through Google OAuth — we never see or store your password

Email Data

• Email content (subject lines, sender info, message bodies) is accessed for AI processing only when you explicitly use the extension
• Content is processed in real-time and is not permanently stored on our servers
• We do not access your entire mailbox — only emails you choose to process

Usage Data

• Feature usage (summarize, reply, compose)
• Daily/monthly statistics for billing purposes
• Error logs for improving service quality

Payment Information

• Payments are processed directly through Stripe
• We never store credit card numbers or sensitive payment details
• We retain only invoice history and subscription status

2. How We Use Your Information

Core Functionality

• AI processing — email content displayed on your screen is sent to OpenAI's GPT models to generate summaries, replies, and suggestions
• Content is processed immediately and deleted from our servers after the response is generated
• Account management — your email address is used to manage your account and subscription

Service Improvements

• Aggregated, anonymized usage data helps us improve features
• Technical logs help us diagnose and fix issues

Communications

• Account notifications (billing alerts, security notices)
• Opt-in product updates — you can unsubscribe at any time

3. Information Sharing

What We Do Not Do

• We do not sell your data to advertisers or data brokers
• We do not share your data with marketing companies
• We do not trade or rent your personal information

We may disclose information if required by law (court order, government request), and will notify you when legally permitted.

4. Data Security

• OAuth authentication — we never handle your Google password
• All data in transit is encrypted using TLS/SSL (HTTPS)
• Access tokens are securely stored, encrypted, and regularly rotated
• Email content is processed in real-time and immediately deleted — never cached or permanently stored
• You can revoke Inkwell's access at any time via Google Account settings

5. Your Rights

• Access — request a copy of all data we hold about you
• Correction — update your account information at any time
• Deletion — delete your account and all associated data
• Revoke access — remove Inkwell's access via Google Account settings
• Opt out — unsubscribe from non-essential communications
• Data portability — request your data in standard formats

6. Data Retention

• Account data is retained while your account is active
• Email content is deleted immediately after processing
• On account deletion, data is removed within 30 days
• Automated backups may contain data for up to 90 days
• Some data may be retained if required by law

7. How Email Processing Works

When you use a feature (summarize, reply, or compose):

• You initiate the action in the extension
• The email content displayed on your screen is sent to OpenAI for AI processing
• The AI response is returned to the extension
• Email content is immediately deleted from our servers
• You decide whether to use, edit, or discard the response

8. Children's Privacy

Inkwell is not designed for users under 13 years old. We do not knowingly collect information from children under 13. If you believe we have collected data from a child under 13, please contact us immediately.

9. International Users

Data may be processed in Canada, the United States, or other countries. We comply with GDPR (EU), CCPA/CPRA (California), PIPEDA (Canada), and applicable regional privacy laws. If you are in the EU, you have additional rights including access, erasure, portability, and objection.

10. Changes to This Policy

We may update this policy to reflect changes in our services or legal requirements. Material changes will be posted on this page with an updated date. Continued use of the extension after changes constitutes acceptance of the updated policy.

11. Contact

For privacy questions, data requests, or concerns:

Email: ceosmartresponces@gmail.com

Include "Privacy" or "Data Request" in the subject line. We respond within 24 hours for general inquiries and within 30 days for formal GDPR/CCPA requests.