Privacy Policy

1. The short version

• We store your email, a hashed password, what you’ve bought, and basic facts about devices you pair.
• Lemon Squeezy handles payments. We never see or store your card number.
• We don’t sell or rent personal data, and we don’t use advertising trackers.
• Email us to get a copy of your data or to have your account deleted.

2. What we collect

Account

• Email address and optional display name.
• Your password, stored only as a one-way hash. We can’t read it.
• Account dates (created, password last changed) and single-use password-reset tokens, stored hashed.

Purchases and membership

• What you bought (wallpapers, packs, Pro or Founders), when, the amount, and the order or subscription reference from Lemon Squeezy.
• Subscription status and renewal dates, so we know what you have access to.

Paired devices

• The device model reported by the plugin, its screen width and height, the name you give it, when it was paired and when it last checked in.
• A device token, stored only as a hash, which lets the device fetch images for your account.

Waitlist

• If you ask to be notified when something becomes available, your email and what you were interested in.

Technical data

• IP address, request time, requested URL and user agent in server logs. We use these for security, abuse prevention and rate limiting, and to fix errors.
• If we enable analytics, we use a privacy-friendly, cookieless tool that counts page views in aggregate without building profiles of individual visitors.

We don’t collect your reading history, books or notes. The plugin only talks to our server to pair and to fetch images.

3. How we use it

• To provide the service: sign-in, your library, rendering images at your device’s size, daily updates.
• To process purchases and give you access to what you paid for.
• To keep things safe: preventing fraud, abuse and excessive requests.
• To talk to you: password resets, receipts-related messages, important service or policy changes, and waitlist notifications you asked for. We’ll only send marketing emails if you opt in, and every one has an unsubscribe link.
• To improve the service using aggregate, non-identifying numbers (for example, which device sizes are most popular).

Where laws such as the GDPR apply, our legal bases are: performing our contract with you (account, purchases, devices), our legitimate interests (security, rate limiting, improving the service), your consent (optional emails, analytics where consent is required), and legal obligations (for example, keeping transaction records).

4. Payments

Checkout is run by Lemon Squeezy, the merchant of record for our sales. You give your payment details directly to Lemon Squeezy and its payment partners; we never receive or store card numbers. Lemon Squeezy tells us that a payment succeeded and shares the details needed to grant access (such as your email, the product, the amount and the order or subscription ID). Lemon Squeezy’s own privacy policy covers how it handles your payment information.

5. Service providers

We use trusted providers to run the service. They process data only on our instructions:

• Hosting for the website and API (for example Vercel and Render).
• Database hosting (for example Neon Postgres).
• File storage for wallpaper images (for example Cloudflare R2). It holds artwork, not your personal files.
• Email delivery for password resets and service messages.
• Payments: Lemon Squeezy, as merchant of record.
• Analytics, only if enabled, as described above.

We may also disclose data if the law requires it, or to protect our rights and users’ safety. If InkMorning is ever transferred to a new owner, your data would move with it under this policy, and we’d tell you first.

6. Cookies and local storage

We keep you signed in using a token stored in your browser’s local storage. It’s strictly necessary for the account features to work. We don’t use advertising or cross-site tracking cookies. The checkout pages run by Lemon Squeezy may set their own cookies.

7. How long we keep data

• Account data: while your account is open. After you ask us to delete it, we remove it within 30 days.
• Devices: until you remove the device or delete your account.
• Purchase records: as long as the law requires for tax and accounting, even after account deletion, kept to the minimum needed.
• Server logs: kept for a short period (typically up to 30 days), unless needed to investigate abuse.
• Backups: deleted data can remain in backups until they rotate out.

8. Your rights

Wherever you live, you can ask us to:

• Access or export the personal data we hold about you, in a common machine-readable format;
• Correct inaccurate data;
• Delete your account and personal data (subject to records we must keep by law);
• Object to or restrict certain processing, and withdraw consent you’ve given.

Email hello@example.com from the address on your account and say what you’d like. We may need to confirm it’s you. We aim to reply within 30 days. You can remove paired devices yourself at any time from the Devices page. If you’re unhappy with our answer, you may also complain to your local data protection authority.

Deleting your account doesn’t cancel a subscription automatically on the payment side — please cancel it in the customer portal first, or tell us and we’ll help.

9. Security

Passwords, device tokens and reset tokens are stored hashed; connections use HTTPS; access to production systems is limited. No system is perfectly secure, but if a breach affects your data we’ll tell you and the relevant authorities as the law requires.

10. International transfers

InkMorning is operated from Vietnam and our providers may store data in other countries, such as the United States or the European Union. When data moves between countries we rely on our providers’ standard safeguards, such as contractual data protection terms.

11. Children

InkMorning isn’t directed at children under 13 (or the higher age required in your country), and we don’t knowingly collect their data. If you believe a child has created an account, contact us and we’ll delete it.

12. Changes

We’ll update the date at the top when this policy changes, and email account holders about important changes before they take effect.

13. Contact

Privacy questions or requests: hello@example.com. See also our Terms of Service.