Privacy Policy

Version 1.1 — Effective Date:

Inkwell is a decentralized client for the Standard.site ecosystem on the AT Protocol. We believe your data belongs to you. This policy applies to Inkwell for iOS (version 1.0, build 49, distributed via AltStore) and Inkwell for Android (version 1.2.0, distributed via a self-hosted F-Droid repository).

1. Data Collection & Usage

Inkwell is a localized client application. The developer (Ewan Croft) does not collect, store, or harvest personal data, analytics, or usage metrics on proprietary servers. Inkwell contains no ads, tracking, or analytics software. All content you read, write, or publish is communicated directly between your device and the relevant Personal Data Server (PDS) or the wider AT Protocol network.

2. Data Stored on Your Device

  • iOS: Your OAuth session (access and refresh tokens) and the P-256 DPoP private key are stored in Apple’s Keychain. Non-sensitive handle and PDS hints, notification state, and a local record of recently seen URIs are stored in UserDefaults.
  • Android: Your OAuth session is stored in EncryptedSharedPreferences, backed by a hardware-backed MasterKey.

3. Authentication

Inkwell uses OAuth 2.1 to sign in to your AT Protocol account securely via the system browser. Inkwell never sees or stores your account password or app password.

4. Notifications

On iOS, with your permission, Inkwell may show local notifications when a publication you follow publishes a new document. Notifications are generated on-device from background refresh; Inkwell does not use push notification services. Notification state and already-seen URIs are stored locally. The Android build declares the notification permission but does not yet send notifications.

5. Backup

The Android build allows Android’s automatic cloud backup of app data, which may include your stored OAuth session. You can disable this in your device’s backup settings or by signing out. iOS Keychain items are not synchronized to iCloud or included in ordinary device backups.

6. Third-Party Services

To function, Inkwell communicates with external services:

  • Your PDS & AT Protocol: Standard network infrastructure to fetch and publish your content.
  • AT Protocol identity services: Standard DNS and PLC directory lookups for identity resolution.
  • Leaflet Search: Used as a cross-platform search index for Standard.site records.
  • Constellation (microcosm.blue): Used to discover cross-repository backlinks and recommend counts.

Queries to these public services are subject to their respective privacy and data retention policies.

7. Changes to this Policy

We may update this policy occasionally to reflect new features or legal requirements. Continued use of the app constitutes acceptance of these changes.

8. Contact

For privacy-related inquiries, please email contact@ewancroft.uk or create an issue on the Inkwell GitHub repository.

9. AI-assisted contributions

AI tools may be used when contributing to Inkwell. Contributors should add Co-authored-by: trailers crediting AI agents when they materially contributed, so attribution stays honest and accurate.