Security

Inkwell is a client for your own data. This page explains, plainly, how it authenticates, what it stores, and what it doesn't collect.

OAuth 2.1, no app passwords

Signing in opens your system browser once, where you approve access directly with your PDS — the same kind of flow as "Sign in with" any identity provider. Inkwell never sees or stores your account password. There is no legacy app-password fallback: if a PDS only supports OAuth, so does Inkwell.

DPoP-bound tokens

Inkwell requests DPoP (Demonstrating Proof-of-Possession) tokens rather than plain bearer tokens. Each request is signed with a private key that never leaves your device, so a stolen access token by itself isn't enough to impersonate a request — it also has to be replayed alongside a valid proof from that specific key. Sessions refresh automatically in the background; the token that's actually sent over the network is always short-lived.

On-device key storage

Your OAuth session and DPoP private key are held in the platform's secure storage, not app-readable preferences: Apple's Keychain on iOS, and Android's EncryptedSharedPreferences backed by a hardware-backed MasterKey on Android. Android excludes the OAuth session from backup and device transfer because the Keystore key cannot be restored safely. Signing out or uninstalling removes them. Full detail — including backup behaviour on each platform — is in the Privacy Policy.

No analytics, no tracking

Inkwell contains no analytics SDKs, no crash-reporting SDKs, no ad networks, and no proprietary telemetry. The developer doesn't collect usage data from the app. This website sets no cookies, runs no analytics, and embeds no third-party trackers — Vercel, as host, records standard server request logs for delivery and security, and that's the extent of it.

Verification

Publications and documents can claim a canonical web address. Inkwell checks that claim against the publication's .well-known endpoint and the canonical <link> tag on the published page, so a mismatch — a spoofed or stale .well-known response, or a canonical link pointing somewhere else — is surfaced to you instead of silently trusted. See Features for more on how this works.

Your PDS, your control

Inkwell is a client, not a service that hosts your content. Your writing lives in your own AT Protocol repository, on whichever PDS you choose or self-host. Inkwell reads and writes to it directly; there's no intermediary database of your content on the developer's infrastructure.

Read the legal detail

The Privacy Policy and Terms of Service spell out exactly what's stored, where, and for how long, including the two narrow exceptions to "no data collection" — optional in-app feedback and this website's server logs.