Inkoasis Privacy Policy

Inkoasis (笔绿洲, at inkoasis.ai, the "Service") is provided by 筆無界科技有限公司 (INKFINITE TECHNOLOGY LIMITED), a company incorporated in the Hong Kong Special Administrative Region of China ("we", "us" or "our"). We are responsible for processing your personal information (under different laws, the "personal information processor", "data user" or "controller").

This policy explains how we collect, use, store, share and protect your personal information when you use the Service, what rights you have and how to exercise them. It forms part of the Inkoasis User Agreement. Points that closely affect your rights — in particular cross-border processing, third-party providers and retention periods — are shown in bold and underlined; please pay particular attention to them.

Key points

• Your works are yours. We do not use your works to train any artificial intelligence model, and we do not sell them, publish them or use them for promotion.
• Your data is stored in Tokyo, Japan. Your account and works are kept on servers in Tokyo. Only when you use a feature do we pass the content needed for that request to a provider (for example an AI model or file recognition); the providers are listed in the Service Providers list.
• No ad tracking. We do not sell your personal information or use it for advertising; the cookies and browser storage we use are described in section 7.
• You can manage your information at any time. You can access, correct, export or delete your information, or delete your account, by emailing support@inkoasis.ai.

1. What we collect and why

We collect only the information needed to provide the Service. The tables below describe, by situation, what we collect, why, and what happens if you do not provide it.

1.1 Registration and sign-in

• Passwords are stored only as salted hashes, so we cannot see your password; verification codes and invitation codes are also stored only as hashes.
• With Sign in with Google we request only basic profile information and never read your Gmail, Drive or similar content. Your Google profile picture is loaded by your browser directly from Google's servers.

1.2 Your works

You provide this information yourself. Without it you can still browse the public pages of the Service, but you cannot save works.

1.3 AI features

To complete a request, we send the necessary context to the model provider. Depending on the request, this context may include relevant AI memory, the project structure, manuscript excerpts, story materials and file content you referenced, conversation history and web search results. We send only what is needed for that request.

1.4 Web search (off by default)

After you turn on web search in settings, the AI drafts search queries from your request, sends them to search providers and reads relevant web pages. We process the queries, search scope, page addresses and the page content retrieved, and keep them in the conversation history. Our servers may also fetch web pages directly, following each site's crawling rules (robots.txt).

1.5 File upload and recognition

Pages that need text recognition (for example scans) are sent to file-recognition providers, and images are sent to an image-description provider; see the Service Providers list.

1.6 Payments

Card and other payment details are collected and processed directly by our payment provider. We never see your full card number — only the card brand, the last four digits and the expiry date.

1.7 Contacting us

When you email us, we process the content of your email, any attachments and your contact details to reply to you and handle your request.

1.8 Security and operational records

1.9 What we do not collect

We do not collect your precise location, contacts, identity documents or biometric information, and we do not require real-name verification.

1.10 Sensitive personal information

We do not actively collect sensitive personal information. Your works may portray real people or sensitive subjects; such content is stored and processed only for you. Please do not upload other people's sensitive personal information (for example identity documents, medical records or bank accounts) unless you have lawful authorisation and it is genuinely necessary.

1.11 Changes of purpose

If we want to use your personal information for a purpose not described in this policy, we will tell you in advance, and where the law requires your consent we will ask for it separately.

2. Legal bases for processing

• Necessary to perform our contract with you: providing accounts, saving works, AI writing, file recognition, payments and other features.
• Our legitimate interests: keeping the Service secure, preventing abuse, troubleshooting, and using statistics that contain no work content to improve the Service. We weigh these interests to make sure they do not override your rights.
• Legal obligations: for example keeping transaction records and keeping records of AI-generated content provided.
• Your consent: for example cross-border processing (section 5) and marketing emails. You can withdraw consent at any time; withdrawal does not affect processing carried out before it.

3. AI and your works

3.1 We do not use your works, instructions, conversations or uploaded files to train or fine-tune any artificial intelligence model, and we do not sell, publish or use them for promotion.

3.2 Only when you use a feature do we pass the content needed for that request to a provider. Providers' data-use policies differ, and some providers' terms allow them to use the data they receive to improve their services or models; we try to choose providers and settings that do not use such data to train models. When you use your own API key, the terms of the provider you chose apply.

3.3 We do not manually view your works unless you give or authorise access (for example by attaching content when reporting a problem), it is needed to handle your appeal or to respond to a security incident, or the law requires it.

3.4 We and our model providers may screen inputs and generated content automatically for safety, but we do not make automated decisions based on your personal information that produce legal or similarly significant effects for you. If you disagree with the result of automated processing, you can contact us for an explanation and appeal.

4. Processors, sharing and disclosure

4.1 We do not sell your personal information, and we do not share it with anyone for advertising.

4.2 Providers. We engage providers to deliver hosting, database, email, model, file-recognition, web search, encryption and payment services on our behalf. Providers may process your information only on our instructions and for the purposes in this policy, and are bound by confidentiality and security obligations (through their service agreements and data processing agreements). Their names, purposes, the information involved and where it is processed are listed in the Service Providers list.

4.3 Affiliate. Our affiliate 杭州笔无界科技有限公司 (a company registered in mainland China) contracts with and pays certain mainland Chinese providers on our behalf; see the Service Providers list. When those providers process your information, the affiliate uses the service accounts concerned only to contract, pay and manage the accounts, and does not use your information for its own purposes. It is also our personal information protection representative in mainland China; see section 12.

4.4 Independent third parties. The following third parties process your information under their own rules: the sign-in method you choose (Google, WeChat), the model provider behind your own API key, our payment provider where it acts independently (for example for fraud prevention), and your email provider.

4.5 Disclosure required by law. We may disclose information where laws, court decisions or competent authorities lawfully require it. We review the legality of each request, disclose only what is necessary, and notify you where the law allows.

4.6 Business transfers. If we need to transfer your personal information because of a merger, acquisition, sale of assets or similar, or because services in some regions are provided by an affiliate under section 4.6 of the User Agreement, we will tell you the recipient's name and contact details and require the recipient to remain bound by this policy; if the recipient changes the original purposes or methods of processing, it will ask for your consent again.

4.7 We do not publish your personal information or your works.

5. Cross-border processing

5.1 Where processing happens.

• We are a Hong Kong company; the Service's computing and database are located in Tokyo, Japan.
• To provide the Service, we and our providers may process your information in Japan, Hong Kong, the United States, Singapore and mainland China; see the Service Providers list.

Wherever you are, your personal information will therefore be processed outside your own country or region. We ask for your consent to this when you register.

5.2 Users in mainland China. The Service is provided by an entity outside mainland China and its servers are in Japan, so your personal information must be processed outside mainland China (in Japan, Hong Kong, the United States and elsewhere) to provide the services you choose; this is necessary to perform our contract with you. We inform you as follows:

• Overseas recipients: us (筆無界科技有限公司, email support@inkoasis.ai) and the providers outside mainland China listed in the Service Providers list;
• Purposes, methods of processing and categories of personal information: see section 1 and the Service Providers list;
• How to exercise your rights: you can exercise all of your rights against us as described in section 8, including in relation to processing by overseas providers; our personal information protection representative in mainland China can also assist you (section 12).

In addition, some features pass the necessary content to providers in mainland China.

5.3 Users in Japan. We obtain your consent in advance before providing your personal data to third parties in foreign countries.

• Names of the foreign countries: the United States, China (mainland), Singapore, and Hong Kong, where we are located.
• Personal information protection systems of these countries and regions: see the survey of foreign personal information protection systems published by Japan's Personal Information Protection Commission.
• Measures taken by the recipients: providers are bound by confidentiality and security obligations through their service agreements and data processing agreements; the measures of providers in mainland China are as stated in their published policies.

You can contact us at any time to ask for more information.

6. Retention

We keep your personal information only for as long as needed for the purposes of processing. When that period ends, we delete or anonymise it, unless the law provides otherwise.

7. Cookies and browser storage

We currently use the following three kinds of browser storage:

• Necessary sign-in cookies: keep you signed in and prevent forged requests during third-party sign-in.
• Browser local storage: keeps what you typed on the home page but have not sent yet (separately for each account), recognises the signed-in account so the page refreshes when you switch accounts, remembers interface preferences (for example open tabs), and holds input drafts and the page to return to after sign-in.
• Browser database: holds manuscript edits not yet saved to the server, so they can be recovered after a network drop or a refresh; cleared once saved.

You can delete or block cookies and local storage in your browser settings. If you block the necessary cookies you cannot sign in; clearing local storage may lose edits not yet saved to the server.

We do not track you across websites, so we do not change how we process information in response to a browser's Do Not Track signal; we do not sell your personal information or "share" it for cross-context behavioural advertising.

8. Your rights

8.1 Your rights. Under applicable law, you have the right to:

• access and obtain a copy of your personal information;
• correct or complete inaccurate or incomplete information;
• delete your personal information;
• withdraw your consent;
• receive a copy of your personal information, or have us transfer it to another processor you designate (where technically feasible);
• delete your account;
• ask us to explain our rules for processing personal information;
• restrict or object to our processing where applicable law provides;
• lodge a complaint with a competent authority.

8.2 How to exercise your rights.

• Yourself in the product: you can edit and delete works, projects, files and conversations; export manuscripts one by one (Word, PDF, Markdown, TXT); and delete your own API key or turn off web search in settings.
• By email: for other requests, email support@inkoasis.ai from your account's email address and tell us which sign-in method the account uses (email, Google or WeChat). To protect your account we may ask you to help verify your identity, but we will never ask for your password or verification codes.
• Response time: we reply within the period required by applicable law.
• Cost: free. For manifestly unfounded or excessively repetitive requests, we may refuse or charge a reasonable fee as permitted by law, and will give our reasons.

8.3 Account deletion. Email support@inkoasis.ai to request deletion. After verifying your identity, we will delete your account and all of your projects, works, files, conversations, AI memory, skills, settings and your own API keys within the period required by applicable law; copies in database backups are removed within the following 7 days as the backups roll over. Records we must keep by law (for example payment records and records of AI-generated content provided) are kept separately and deleted when their period ends. Deletion cannot be undone, so please export the works you need and cancel automatic renewal first.

8.4 Deceased users. After a user dies, their next of kin may, for their own lawful and legitimate interests, access, copy, correct or delete the deceased's relevant personal information, unless the deceased arranged otherwise during their lifetime.

9. Minors

The Service is intended for adults aged 18 or over and is not directed at minors. We do not knowingly collect personal information from minors; if we find that a minor has registered an account, we will close it and delete the related information. If you believe we have collected a minor's information by mistake, please contact us.

10. How we protect your information

• All traffic is encrypted in transit; the database is not directly reachable from outside and can be read and written only by our servers after a permission check, and each project can be read and written only by its members.
• Passwords and verification codes are stored only as hashes; third-party sign-in credentials and your own API keys are encrypted.
• Files are stored in private storage, scanned for viruses on upload and processed in restricted environments.
• Server logs never record the content of your works.
• Only necessary operations staff can access production systems, under the principle of least privilege.

No system on the internet is perfectly secure. If a security incident such as a personal information breach occurs, we will take remedial measures and notify you and the competent authorities as required by applicable law. Please use a strong password and never share your password or verification codes.

11. Changes to this policy

We may update this policy; the updated version will be published on this page with the date at the top updated. If there are material changes to the purposes of processing, the categories of personal information, our providers or cross-border processing, we will notify you through an in-app notice or by email before they take effect, and where the law requires your consent again we will ask for it separately.

12. Contact us

If you have questions, comments or complaints about this policy, or want to exercise your rights, contact us:

• Email: support@inkoasis.ai (please put "Personal information" in the subject line)
• Personal information protection officer: our head of operations, reachable at the email above
• Operator: 筆無界科技有限公司 (INKFINITE TECHNOLOGY LIMITED)
• Registered address: UNIT 606, 6/F, PENINSULA CENTRE, 67 MODY ROAD, TSIM SHA TSUI EAST, KOWLOON, HONG KONG
• Representative in mainland China: 杭州笔无界科技有限公司, email support@inkoasis.ai

If you are not satisfied with our reply, you can complain to the competent authority where you are; see section 13.

13. Regional information

13.1 Mainland China

If you have a complaint about our processing of personal information, you can also report it to the cyberspace administration authorities (www.12377.cn, telephone 12377).

13.2 Hong Kong

You have the right to request access to and correction of your personal data. Please make the request in writing to our personal information protection officer (head of operations): by email to support@inkoasis.ai, or by post to the registered address in section 12. You can also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

Personal information collection statement: section 1 states which data is obligatory, the consequences of not providing it, and the purposes of use; the classes of persons to whom data may be transferred are the providers listed in the Service Providers list, the independent third parties described in section 4, and bodies to which disclosure is required by law. We will not use your personal data for direct marketing without your separate, express consent.

13.3 United States (including California)

• Categories of personal information we collect: identifiers (for example email, account identifiers and IP addresses), commercial information (for example subscription and payment records), internet activity information (for example server logs), and content you provide. Sources, purposes and recipients are described in sections 1 and 4 and the Service Providers list.
• We do not sell your personal information or "share" it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you.
• You can ask to know, delete or correct the personal information we hold about you, and you can authorise an agent to make a request for you (we will verify the authorisation). We will not discriminate against you for exercising these rights.
• When this policy is updated, we will notify you as described in section 11.

13.4 Japan

• Business handling personal information: 筆無界科技有限公司 (INKFINITE TECHNOLOGY LIMITED); address in section 12. We will promptly provide the name of our representative on request.
• Purposes of use are in section 1; how to request disclosure, correction, suspension of use and similar is in section 8, free of charge; complaints can be sent to support@inkoasis.ai.
• Security control measures are in section 10. The countries and regions where we and our providers handle personal data are listed in section 5.1 and the Service Providers list, and we have looked into the personal information protection systems of those countries and regions.
• We are not a business covered by an accredited personal information protection organisation.