Privacy Policy

Effective date: 29 July 2026

Last updated: 15 October 2026

Your privacy matters to us. This policy explains what data we collect, why we collect it, and what happens to it when you use InkCraft.

1. What We Collect

Information you provide

• Account: when you first open the app, we create an anonymous account for you automatically. We do not ask for your name, email address or phone number. You can choose to add a nickname, a profile photo and your gender.
• Searches and history: what you search for in the ideas library, to improve it, and the designs you generate, saved to your history until you delete them or your account.
• Purchases: payments are processed by the Apple App Store or Google Play, and we never see your card details. We store which product you bought, its purchase reference and your subscription status, so we can unlock Pro features for you.

Information collected automatically

• Usage analytics: on the website, we use privacy-focused analytics that do not use cookies and do not track you across sites. In the apps, we use analytics services, including Google Analytics, that record which features you use and how the app performs, linked to your anonymous account ID. We also record how app screens are used, with photos and text hidden, to find and fix usability problems.
• Device metadata: app version, OS version, device model, and locale stored in your user profile to help us improve compatibility.
• Device and region: a device identifier we use to prevent abuse of free features, and your country, time zone and language (from your device settings and IP address) to set prices and limits. We never collect your precise location.
• Crash reports: reports of app crashes, linked to your anonymous account ID, so we can diagnose and fix bugs.

Information you upload

• Photos you upload: when you upload a photo to try on a tattoo or to extract a design, it is sent to our server only to produce that result and is not stored afterwards. We do not use your photos for any other purpose.
• Profile photo: if you add one, it is stored with your profile until you remove it or delete your account.
• EXIF metadata: EXIF location data is stripped from your photo client-side before upload so your location is never transmitted to our servers.
• Android waitlist email (optional): if you are on an Android phone and ask to be told when InkCraft for Android launches, we store the email address you enter, the page language, and the page you were on. It is used only to send that launch email.

AI features

• When you use an AI feature (generating a design, extracting a design from a photo, or chatting with our AI assistant), the text, photos and messages you submit are sent to external AI service providers to produce the result. We use only paid AI services.
• We do not use your photos, prompts or chats to train AI models.
• AI chat conversations are not stored on our servers.

2. How We Use Your Data

We do not sell your data. We do not use your photos or designs to train AI models.

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area, we process your data on the following bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to operate and improve the Service, detect abuse, maintain security, and understand how the website and apps are used so we can improve them.

4. Photo Processing in Detail

When you use the web or app try-on:

1. Your photo is loaded and displayed locally in your browser or device.
2. EXIF metadata (including GPS location) is stripped before any data leaves your device.
3. The photo is transmitted over an encrypted HTTPS connection to our processing server.
4. Our server renders the tattoo placement and returns the preview image.
5. The uploaded photo is deleted from server memory at the end of the request. It is not written to persistent storage, logged, or retained in any form.

This is the same posture described in our Terms of Service §5.

5. Data Sharing

We share data only with service providers that help us run InkCraft:

• Cloud hosting, database and storage providers: to run the app, the website and your account.
• Content delivery and security providers: to serve the website and protect it from abuse.
• Analytics and crash-reporting providers, including Google Analytics: to understand how InkCraft is used and fix bugs.
• External AI service providers: to produce the results of AI features (see §1).
• Apple App Store and Google Play: to process purchases and subscriptions.

We do not share your data with Pinterest. Our Pinterest integration involves our own company account only — see §6.

We share with each provider only what it needs to provide its service to us.

6. Pinterest Integration

InkCraft uses the Pinterest API to publish our own marketing content — tattoo preview imagery and design inspiration — to our own company Pinterest account, @InkCraftApp.

This integration does not involve your data in any way. InkCraft users do not connect Pinterest accounts to InkCraft. We do not request, receive, access, or store any Pinterest account, profile, board, Pin, or other Pinterest data belonging to you or to any other Pinterest user. Nothing about you is sent to Pinterest.

InkCraft is not endorsed by, sponsored by, certified by, or affiliated with Pinterest. "Pinterest" and the Pinterest logo are trademarks of Pinterest, Inc. Our use of Pinterest is governed by Pinterest's Terms of Service and Privacy Policy.

What the integration does

Authenticating as our own Pinterest account, we call the Pinterest API to list our own boards and to create Pins on them. That is the entire scope of the integration.

What we store

We do not store information accessed through the Pinterest API. We call the API each time we need it, in line with Pinterest's Developer Guidelines. The only value we retain is the OAuth access and refresh token for our own account, kept securely and used solely to publish to that account.

We do not copy, archive, cache, or index Pins, boards, images, profiles, or any other content or data obtained from Pinterest.

Disconnecting

When we disconnect our account — from within our own tooling, or by revoking access in Pinterest's settings — the access and refresh tokens are deleted immediately. Since no other Pinterest-derived data is retained, nothing else remains to delete.

What we never do

We do not sell, rent, resell, license, sublicense, redistribute, or otherwise transfer Pinterest content or Pinterest-derived data to any third party. We do not use it for advertising or ad targeting, we do not combine it with data from other sources to build profiles, and we do not use it to train AI models.

Questions about this integration: hello@inkcraftapp.com.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to processing based on legitimate interests.

To exercise any of these rights, email hello@inkcraftapp.com. We will respond within 30 days.

8. Data Retention

• Account data: retained while your account is active. Deleted within 30 days of account deletion.
• Usage analytics and crash reports: deleted automatically after a limited period set in our analytics tools.
• Uploaded photos: not retained (see §4).
• Pinterest data: none retained. We store no information accessed through the Pinterest API; only our own account's OAuth token, deleted immediately on disconnect (see §6).
• Purchase records: retained for 7 years to meet accounting obligations.
• Android waitlist emails: kept until we send the Android launch email, then deleted. Ask us at any time to remove yours sooner.

Account deletion

You can delete your account in the app (Settings → Delete Account) or request it at inkcraftapp.com/delete-account. Within 30 days, we delete your account and the data associated with it from our servers. We keep only a counter for your device that limits free use, which is not linked to your account, and the purchase records we must keep for accounting (see above).

9. Security

We use encryption (TLS) for all data in transit. Our servers are access-controlled.

10. Children

The Service is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy. We'll post any changes on this page and update the date at the top.

12. Contact

Data protection questions: hello@inkcraftapp.com