Privacy Policy

App Store submission draft for the production iPad app, web/cloud services, and optional local companion paths. This draft still needs counsel and publication review before live use; it is not legal sign-off.

1. Who We Are

Belletrist is the production iPad app from InkCast. It is a notebook and study app for iPad with handwritten notes, AI-assisted tutoring, voice features, attachments, hosted account controls, subscriptions and credits, and an optional local companion mode.

In this Privacy Policy, "InkCast," "we," "our," and "us" refer to the operator of the InkCast app and related cloud services. For privacy questions, you can contact us at support@inkcast.app.

2. Scope Of This Policy

This Privacy Policy applies to:

• the Belletrist iPad app
• InkCast Cloud, including hosted authentication, notebook sync, attachments, account features, and AI-backed features
• optional InkCast Local companion features when you connect the app to your own Mac-hosted local server
• related support, billing, and account-management workflows

This Privacy Policy does not override the privacy practices of third-party services you choose to use, including Apple, Google, Supabase, RevenueCat, Razorpay, OpenAI, Anthropic, OpenRouter, Google AI Studio, ElevenLabs, fal.ai, DuckDuckGo, Brave Search, Sentry, or any provider you connect in local or BYOK mode. Those services have their own terms and privacy policies.

3. Cloud Mode, Local Mode, And BYOK

InkCast supports more than one operating mode, and privacy expectations differ by mode.

• Hosted Cloud Mode: notebook sync, cloud account features, attachments, and hosted AI features use InkCast Cloud infrastructure.
• Local Mode: you may connect InkCast to your own Mac-hosted companion server over your local network. In this mode, some content stays within your local setup rather than being sent through InkCast Cloud.
• BYOK Mode: some provider paths allow you to use your own provider API key or account. In those cases, requests may go directly through the provider path you selected instead of counting against InkCast's hosted allowance.

When a feature uses hosted AI, cloud storage, or cloud sync, it is not local-only.

When you use local mode, content may be sent over your local network to your own Mac companion server and may then be processed by the provider you configured there, such as Claude, Codex, Ollama, or an optional BYOK voice provider. BYOK keys, where supported by the app or companion, are stored in user-local secure storage such as Keychain or your local provider account, not committed to the InkCast repository.

4. Information We Collect

4.1 Account And Identity Information

We may collect:

• your email address
• your email-based authentication method and, if enabled in a future shipped build, Sign in with Apple or Google sign-in
• Supabase user identifiers, profile identifiers, and session/auth identifiers
• your display name and profile names
• pseudonyms or learner labels you choose to create
• account type, subscription plan, entitlements, and related account status

4.2 Notebook And Study Content

We may collect and store content you create or upload in InkCast, including:

• handwritten notebook strokes and page content
• typed prompts, typed notes, and workspace messages
• assistant responses and follow-up conversation context
• page transcripts and auto-transcribed page text
• notebook metadata, history, and events
• skill progress, practice signals, problem attempts, assessments, and mastery data
• skill-profile share-token metadata
• generated files and artifacts, such as summaries, flashcards, HTML previews, code exports, SVGs, images, videos, and other notebook outputs

4.3 Attachments And Imported Media

If you attach or import files, we may collect:

• uploaded images, PDFs, text files, code files, and other notebook attachments
• extracted text or context derived from those attachments
• file names, MIME types, timestamps, and notebook linkage metadata

4.4 Voice, Audio, Camera, And Photo Inputs

Depending on the feature you use, we may process:

• microphone audio for voice prompts or audio chat
• speech transcripts
• camera captures of handwritten work or worksheets
• images selected from your photo library

In local mode, the app can transcribe speech on-device before sending text to your local provider setup. In hosted cloud flows, audio, images, or transcripts may be sent to InkCast Cloud and the provider needed to complete the feature.

4.5 Billing, Purchases, Subscriptions, And Credits

If you purchase a subscription or credits through Apple's in-app purchase system, Apple handles the payment transaction. The first production iOS app submission uses StoreKit directly for iOS subscription purchases. If a future shipped build or non-App Store purchase path uses RevenueCat, RevenueCat helps process entitlement and receipt metadata. If a web or external billing path uses Razorpay, Razorpay processes the payment through that path. InkCast Cloud remains the authority for hosted credit balances and ledger state.

We may receive limited billing-related information such as:

• product identifier
• top-up identifier
• subscription plan
• purchase status
• entitlement state
• credit balance and hosted usage ledger entries
• transaction identifiers, original transaction identifiers, receipt metadata, event identifiers, and replay/idempotency markers
• transaction verification information made available through StoreKit

We do not receive your full payment card number from Apple, RevenueCat, or Razorpay.

4.6 Diagnostics, Usage, And Telemetry

We may collect operational data such as:

• app launch and session state signals
• unclean-exit detection
• authentication success or failure events
• feature-usage events and client telemetry submitted by the app, including events sent to /api/client-events
• request and error metadata
• server-side usage ledger entries for hosted AI budget enforcement
• logs needed for abuse prevention, debugging, performance, reliability, or security
• support report descriptions, optional screenshots, optional recent log tails, and issue-report metadata when you submit a report
• crash or performance diagnostics if a crash-reporting service such as Sentry is enabled for the shipped build

Some telemetry and analytics-related processing can be restricted or turned off through in-app controls.

4.7 Consent, Safety, And Security Records

We may collect and retain:

• hosted AI consent before the first off-device AI turn
• consent records and consent versions
• parental consent status where applicable
• processing restriction requests and reasons
• IP address and user agent associated with consent or security events
• account and service abuse-prevention data

4.8 Local Network And Companion Connection Data

If you use InkCast Local, we may process:

• local server URL or connection settings stored on your device
• pairing code or bearer-style local access token
• Bonjour or local-network discovery details
• local server health and capability information

4.9 Web Search Data

If you explicitly use web search features or send a prompt that invokes web search, InkCast may process:

• your search query
• search results and URLs
• snippets returned by the search provider

4.10 App Permissions

Depending on what you enable, InkCast may request permission to access:

• your microphone for voice prompts and voice features
• speech recognition for on-device transcription
• your camera for capturing handwritten problems or worksheets
• your photo library for importing images into notebooks
• your local network for discovering and connecting to your Mac companion server

5. Hosted AI Consent

Before the first off-device hosted AI turn, Belletrist asks for explicit hosted AI consent. Hosted AI turns may send selected handwriting, prompts, typed notes, voice inputs, transcripts, images, attachments, and notebook context to InkCast Cloud and to the third-party provider needed to complete the feature.

You can use in-app account controls to restrict optional processing, manage analytics consent, export data, or delete your account. Restricting processing does not make hosted cloud features local-only; it pauses optional processing where supported while core account, billing, security, and legal workflows keep working.

6. How We Use Information

We use personal information to:

• create and manage your InkCast account
• authenticate you and maintain your session
• save, sync, restore, export, and delete notebooks and related content
• provide AI tutoring, notebook assistance, practice, web search, transcription, media generation, and voice features
• support notebook sync, course guidance, practice workflows, and generated study material
• calculate progress, mastery, practice review, and study-card features
• provide subscriptions, entitlements, and usage controls
• enforce hosted AI usage budgets and abuse safeguards
• maintain safety, reliability, performance, and debugging workflows
• honor your privacy choices, processing restrictions, and consent settings
• comply with legal obligations and respond to valid legal requests

7. When We Share Information

We share information only as needed to operate the product, complete a feature you request, comply with law, or protect the service.

We may share information with the following categories of recipients:

• infrastructure and platform providers, such as Supabase and our cloud hosting providers
• AI and media providers used to answer prompts, transcribe audio or images, synthesize speech, generate media, or run web search
• Apple for authentication, in-app purchases, TestFlight, App Store, and platform services
• RevenueCat if the shipped build uses RevenueCat for subscription, receipt, or entitlement workflows
• Razorpay if you use a web or external billing flow powered by Razorpay
• Sentry or another diagnostics provider if crash or performance diagnostics are enabled for the shipped build
• legal authorities or other parties when required by law or when necessary to protect rights, safety, or the integrity of the service

We do not sell personal information. We do not use your notebook content for third-party advertising. The app privacy manifest declares NSPrivacyTracking=false; Belletrist is not designed to track you across other companies' apps or websites for advertising purposes.

8. AI, Search, And Media Providers

When you use hosted AI or media features, the content needed to fulfill your request may be sent to InkCast Cloud and to one or more external providers. Depending on the feature and configuration, these providers may include:

• OpenAI for core hosted ChatGPT responses
• Anthropic for hosted Claude responses and some search-enabled flows
• OpenRouter for selected model-routing, transcription, image, video, and fallback AI flows
• Google AI Studio when you select supported Google-hosted model paths
• ElevenLabs for cloud text-to-speech
• fal.ai for image editing, aspect-ratio expansion, and image-to-3D generation
• DuckDuckGo or Brave Search for web-search queries and result retrieval

The data shared can include your prompt text, notebook excerpts, typed notes, transcripts, cropped page images, attachments, audio, and output instructions, but only to the extent needed to fulfill the feature you chose to use.

If you use a BYOK configuration or a local provider setup, the relevant request may be processed under your own provider account or local environment instead.

9. Unlisted Dashboard Links And Public Access

InkCast includes unlisted dashboard/share-token features for selected progress surfaces.

• Skill-profile or dashboard share links may be unlisted rather than publicly indexed. Anyone with the active link may be able to view the shared material until the link is rotated, revoked, or expires.

Please use share links carefully and only with people you intend to include.

10. Optional Training And De-Identified Archives

InkCast includes consent-aware data governance paths for certain internal training or improvement workflows.

Separate consent categories may apply to:

• training on handwriting data
• training on skill analytics data
• training on interaction data

Where these workflows are used, InkCast is designed to archive only data covered by the relevant consent and to remove or scrub direct identifiers before moving data into anonymized archive tables.

We do not intentionally add your data to these anonymized archives unless the corresponding consent is active.

11. Data Retention

We retain different categories of data for different periods, depending on the feature, your settings, and legal or operational needs.

In general:

• account, notebook, profile, attachment, and hosted usage data are retained until you delete them, delete your account, or we no longer need them to operate the service
• local device data remains on your device until you remove the app, sign out, clear local data, or delete the relevant content
• telemetry, logs, notebook events, consent records, and similar operational data may be retained for a limited period needed for debugging, abuse prevention, legal compliance, or account history
• de-identified archive data may be retained longer than source data where permitted by law and consent

If you delete your account, we will process the deletion according to our account-deletion workflow. Some records may remain in backups, archives, fraud-prevention logs, or legally required retention systems for a limited time.

12. Your Choices And Rights

Depending on your location and how you use InkCast, you may be able to:

• access and update your account or profile information
• use "Export my data" in Account Center
• delete your account from within the app with "Delete account"
• delete notebooks, attachments, and share links
• restrict optional processing and telemetry with "Restrict processing"
• manage analytics or other consent settings with the analytics consent control
• choose local mode, cloud mode, or BYOK-supported paths for certain features

You can also use device-level permission settings to control microphone, camera, photo-library, speech-recognition, and local-network access.

If you want to exercise privacy rights that are not available directly in the app, contact us at support@inkcast.app.

13. Children And Education

InkCast is not submitted for the App Store Kids Category. InkCast is intended to be used with appropriate parent, guardian, school, or organizational supervision where required by law. If a child uses InkCast in a context where parental consent is required, the responsible adult or account owner must obtain that consent outside the app.

Parents, guardians, teachers, and account owners using InkCast are responsible for using it in compliance with applicable education, household, and local privacy requirements.

If InkCast is used in an educational setting, additional school or district terms may apply. Contact support@inkcast.app for account or deletion requests that cannot be completed in the app.

14. International Transfers

InkCast and its service providers may process data in countries other than the one where you live. By using hosted features, you understand that your information may be transferred to and processed in other jurisdictions, subject to applicable safeguards and provider practices.

15. Security

We use administrative, technical, and organizational measures intended to protect personal information. No service can guarantee absolute security.

Important limits include:

• hosted cloud features depend on third-party infrastructure and provider security
• local network mode depends on the security of your home, school, or office network
• local companion LAN mode may expose your Mac-hosted server to other devices on the same network if they obtain the pairing code

Please use strong device security, keep your software updated, and avoid sharing account credentials or local pairing codes.

16. Changes To This Policy

We may update this Privacy Policy from time to time. If we make material changes, we may update the date above, revise in-app disclosures, request refreshed consent where appropriate, or otherwise notify you as required by law.

17. Contact

For privacy questions, requests, or complaints, contact:

• Email: support@inkcast.app
• Support: mailto:support@inkcast.app

Before publishing this policy publicly, add your legal entity name and any mailing address or regional privacy contact details required by the jurisdictions where you operate, and complete counsel/publication review.