InkEgg.io Privacy Policy

Effective Date: October 22, 2026
Replaces the policy of September 2, 2025.

1. Everyone who visits

• Server logs. Like almost every website, our web server records each request: your IP address, the page asked for, the time, and the browser's user-agent string. These web server logs are deleted after 14 days. The app's own error and event logs, which can hold an IP address or username, are deleted after about 30 days.
• Country check. InkEgg is offered in the United States only. Your IP address is checked against a country database stored on our server; it isn't sent anywhere.
• Security monitoring. Requests that look like an attack, such as probing for files that don't exist here, attack payloads or repeated failed logins, are recorded with the IP address, the request, the time and the browser string, so intrusion attempts can be spotted. Ordinary visits aren't recorded this way. These security records are deleted after 90 days.
• Abuse protection. To stop floods of requests, the server counts requests per IP address. The counts are held in memory and cleared within minutes.
• Cookies. No tracking or advertising cookies. A browsing visitor gets no cookies from InkEgg at all. If you submit a form, a short-lived cookie (one hour) carries the "message sent" notice to the next page. If you sign in, a login cookie keeps you signed in (see section 4).
• Your browser's own storage. Many tools remember settings or your work in your browser's local storage (for example, a chosen camera or a draft). That data stays on your device; we can't see it, and clearing your browser data removes it.

Content loaded from other services

Some pages load fonts, code libraries or embeds from other companies. Your browser contacts them directly, so they receive your IP address and browser details, as with any web request, under their own privacy policies:

• Google Fonts (fonts.googleapis.com) on every page.
• jQuery CDN (code.jquery.com) on most pages, and cdnjs (Cloudflare) or jsDelivr on a few.
• Google reCAPTCHA on the Contact and Create Account forms, to keep out spam bots. reCAPTCHA is subject to Google's Privacy Policy and Terms.
• Tableau Public (Salesforce) for the embedded charts on Omaha Crime and Green Line.

2. Tools that work entirely in your browser

Most InkEgg tools, including Stop Motion, the GIF Editor, PDF Edit, Chroma Key, the camera and microphone toys, the synths, the games and the generators, do their work on your own computer. Camera and microphone input is processed in the browser and never uploaded. Stop Motion saves photos only into a folder you choose on your own disk.

3. Public tools that do send something

• Contact form (About Us). Your name, email address, message and IP address are emailed to our inbox through Brevo, our email service, and kept in that inbox (Google Gmail). We use them only to reply to you. An automated assistant that sorts our inbox may read the message, using Anthropic's Claude AI.
• GIF Zoetrope. The GIF you upload is turned into a printable PDF in the server's memory and isn't saved.
• UPC Scanner / Lookup. A barcode photo is read on our server and deleted right away. The barcode number, never the photo, is looked up at Barcode Lookup (barcodelookup.com).
• ASCII City and Go Outside. The place you type is looked up by our server at OpenStreetMap services (Nominatim and Overpass), and Go Outside fetches the weather from Open-Meteo. These services see our server, not you. Results are cached in memory for up to 30 days and aren't linked to you.
• Pixel Canvas. The pixels you paint are saved and shown to everyone. Nothing identifies who painted them.

4. If you have an account

Accounts are approved by hand, and access to each tool is granted individually. When you create one, we store:

• your username, email address and name, and optionally a mobile number;
• your password, but only as a one-way hash, never the password itself;
• the IP address you signed up from;
• a record of each sign-in session (browser, IP address and last activity), so you can see your signed-in devices in your Profile and sign them out;
• a security record of each sign-in attempt, successful or not (username, time, IP address and browser), kept for 90 days;
• a profile picture, if you add one, and any feedback you send, which is stored and emailed to us through Brevo.

Signing in sets a login cookie, which keeps you signed in for up to 30 days after your last visit. A password-reset code is emailed through Brevo.

Account tools and where your data goes

These tools are available only to signed-in users who have been given access to them. What you put into them is used only to run the tool for you. The table says what is kept; anything not mentioned is processed and then discarded.

Tool	What it handles	Outside service
SMS Reminders	Your mobile number and the reminders you schedule. When you opt in, we record your consent (number, time, IP address, browser and the wording you agreed to).	Brevo sends the texts
Advanced Transcriber	Uploaded audio and the transcript. The audio is deleted 30 minutes after the transcript is ready, or sooner when you export it. Transcripts stay until you delete them.	OpenAI (speech-to-text)
YouTube Transcriber	The video you choose is downloaded from YouTube and transcribed. The transcript is emailed to you and held on the server for 30 minutes.	OpenAI (speech-to-text); Brevo (email)
Echo Vault	Audio recordings and images you submit for transcription or text recognition. They aren't kept on the server.	OpenAI (speech-to-text); Google Cloud Vision (text in images)
Face Scan	Webcam photos or video frames of your face, used to build a 3D model. These are kept only in the server's memory, never written to disk, and discarded 2 hours after last use.	OpenAI (checks the photos and the model)
80-HD journal	Your notes are kept in your browser unless you turn on saving to your account. Summaries send the notes for that week or month to be summarised.	Anthropic (summaries)
Ledger	Bank transaction files you import and your categories. Questions you ask send the relevant transactions to be answered.	OpenAI (questions)
Address Mapper, Sprinkler Pepper	Addresses you enter or upload, processed and not kept on the server.	OpenAI (address clean-up); Google Maps; US Census Geocoder
QR Library	The text, links and files you attach to your QR codes, which anyone with the code can open.	None
Games	Scores and game preferences.	None

A few private administration tools process only the site owner's own data. Those tools don't record the security camera feeds.

5. Outside services, and who we share with

We don't sell, rent or trade personal information, and we don't share it for advertising or marketing. The only companies that receive it are the services that do the work for a feature you use, as listed above:

• Brevo: email and text-message delivery.
• OpenAI and Anthropic: AI processing, through their business APIs. Both say they don't train their models on API data by default.
• Google: reCAPTCHA, Fonts, Maps, Cloud Vision, and the Gmail inbox that receives our mail.
• Others: Barcode Lookup, OpenStreetMap, Open-Meteo and the US Census Geocoder, which receive only the barcode, place or address being looked up; Tableau Public, Cloudflare (cdnjs), jsDelivr and the jQuery CDN, which serve page content.

We would disclose information only if required by law, or to protect the site and its users from abuse.

6. How long we keep it, and deleting your account

Account data is kept while your account exists. You can delete your account from your Profile at any time, which immediately and permanently removes your account, profile, reminders, journal notes, transcripts, ledger, QR codes, game data and preferences. A few records are kept after deletion:

• SMS consent and delivery records (phone number, consent wording, time, IP address and browser), plus an opt-out list. Text-message rules require us to be able to prove consent and to keep honouring a STOP.
• Feedback you sent, stored with your username, and any emails already sent to us.
• Server and application logs, until they are deleted (14 days for web server logs, about 30 days for application logs), and security records, for 90 days.

Information already sent to an outside service is kept under that service's own retention terms.

7. Your choices

• Use InkEgg without an account, and most of it collects nothing about you beyond the server logs above.
• See and change your details, and see or sign out your sessions, in your Profile.
• Stop text messages at any time by replying STOP, or by revoking consent in your Profile.
• Delete your account from your Profile, or email us to ask what we hold about you or to have it removed.

8. Security

The site is served only over HTTPS. Passwords are stored as one-way hashes. Sign-in attempts are rate-limited, and only the site owner can reach user data. No system is perfectly secure, but we keep what we hold to a minimum.

9. Children

InkEgg isn't directed at children, and accounts aren't offered to anyone under 13. We don't knowingly collect personal information from children under 13; if you think we have, email us and we'll delete it.

10. Changes

When features change what we collect, we update this page and its effective date.

Contact

Questions about this policy or your data: admin@inkegg.io