What we hold, and why
Last updated 5 September 2026
Inkstone is a writing tool operated by Extrafemi Labs. This notice covers the Inkstone product at inkstone.extrafemi.com. It is written to be read, not to be hidden behind. If something here is unclear, email [email protected].
1. Who the controller is
Extrafemi Labs is the data controller for personal data processed through Inkstone. Contact for any privacy question or request: [email protected].
2. What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Your email address | To sign you in (a one-time code), route you to the right workspace, and contact you about the service. | Performance of a contract |
| Writing samples you add, and the answers to the short set-up questions | To characterise your writing voice so drafts sound like you. Used for that and nothing else. | Performance of a contract |
| The voice guide generated from those samples, and any edits you make to it | Applied to every draft you run. | Performance of a contract |
| Domains you mark as trusted sources | To tier those sources fairly during research. | Performance of a contract |
| An activity log (which desk you picked, when a sample was added, errors) | To run the service, debug failures, and understand aggregate usage. | Legitimate interests (keeping the tool working) |
| Draft topics and generated drafts | Stored against a job so you can revise without re-researching. | Performance of a contract |
We do not collect payment details, we do not use advertising or tracking cookies, and we do not build a profile of you for any purpose other than drafting in your voice.
3. Storage on your device
Inkstone stores a sign-in token and a theme preference in your browser's local storage, and (if you connect your own model key) that key in session storage for the tab only. These are strictly necessary for the tool to work and are not shared with anyone. There are no analytics or advertising cookies. The site uses Cloudflare's cookieless Web Analytics for aggregate traffic counts; it sets no cookie and does not identify you.
4. Who else processes it
Inkstone runs on a small number of sub-processors, each under a data-processing agreement:
- Netlify — hosting, serverless functions, and the data store (US; Standard Contractual Clauses).
- Google Firebase Authentication — the user directory and session-revocation control (US; SCCs). No document database is used.
- Resend — sends the one-time sign-in code and service emails (US; SCCs).
- OpenRouter, and the model provider it routes your request to — runs the language model that analyses your samples and writes drafts (US; SCCs). Your text is sent for that single request and is not retained by us for training. OpenRouter's routing may reach providers who log prompts transiently for abuse detection; we select providers and settings to minimise this. When Inkstone analyses your own writing samples it asks OpenRouter to use only providers that do not keep or train on prompts; if none of those can answer, the request goes to the next available model instead, so an unavailable provider never stops you setting up.
- Lodestone — Extrafemi's open-source library that decides which model answers each request and moves to another when one is busy or down. It runs inside Inkstone's own functions: it is not a separate service and receives none of your text. It records only which model failed or answered, how long it took and what it cost — never prompts or drafts. That health record is kept in Inkstone's Netlify data store.
Fonts are served from Inkstone's own domain — no request is made to Google Fonts or any third-party font host.
5. Where it's processed
Data is processed in the United States by the sub-processors above. Transfers out of the UK/EEA rely on Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
6. How long we keep it
- Your voice guide, samples and trusted sources: until you delete them or delete your account.
- Sign-in codes: 10 minutes.
- Sessions: expire after 60 minutes of inactivity, and at most 7 days.
- Activity log: 30 days, then the daily records age out.
- Drafts and job records: up to 45 days, then pruned automatically.
7. Your rights
Under UK/EU data-protection law you can:
- Get a copy of everything we hold about you — in Inkstone, open the menu and choose “Download my data”. It's a JSON file, generated on the spot.
- Delete your account and data — the menu's “Delete my account” erases your voice guide, samples, sign-in record and activity log, and signs you out everywhere. This can't be undone. A minimal record of the deletion is kept only so old sign-in tokens keep failing.
- Correct anything inaccurate — your voice guide and its rules are all editable in the app.
- Object to or restrict processing based on legitimate interests, and complain to your supervisory authority (in the UK, the ICO — ico.org.uk).
8. Security
Traffic is encrypted in transit (HTTPS/HSTS). Sessions time out on inactivity. Sign-in is a one-time code, never a reusable password. Uploaded writing is screened for injected instructions before it is used and is only ever treated as reference text, never as commands or as a source of facts.
9. Children
Inkstone is a workplace tool and is not directed at anyone under 16.
10. Changes
If this notice changes materially we will update the date above and, where the change affects you, tell you by email.