Privacy
Policy

Overview

Digital Ink is an iPad art application that transforms selected images into unique Smart Inks. Smart Inks can be used to create artworks, acquire concepts through education, develop biographies and produce optional AI-assisted descriptions and memory reconstructions.

Digital Ink is designed to work primarily on your device.

We do not require you to create an account. We do not display third-party advertising, sell personal information or track you across other companies’ apps and websites.

Some optional features use online services provided by Cloudflare and OpenAI. Digital Ink explains what will be sent and asks for your permission before initiating an online AI request.

Purchasing credits does not, by itself, constitute consent to send an image or other content to an AI service.

Information processed on your device

Digital Ink may store the following information locally on your iPad:

• Smart Inks created from images you select
• Smart Ink identifiers, colours and creation dates
• Vision Memory descriptions and structured visual metadata
• Emotional descriptions, palettes, subjects and environmental details
• Personal memory notes that you choose to write
• Learned concepts, hashtags and education levels
• Ink relationships, affinity information and provenance history
• Artworks, canvases and pixel placement
• Generated reconstructions
• Certificates and export information
• Application settings and preferences
• Local activity and diagnostic history
• Credit balance information received from the Digital Ink service

This information remains on your device unless you deliberately use an online feature, export content or share it through another application.

Artist Identity

Digital Ink creates a local Artist Identity. It may include an artist handle, a derived Artist ID, a public signing key, a creation date and an optional artist identity image.

The optional identity image is processed locally and reduced to a compact display image with a maximum dimension of 256 pixels. The private artwork-signing key is stored locally in the iOS Keychain and is not intentionally transmitted to Digital Ink’s online service.

The public Artist ID is distinct from the pseudonymous device/service identifier used by Digital Ink’s online credit service.

Artwork Verification V2

Newly eligible artworks can be cryptographically signed and verified locally. Verification metadata may include an artwork hash, verification version, signing time, artist public-key information, composition and pixel information, Smart Ink provenance identifiers, a signature and verification status.

This is local artwork verification. It does not prove facts that were never recorded.

Heritage Inks

Older Smart Inks created before the current provenance system may be identified as Heritage Inks. Recorded creator, owner and history information may be displayed, but Digital Ink does not invent missing historical proof or manufacture a cryptographically verified transfer history.

Local Smart Ink relationships

The current Smart Ink relationship network is calculated and stored locally. It may use local Ink metadata, artwork experience, relationship history and provenance-derived evidence.

Relationship states, histories, explanations, 3D InkHome exploration and routes remain local functionality. The current relationship system does not require an external AI service and does not automatically upload source images, private notes or relationship histories for relationship calculation.

Access to photographs and files

Digital Ink processes only photographs, artworks, screenshots, PDFs or other files that you choose to import.

A selected image is used to create a Smart Ink, calculate its colour and generate its visual memory. When you use the built-in offline analysis, this processing takes place on your device.

Digital Ink does not intentionally upload your entire photo library and does not require access to photographs that you have not selected.

Imported PDFs are processed to derive concepts and hashtags for Smart Ink education. The PDF itself is not sent to OpenAI as part of the education process.

When you export a certificate, image or other artwork, you choose its destination using Apple’s sharing interface. The privacy practices of the receiving application or service then apply.

Optional Source Memory

During Sacred Transformation, you may choose to preserve a small visual trace of the selected image as Source Memory.

Source Memory is:

• Optional
• Disabled unless you choose to include it
• Resized to a maximum of 192 pixels on its longest edge
• Compressed before being stored
• Kept locally as part of the Smart Ink’s biography

If Source Memory is not selected, Digital Ink does not retain a preview of the original image as part of the Smart Ink.

The full-resolution original image is not stored inside the Smart Ink.

A Source Memory remains on your device unless you explicitly choose to include it in an online AI Memory Reconstruction.

Built-in offline image recognition

Digital Ink uses Apple’s on-device Vision technologies for offline image analysis. This may derive image classifications, detected visual subjects, OCR text visible inside an imported image or screenshot, confidence and evidence information, visual-region information and factual descriptions.

OCR may capture text visible in an image even when that text was not manually typed into Digital Ink. New imports may retain structured derived visual evidence locally as part of the Smart Ink metadata.

This offline processing does not require Digital Ink credits and does not transmit the selected image to Cloudflare or OpenAI.

Because on-device recognition is automated, its descriptions may be incomplete or inaccurate.

Online Assist for image descriptions

Online Assist is an optional feature that provides a more detailed description of a selected image.

Before an online description begins, Digital Ink identifies the external services involved and asks for your permission.

If you consent, the following information may be sent:

• A compressed copy of the image you selected
• A place name derived from the image’s metadata, when available
• Instructions requesting a visual description and structured memory
• A pseudonymous Digital Ink device/service identifier used to verify credits
• A request or operation identifier used for reliability and duplicate protection
• Technical information required to process and secure the request

The information travels through Digital Ink’s Cloudflare service and is then sent to OpenAI for analysis.

The resulting description and Vision Memory are returned to the app and stored locally as part of the Smart Ink.

Digital Ink’s Cloudflare caption cache does not intentionally retain the selected source image. It may temporarily retain the returned caption together with an operation/idempotency record for up to 24 hours for safe retries and duplicate-charge protection. After expiry, that caption cache entry is deleted.

This caption-cache limit does not set the retention period for Cloudflare’s network or security logs. OpenAI has its own separate API data-retention practices, described below.

An online image description currently costs 1 Digital Ink credit. Credits are not deducted unless the online operation is requested.

AI Memory Reconstruction

AI Memory Reconstruction is an optional feature that creates a new image inspired by what a Smart Ink remembers and what it has learned.

It is not designed to recover or reproduce the original photograph.

Before reconstruction begins, Digital Ink explains what information will be shared and asks for your permission.

Depending on the available biography and the options you select, reconstruction may send:

• The Smart Ink’s Vision Memory and image description
• Subjects, environment, colour and emotional information
• Personal memory notes that you entered
• Learned concepts, hashtags and education information
• Relationship or affinity information
• Provenance and transformation information
• Place information associated with the Smart Ink
• An AI reconstruction prompt created from this information
• Source Memory, only if it exists and you choose to include it
• A pseudonymous Digital Ink device/service identifier
• A unique operation identifier used to prevent duplicate charging
• Technical information required to process and secure the request

This information is sent through Digital Ink’s Cloudflare service to OpenAI’s image-generation service.

OpenAI generates a new image and returns it through Cloudflare to Digital Ink. The completed reconstruction is stored locally on your device.

A reconstruction currently costs 10 Digital Ink credits.

A unique operation identifier is reused when the app retries the same reconstruction. This helps prevent a retry from charging the same operation more than once. When an eligible operation fails after charging, the service attempts to return the credits automatically.

For a limited period, normally up to 24 hours, Cloudflare may retain the operation identifier, charging state and result needed to safely replay a completed request or process a refund without generating or charging twice.

Explicit AI permission

Digital Ink does not treat the following actions as permission to share your content with OpenAI:

• Purchasing credits
• Restoring a purchase
• Creating a Smart Ink using offline recognition
• Enabling Source Memory
• Previously consenting to a different AI operation

Permission is requested in the context of the particular online feature.

You may decline and continue using Digital Ink’s offline features. You can withdraw permission for future processing by cancelling the consent screen or choosing not to use Online Assist or AI Memory Reconstruction.

Withdrawing permission cannot recall information that has already been transmitted for an operation you previously approved.

OpenAI processing

OpenAI processes submitted content to provide online image descriptions and image generation.

According to OpenAI, data submitted through its API is not used to train or improve its models by default unless the API customer explicitly opts in to data sharing.

Under OpenAI’s standard API data controls, prompts, images, generated outputs and associated metadata may be retained in abuse-monitoring logs for up to 30 days, unless a longer period is required by law. OpenAI’s policies and available retention controls may change.

More information is available at OpenAI API data controls and the OpenAI Privacy Policy.

Digital Ink does not operate or control OpenAI’s infrastructure. OpenAI processes information according to its applicable terms, privacy commitments and security controls.

Cloudflare processing

Digital Ink uses Cloudflare Workers and related Cloudflare services as a secure intermediary between the app, OpenAI and Apple’s purchase-verification services.

Cloudflare may process:

• Submitted AI content while routing a request
• Pseudonymous Digital Ink device/service identifiers
• Credit balances and credit-ledger transactions
• Apple purchase-verification information
• Operation identifiers
• Reconstruction charging, completion and refund states
• Temporarily cached reconstruction results
• Temporarily cached Online Assist captions and operation/idempotency records
• IP addresses, request headers and timestamps
• Security, rate-limiting and error information

Pseudonymous online identifier

Online Digital Ink services use a randomly generated pseudonymous Digital Ink device/service identifier stored locally in Keychain. It is used to associate credit balances, process Online Assist and reconstructions, protect operation idempotency, and validate and restore purchases.

This service identifier is not the public Artist ID, is not an advertising identifier and is not used for cross-app tracking.

Digital Ink does not use Cloudflare to build advertising profiles.

Cloudflare may retain limited network and security logs according to its service configuration, legal obligations and privacy policy.

Credits and Apple in-app purchases

Digital Ink credits are purchased through Apple’s in-app purchase system.

Apple processes your payment information. Digital Ink does not receive your complete credit-card or bank-account details.

To validate a purchase and maintain the correct credit balance, Digital Ink and its Cloudflare service may process:

• The purchased product identifier
• Apple transaction or signed purchase information
• Purchase and restoration status
• A pseudonymous Digital Ink device/service identifier
• Credit grants, deductions and refunds

Apple processes purchase information according to its own privacy policy.

Credit-ledger information is stored on Digital Ink’s Cloudflare service so that balances can remain accurate across purchases, reconstructions, retries, refunds and restorations.

Technical and operational information

When an online feature is used, Digital Ink and its service providers may automatically process limited technical information, including:

• IP address
• Date and time of the request
• App version
• Device or operating-system information included in network requests
• Request status and error category
• Rate-limiting and security information
• Operation identifiers and the pseudonymous Digital Ink device/service identifier

This information is used to provide the requested service, prevent fraud, protect credits, diagnose failures and maintain security.

Production application logs are designed to avoid recording complete captions, personal memory notes, AI prompts, source images, authentication secrets or full Smart Ink metadata.

Information we do not intentionally collect

Digital Ink does not intentionally collect:

• A user account profile
• Your name, postal address or phone number
• Contacts
• Health or fitness information
• Microphone recordings
• Advertising identifiers
• Cross-app browsing activity
• Complete payment-card or bank details

Digital Ink does not sell personal information and does not share information for third-party behavioural advertising.

How information is used

Information is processed only as needed to:

• Create and maintain Smart Inks and artworks
• Provide offline image analysis
• Provide optional online descriptions and reconstructions
• Store Source Memory when requested
• Maintain Smart Ink education, biography and provenance
• Validate purchases and maintain credit balances
• Prevent duplicate charges and provide eligible refunds
• Protect the service from fraud, abuse and excessive requests
• Diagnose technical failures
• Respond to privacy or support requests
• Meet applicable legal obligations

Where applicable, processing is based on providing the feature you requested, your explicit consent, the legitimate operation and security of the service, or compliance with legal obligations.

Sharing of information

OpenAI

For online image descriptions and AI Memory Reconstruction, and only after explicit permission for the requested operation.

Cloudflare

For secure request routing, credit accounting, purchase verification, operation deduplication, temporary result recovery, rate limiting and service security.

Apple

For App Store distribution, in-app purchases, purchase restoration and transaction verification.

Legal or safety recipients

Information may be disclosed if reasonably necessary to comply with law, protect users, investigate fraud or abuse, or protect the rights and security of Digital Ink and its service providers.

Digital Ink requires its service providers to handle information under their applicable data-protection, confidentiality and security commitments.

Data retention

Information on your device

Local Smart Inks, Source Memories, artworks, biographies, education data, reconstructions and settings remain on your device until you remove or “set free” the relevant content, reset application data or uninstall Digital Ink.

Deleting the app may remove local data that has not been exported or backed up by an Apple service.

Credit ledger

Pseudonymous credit and transaction records may be retained while needed to maintain balances, verify purchases, prevent repeated claims, resolve disputes, prevent fraud and satisfy legal or accounting obligations.

Online Assist

Successful Online Assist caption/idempotency cache records may be retained by Digital Ink’s Cloudflare service for up to 24 hours for retry and duplicate-operation protection. The caption cache entry is deleted after expiry. This cache does not intentionally retain the selected source image.

Reconstruction operations

An operation’s deduplication state and result may be temporarily retained by Cloudflare, normally for up to 24 hours, so retries can return the original result without charging again.

Operational logs

Limited security and network logs, including Cloudflare’s network and security logs, may be retained for a period determined by the service configuration, security requirements, legal obligations and the policies of the applicable provider. The Online Assist caption cache’s 24-hour limit does not necessarily apply to these logs.

OpenAI

OpenAI API content may ordinarily be retained in abuse-monitoring logs for up to 30 days, unless different retention controls apply or a longer period is legally required.

Apple

Apple retains purchase and App Store information according to its own policies and legal obligations.

Deleting information and requesting assistance

You can remove locally stored information by using Digital Ink’s available farewell or reset controls, or by uninstalling the application.

Before removing the app, export any artworks, certificates or reconstructions that you want to keep.

To request deletion or correction of information held by the Digital Ink online service, email hello@q888.space.

We may ask for information necessary to identify the applicable pseudonymous service record or purchase transaction, together with a description of what you want deleted or corrected. Your public Artist ID is not the online service identifier.

Do not send photographs, personal memories, API keys or payment-card information in your email.

Deleting server-side credit-ledger information may make any remaining credit balance impossible to verify or restore. Certain purchase, fraud-prevention, security or accounting records may need to be retained where required by law or reasonably necessary to protect the service.

Digital Ink cannot directly delete records independently controlled by Apple or OpenAI. Requests concerning those services may need to be directed to the relevant provider.

International processing

Cloudflare, OpenAI and Apple operate internationally. Information submitted to online features may be processed in countries other than the country where you live.

Those providers maintain their own legal mechanisms and safeguards for international data transfers. Their privacy policies provide further information about their processing locations and safeguards.

Security

Digital Ink uses reasonable technical and organisational safeguards intended to protect information.

These measures include encrypted HTTPS connections, server-side purchase verification, pseudonymous identifiers, controlled access to service credentials, rate limiting, duplicate-operation protection and reduced production logging.

No electronic transmission or storage system can be guaranteed to be completely secure.

Your privacy rights

Depending on where you live, you may have rights relating to your personal information, including the right to:

• Request access
• Request correction
• Request deletion
• Restrict or object to certain processing
• Withdraw consent for future processing
• Request a portable copy of certain information
• Complain to an applicable data-protection authority

To make a request, contact hello@q888.space.

For assistance with server-side privacy requests, we may ask for information necessary to identify the applicable pseudonymous service record or purchase transaction.

Children’s privacy

Digital Ink is a general creative application and does not knowingly collect personal profile information from children.

Children should use online AI features only with the involvement and permission of a parent or legal guardian where required by applicable law.

If you believe that a child has submitted personal information through an online feature without appropriate permission, contact hello@q888.space.

Third-party links and exported content

Digital Ink may provide links to external websites or allow you to export content to other applications.

Digital Ink is not responsible for the privacy practices of websites, applications or services that it does not control. Review their privacy policies before sharing personal information.

Changes to this policy

This policy may be updated when Digital Ink’s features, service providers or legal obligations change.

The canonical public privacy policy is published at q888.space/privacy/. Revisions will be published there with a new effective date. Material changes may also be communicated within the app or through the App Store where appropriate.