LEGAL

Data Protection

The strongest protection is not collecting data in the first place. Here is how that works in practice.

Last updated: 30 October 2026

Architecture by design

inkin.space is a static site with no backend and no database. The drawing engine is JavaScript running in your tab. There is no API endpoint that accepts a drawing, because there is no server-side component to accept one.

What is stored, and where

Drawings — in localStorage under your browser profile
Preferences — grid, background and tool settings, also local
Nothing else — no identifiers, no session tokens, no profiles

Encryption

Data at rest is protected by your operating system's disk encryption and your browser profile permissions. Traffic to the site uses HTTPS. We do not add application-level encryption because we never hold the data in the first place.

Data minimisation

Every feature request is evaluated against one question: can this be built without sending the drawing anywhere? If not, it is either redesigned or dropped. That rule is why there is no cloud sync, no AI autocomplete, and no collaboration mode.

Third-party surface

Only two external origins are contacted, both for static assets: Google Fonts for the Inter typeface and unpkg for the Ionicons icon set. If you need a fully offline build, both can be self-hosted without changing app behaviour.

Backups

We cannot back up your drawings for you. Export a JSON file (Cmd + S) to keep a portable copy, or export PNG/SVG for a finished image.

Deleting your data

Clear site data for inkin.space and app.inkin.space in your browser settings. That removes every drawing and preference we could ever have influenced. There is no server-side copy to request deletion of.

Reporting a concern

If you believe you have found a data handling issue, email [email protected] with the details. Please do not include sensitive drawing content in the report.