Cookie Policy — Inkwell

01The short of it

We use as few cookies as we can get away with. There is no advertising cookie on any Inkwell property, no tracking pixel, and no third party building a profile of you as you move around the web.

What remains is the handful of things that make signing in work, plus cookie-less analytics you can switch off. This page lists every one of them. If you find one we haven't documented, that's a bug — tell us at thekodevs@gmail.com.

No consent banner.Under the ePrivacy Directive, strictly necessary cookies need no consent, and we don't set any others by default. Interrupting you with a banner to ask about cookies we don't use would be theatre.

03Every cookie we set

Name	Purpose	Lifetime	Consent
Session token	Keeps you signed in between page loads. Without it you would re-enter your password on every click.	Until sign-out, or 30 days idle	Strictly necessary
Session refresh token	Renews the session above quietly in the background so it doesn't expire mid-sentence.	Until sign-out	Strictly necessary
Sign-in verifier	A one-time value that proves the sign-in you complete is the one you started (PKCE). Prevents an intercepted code being redeemed by someone else.	Minutes — deleted on completion	Strictly necessary
Portal session	Keeps a client signed in to a portal you shared with them.	Until sign-out	Strictly necessary

All of them are first-party, set by Inkwell, marked HttpOnly and Secure where the browser allows it, and scoped with SameSite to resist cross-site request forgery.

04What we keep in local storage

These never leave your browser and are never sent to us:

Key	What it remembers
Appearance	Light or dark theme, density, accent colour, font pairing
Workspace	Which workspace you last had open, so you land back where you left
Plan intent	A plan you chose before signing up, so we can carry it through. Expires after an hour.

Clearing your browser storage removes all of these. Nothing breaks; you just get the defaults back.

05Analytics

We count page views and anonymous page-load timings in aggregate so we know which parts of Inkwell are worth improving, and which are too slow. This is cookie-less — no identifier is stored on your device and no cross-site profile is built.

How to switch it off

Enable Global Privacy Control in your browser, or
Enable Do Not Track.

We honour both signals as an opt-out. You don't need to tell us twice, and we won't nag you about it.

06Third parties

Inkwell sets no third-party advertising or tracking cookies. Two services may set their own cookies, and only when you actively use them:

Our payment provider, while a checkout window is open, for fraud prevention and to remember your billing details.
Your identity provider (Google or GitHub), if you choose to sign in that way. Those cookies belong to them and are governed by their policies.

Neither is set by simply browsing the site. See the full list of processors in our Privacy Policy.

07Taking control

Every browser lets you view, block, and delete cookies — usually under Settings → Privacy. You can also browse in a private window, which discards everything when you close it.

Blocking the strictly necessary cookies means we cannot keep you signed in. The app will still load, but you will be logged out on every navigation. There is no way around this: a session has to live somewhere.

08Changes to this policy

If we ever add a cookie, this page changes before the cookie ships, and the “last updated” date at the top moves. If we ever add one that isn't strictly necessary, we will ask for your consent first — properly, once, and we will remember your answer.

Spotted a cookie we haven't documented? That's a bug. Write to thekodevs@gmail.comand we'll fix the page — or the cookie.

— The Inkwell team