Inkoasis (笔绿洲, at inkoasis.ai, the "Service") is provided by 筆無界科技有限公司 (INKFINITE TECHNOLOGY LIMITED), a company incorporated in the Hong Kong Special Administrative Region of China ("we", "us" or "our"). We are responsible for processing your personal information (under different laws, the "personal information processor", "data user" or "controller").
This policy explains how we collect, use, store, share and protect your personal information when you use the Service, what rights you have and how to exercise them. It forms part of the Inkoasis User Agreement. Points that closely affect your rights — in particular cross-border processing and third-party providers — are shown in bold and underlined; please pay particular attention to them.
Key points
- Your works are yours. We do not use your works to train any artificial intelligence model, and we do not sell them; without your consent, we do not publish them or use them for promotion. How providers use data is governed by their own terms; see section 3.2.
- Your data is currently stored in Tokyo, Japan. Your account and works are kept on servers in Tokyo, which may change in future depending on where you are (see section 5.1). Only when you use a feature do we pass the content needed for that request to a provider (for example an AI model or file recognition); the providers are listed in the Service Providers list.
- No ad tracking. We do not sell your personal information or use it for advertising; the cookies and browser storage we use are described in section 7.
- You can manage your information at any time. Request account deletion in Settings → Account and data. To access, correct, export or delete information, or get help, email support@inkoasis.ai.
1. What we collect and why
We collect only the information needed to provide the Service. The tables below describe, by situation, what we collect, why, and what happens if you do not provide it.
1.1 Registration and sign-in
| Situation | Information collected | Purpose | If you do not provide it |
|---|---|---|---|
| Email registration and sign-in | Email address, password, email verification code | Create your account, confirm you can receive mail at that address, sign in, reset your password and send you account security alerts | You cannot register or sign in with email |
| Sign in with Google | Google account identifier, name, profile picture, email | Sign you in and show your name and picture in the interface | You cannot sign in with Google |
| WeChat sign-in | WeChat account identifier (openid), nickname, profile picture | Sign you in and show your nickname and picture | You cannot sign in with WeChat |
| Staying signed in | Session identifier, IP address at sign-in, browser information (User-Agent) | Keep you signed in and detect unusual sign-ins | You cannot stay signed in |
| Invitation access | Invitation code, the redeeming account and time | Unlock the workspace and prevent repeated redemption | During testing you cannot enter the workspace |
| Referral rewards | Your invite code, the inviter and the account created through their invite link, when the link was opened and the account created, the amount and status of the friend's first payment, reward status | Grant and take back referral rewards, and prevent self-referral | You cannot receive referral rewards |
- Passwords are stored only as salted hashes, so we cannot see your password; verification codes and the invitation codes we issue are also stored only as hashes.
- With Sign in with Google we request only basic profile information and never read your Gmail, Drive or similar content. Your Google profile picture is loaded by your browser directly from Google's servers.
1.2 Your works
| Information collected | Purpose |
|---|---|
| Projects, manuscript titles and text, revision history, plot graph and outline structure, story materials, items in the trash | Save, sync and restore your works; provide editing, version and export features |
| The writing request you enter on the home page | Create a project and hand it to the AI to start writing |
| Project covers | Show them in your project list; after upload they are converted into images without capture metadata |
| Writing skills (including skills you create or import, and their versions) | Let the AI write as you ask; let you manage and export them |
You provide this information yourself. Without it you can still browse the public pages of the Service, but you cannot save works.
1.3 AI features
| Information collected | Purpose |
|---|---|
| Your instructions and conversation history, the AI's replies and working steps, edits proposed by the AI and your decisions on them | Complete your AI requests and let you review and undo them |
| AI memory (for example your writing preferences and character settings) | Keep later writing consistent |
| Model settings and your own API key | Call models as you choose |
| Usage records (models used, usage and cost, without any work content) | Calculate usage and charges and reconcile costs |
| Provision records of AI-generated content (account and the sign-in email at the time, time, work and item IDs, a content fingerprint — never the text) | Keep the legally required record of which Generated Content without explicit labels was provided to you; see section 7.4 of the User Agreement |
To complete a request, we send the necessary context to the model provider. Depending on the request, this context may include relevant AI memory, the project structure, manuscript excerpts, story materials and file content you referenced, conversation history and web search results. We send only what is needed for that request.
1.4 Web search (off by default)
After you turn on web search in settings, the AI drafts search queries from your request, sends them to search providers and reads relevant web pages. We process the queries, search scope, page addresses and the page content retrieved, and keep them in the conversation history. Our servers may also fetch web pages directly, following each site's crawling rules (robots.txt).
1.5 File upload and recognition
| Information collected | Purpose |
|---|---|
| Files you upload, with their file name, size, type and checksum | Store your materials and avoid processing them twice |
| Text, page images and image descriptions extracted from files | Recognise text and let the AI cite it |
| Virus scan results | Block malicious files |
Pages that need text recognition (for example scans) are sent to file-recognition providers, and images are sent to an image-description provider; see the Service Providers list.
1.6 Payments
| Information collected | Purpose |
|---|---|
| Orders, plan, amount, currency, payment status, the payment provider's customer identifier, billing country or region | Process payments, send receipts, calculate tax, handle refunds and payment disputes |
| A fingerprint of the payment account (an identifier from the payment provider, stored as a hash) | Tell whether a referral reward comes from the same payment account |
| Tax ID, company name and billing address (optional, entered at checkout when you buy as a business; collected by our payment provider and kept in its customer record) | Show them on your invoices and determine which type of tax ID applies |
| The country or region your checkout comes from, judged by your IP address (kept with the order) | Apply the terms that depend on where you buy, for example the 6-month validity of credit packs bought in Japan |
Card and other payment details are collected and processed directly by our payment provider. We never see your full card number — only the card brand, the last four digits and the expiry date.
1.7 Help and feedback, contacting us
When you send something through Help and feedback, we process the type and the area you chose, what you wrote, any screenshots you attached and the contact email you left, plus information attached automatically when you send it: the page you were on, the IDs of the work and the conversation, your interface language, window size, browser information and the product version. We look at the content of that AI conversation only if you choose to attach it. We use this information to understand and fix problems, improve the Service and reply to you; your feedback is stored in our database and sent to our support inbox as a notification email.
When you email us, we process the content of your email, any attachments and your contact details to reply to you and handle your request.
1.8 Security and operational records
| Information collected | Purpose |
|---|---|
| Server logs (for example the page accessed, the time and the result) — never the content of your works | Troubleshoot and keep the Service stable |
| Network information recorded by our hosting providers, such as IP addresses | Defend against attacks and keep the network secure |
| Rate records for sign-in, registration and verification-code requests and for most other operations (for example saving works, starting AI tasks, uploading files and searching) | Prevent brute-force attacks and abuse |
| Bot checks: browser and device signals that our hosting provider's check script collects in your browser when you register, sign in or use an email verification code | Recognise automated programs and prevent mass registration and brute-force attacks |
| Account security records: one entry each time you sign in (with the IP address and browser information at the time), sign out your other devices or reset your password with a verification code | Keep your account secure |
| Account suspension records: the time and reason we record when we suspend an account, for example for abuse | Stop abuse and keep the Service secure |
| Records of creating and opening a project (time, browser information), without any work content | Keep a basic record of what happened to a project, to investigate problems |
1.9 What we do not collect
We do not collect your precise location, contacts, identity documents or biometric information, and we do not require real-name verification.
1.10 Sensitive personal information
We do not actively collect sensitive personal information. Your works may portray real people or sensitive subjects; such content is stored and processed only for you. Please do not upload other people's sensitive personal information (for example identity documents, medical records or bank accounts) unless you have lawful authorisation and it is genuinely necessary.
1.11 Changes of purpose
If we want to use your personal information for a purpose not described in this policy, we will tell you in advance, and where the law requires your consent we will ask for it separately.
2. Legal bases for processing
- Necessary to perform our contract with you: providing accounts, saving works, AI writing, file recognition, payments and other features.
- Our legitimate interests: keeping the Service secure, preventing abuse, troubleshooting, and using statistics that contain no work content to improve the Service. We weigh these interests to make sure they do not override your rights.
- Legal obligations: for example keeping transaction records and keeping records of AI-generated content provided.
- Your consent: for example cross-border processing (section 5) and marketing emails. You can withdraw consent at any time; withdrawal does not affect processing carried out before it.
3. AI and your works
3.1 We do not use your works, instructions, conversations or uploaded files to train or fine-tune any artificial intelligence model, and we do not sell them; without your separate consent, we do not publish them or use them for promotion.
3.2 Only when you use a feature do we pass the content needed for that request to a provider. Providers' data-use policies differ, and some providers' terms allow them to use the data they receive to improve their services or models; we try to choose providers and settings that do not use such data to train models, but we cannot guarantee this. When you use your own API key, the terms of the provider you chose apply.
3.3 We do not manually view your works unless you give or authorise access (for example by attaching content when reporting a problem), it is needed to handle your appeal or to respond to a security incident, or the law requires it.
3.4 We and our model providers may screen inputs and generated content automatically for safety, but we do not make automated decisions based on your personal information that produce legal or similarly significant effects for you. If you disagree with the result of automated processing, you can contact us for an explanation and appeal.
4. Processors, sharing and disclosure
4.1 We do not sell your personal information, and we do not share it with anyone for advertising.
4.2 Providers. We engage providers to deliver hosting, database, email, model, file-recognition, web search, encryption and payment services on our behalf. Providers may process your information only on our instructions and for the purposes in this policy, and are bound by confidentiality and security obligations (through their service agreements and data processing agreements). Their names, purposes, the information involved and where it is processed are listed in the Service Providers list.
4.3 Affiliate. Our affiliate 杭州笔无界科技有限公司 (a company registered in mainland China) contracts with and pays certain mainland Chinese providers on our behalf; see the Service Providers list. When those providers process your information, the affiliate uses the service accounts concerned only to contract, pay and manage the accounts, and does not use your information for its own purposes. It is also our personal information protection representative in mainland China; see section 12.
4.4 Independent third parties. The following third parties process your information under their own rules: the sign-in method you choose (Google, WeChat), the model provider behind your own API key, our payment provider where it acts independently (for example for fraud prevention), and your email provider.
4.5 Disclosure required by law. We may disclose information where laws, court decisions or competent authorities lawfully require it. We review the legality of each request, disclose only what is necessary, and notify you where the law allows.
4.6 Business transfers. If we need to transfer your personal information because of a merger, acquisition, sale of assets or similar, or because services in some regions are provided by an affiliate under section 4.6 of the User Agreement, we will tell you the recipient's name and contact details and require the recipient to remain bound by this policy; if the recipient changes the original purposes or methods of processing, it will ask for your consent again.
4.7 We do not publish your personal information or your works without your separate consent.
5. Cross-border processing
5.1 Where processing happens.
- We are a Hong Kong company; the Service's computing and database are currently located in Tokyo, Japan, and may in future be located, depending on where you are, in Japan, Hong Kong, the United States, Singapore or elsewhere.
- To provide the Service, we and our providers may process your information in Japan, Hong Kong, the United States, Singapore, Ireland and mainland China; see the Service Providers list.
Wherever you are, your personal information will therefore be processed outside your own country or region. We ask for your consent to this when you register.
5.2 Users in mainland China. The Service is provided by an entity outside mainland China and its servers are currently in Japan, so your personal information must be processed outside mainland China (in Japan, Hong Kong, the United States and elsewhere) to provide the services you choose; this is necessary to perform our contract with you. We inform you as follows:
- Overseas recipients: us (筆無界科技有限公司, email support@inkoasis.ai) and the providers outside mainland China listed in the Service Providers list;
- Purposes, methods of processing and categories of personal information: see section 1 and the Service Providers list;
- How to exercise your rights: you can exercise all of your rights against us as described in section 8, including in relation to processing by overseas providers; our personal information protection representative in mainland China can also assist you (section 12).
In addition, some features pass the necessary content to providers in mainland China.
5.3 Users in Japan. We obtain your consent in advance before providing your personal data to third parties in foreign countries.
- Names of the foreign countries: the United States, China (mainland), Singapore, and Hong Kong, where we are located.
- Personal information protection systems of these countries and regions: see the survey of foreign personal information protection systems published by Japan's Personal Information Protection Commission.
- Measures taken by the recipients: providers are bound by confidentiality and security obligations through their service agreements and data processing agreements; the measures of providers in mainland China are as stated in their published policies.
You can contact us at any time to ask for more information.
6. Retention
We keep your personal information only for as long as needed for the purposes of processing. When that period ends, we delete or anonymise it, unless the law provides otherwise.
| Information | Retention |
|---|---|
| Account information, invitation access, model settings, your own API key | While your account exists; deleted when you delete your account. An account registered with an email address that is still unverified after 7 days and holds no data other than its email address and password is deleted automatically |
| Works, story materials, skills | Until you delete them or your account |
| Manuscript revision history | Every revision from the last 90 days is kept; of older revisions, each manuscript keeps only its last revision of each day; revisions that a project version or a record of AI edits still refers to are also kept |
| Project versions you bookmark | Kept until you remove the bookmark, delete the project or delete your account |
| Deleted chapters, outlines and similar | First moved to the trash, where they can be restored for 30 days; after 30 days they are no longer shown, but so that the story history can still be rolled back, the related data stays with the project until you delete the project or your account |
| Deleted story materials | First moved to the trash, where they can be restored for 30 days; permanently deleted once the 30 days have passed |
| Deleted projects | Inaccessible immediately and deleted from the database, usually at the time of deletion or within 10 minutes after it |
| Deleted files | The file itself and the recognised text are deleted immediately, with automatic retries if a deletion fails; records of file name, size and checksum are kept until you delete your account, to avoid processing a file twice. File content the AI read or quoted in a conversation is part of that conversation's record and is kept with it until you delete the conversation, its project or your account; once the file is deleted, the AI no longer reads that content from the conversation's record |
| Deleted AI conversations | Inaccessible immediately, and the conversation content is deleted from the database, usually at the time of deletion or within 10 minutes after it; usage records without content are kept as in the next row |
| Usage and cost records (without work content) | Kept for 3 years after account deletion, to reconcile charges and handle disputes |
| Deletion request and processing records (account ID, status and times, without email addresses or work content) | Unconfirmed verification records are kept for at most 1 day; the code digest is cleared on confirmation. Completion records are kept for 3 years to handle request disputes and repeat deletion after a backup restore |
| Payment and transaction records (including the country or region your checkout came from, judged by your IP address) | 7 years, as required by Hong Kong tax law |
| Records of AI-generated content provided | At least 6 months, as required by law |
| Session records (including IP address and browser information) | Used to keep you signed in and for account security; deleted when you sign out, when the session expires or when you delete your account |
| Account security records (the IP address and browser information of each sign-in, and records of signing out other devices and of password resets by verification code) | 30 days, for account security |
| Account suspension records (time and reason of a suspension) | Kept while the suspension lasts; deleted when it is lifted or when you delete your account |
| Records of creating and opening a project (time, browser information) | Kept with the project; deleted when you delete the project or your account |
| Security and operational records (rate records, server logs, verification-code emails and similar) | Generally no more than 30 days; emails delivered to your mailbox are kept by your email provider |
| Support emails | Kept for 3 years after your request is handled, to deal with follow-up questions |
| Help and feedback (text, screenshots, contact email, and the page, work and conversation IDs, browser and version information) | Kept for 3 years after it is handled, to deal with follow-up questions; deleted from our database when you delete your account, while the notification email in our support inbox is kept as the row above says |
| Database backups | Daily backups kept for 7 days on a rolling basis; deleted data is removed from backups as they roll over |
| Data stored in your browser | Kept in your browser, which you can clear at any time; see section 7 |
7. Cookies and browser storage
We currently use the following four kinds of browser storage:
- Necessary sign-in cookies: keep you signed in and prevent forged requests during third-party sign-in.
- Functional cookies: remember the price currency and purchase terms shown for the region you visit from (for a visitor from Japan it records USD-JP, to show US-dollar prices and the credit-pack validity that applies there), and the invite link you opened (so that a sign-up within 60 days records who invited you).
- Browser local storage: keeps what you typed on the home page and in Help and feedback but have not sent yet (separately for each account), recognises the signed-in account so the page refreshes when you switch accounts, remembers interface preferences (for example open tabs), holds input drafts and the page to return to after sign-in, and, when a page closes, temporarily keeps manuscript edits not yet sent to the server (moved into the browser database the next time you open that project).
- Browser database: holds manuscript edits not yet saved to the server, so they can be recovered after a network drop or a refresh, cleared once saved; and screenshots in Help and feedback not sent yet, cleared once sent.
You can delete or block cookies and local storage in your browser settings. If you block the necessary cookies you cannot sign in; clearing local storage may lose edits not yet saved to the server.
We do not track you across websites, so we do not change how we process information in response to a browser's Do Not Track signal; we do not sell your personal information or "share" it for cross-context behavioural advertising.
8. Your rights
8.1 Your rights. Under applicable law, you have the right to:
- access and obtain a copy of your personal information;
- correct or complete inaccurate or incomplete information;
- delete your personal information;
- withdraw your consent;
- receive a copy of your personal information, or have us transfer it to another processor you designate (where technically feasible);
- delete your account;
- ask us to explain our rules for processing personal information;
- restrict or object to our processing where applicable law provides;
- lodge a complaint with a competent authority.
8.2 How to exercise your rights.
- Yourself in the product: you can edit and delete works, projects, files and conversations; export manuscripts one by one (Word, PDF, Markdown, TXT); and delete your own API key or turn off web search in settings.
- By email: for other requests, email support@inkoasis.ai from your account's email address and tell us which sign-in method the account uses (email, Google or WeChat). To protect your account we may ask you to help verify your identity, but we will never ask for your password or verification codes.
- Response time: we reply within the period required by applicable law.
- Cost: free. For manifestly unfounded or excessively repetitive requests, we may refuse or charge a reasonable fee as permitted by law, and will give our reasons.
8.3 Account deletion. In Settings → Account and data → Delete account, verify through the current account's email address and confirm deletion, or email support@inkoasis.ai to apply. Contact us by email if email verification is unavailable. Once verified and confirmed, the account is disabled immediately and background processing deletes the account and all of its projects, works, files, conversations, AI memory, skills, settings and your own API keys within the period required by applicable law. Closing the page does not interrupt processing. Copies in database backups are removed within the following 7 days as the backups roll over. The necessary records listed in section 6 (such as payment records, records of AI-generated content provided and deletion processing records) are kept separately and deleted when their period ends. Deletion cannot be undone, so please export the works you need first. Self-service deletion stops automatic renewal and ends plan benefits and remaining credits; refunds follow the Service Terms. Other independent sign-in accounts using the same email address are unaffected.
8.4 Deceased users. After a user dies, their next of kin may, for their own lawful and legitimate interests, access, copy, correct or delete the deceased's relevant personal information, unless the deceased arranged otherwise during their lifetime.
9. Minors
The Service is intended for adults aged 18 or over and is not directed at minors. We do not knowingly collect personal information from minors; if we find that a minor has registered an account, we will close it and delete the related information. If you believe we have collected a minor's information by mistake, please contact us.
10. How we protect your information
- All traffic is encrypted in transit; the database is not directly reachable from outside and can be read and written only by our servers after a permission check, and each project can be read and written only by its members.
- Passwords and verification codes are stored only as hashes; third-party sign-in credentials and your own API keys are encrypted.
- Files are stored in private storage, scanned for viruses on upload and processed in restricted environments.
- Server logs never record the content of your works.
- Only necessary operations staff can access production systems, under the principle of least privilege.
No system on the internet is perfectly secure. If a security incident such as a personal information breach occurs, we will take remedial measures and notify you and the competent authorities as required by applicable law. Please use a strong password and never share your password or verification codes.
11. Changes to this policy
We may update this policy; the updated version will be published on this page with the date at the top updated. If there are material changes to the purposes of processing, the categories of personal information, our providers or cross-border processing, we will notify you through an in-app notice or by email before they take effect, and where the law requires your consent again we will ask for it separately.
12. Contact us
If you have questions, comments or complaints about this policy, or want to exercise your rights, contact us:
- Email: support@inkoasis.ai (please put "Personal information" in the subject line)
- Personal information protection officer: our head of operations, reachable at the email above
- Operator: 筆無界科技有限公司 (INKFINITE TECHNOLOGY LIMITED)
- Registered address: UNIT 606, 6/F, PENINSULA CENTRE, 67 MODY ROAD, TSIM SHA TSUI EAST, KOWLOON, HONG KONG
- Representative in mainland China: 杭州笔无界科技有限公司, email support@inkoasis.ai
If you are not satisfied with our reply, you can complain to the competent authority where you are; see section 13.
13. Regional information
13.1 Mainland China
If you have a complaint about our processing of personal information, you can also report it to the cyberspace administration authorities (www.12377.cn, telephone 12377).
13.2 Hong Kong
You have the right to request access to and correction of your personal data. Please make the request in writing to our personal information protection officer (head of operations): by email to support@inkoasis.ai, or by post to the registered address in section 12. You can also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).
Personal information collection statement: section 1 states which data is obligatory, the consequences of not providing it, and the purposes of use; the classes of persons to whom data may be transferred are the providers listed in the Service Providers list, the independent third parties described in section 4, and bodies to which disclosure is required by law. We will not use your personal data for direct marketing without your separate, express consent.
13.3 United States (including California)
- Categories of personal information we collect: identifiers (for example email, account identifiers and IP addresses), commercial information (for example subscription and payment records), internet activity information (for example server logs), and content you provide. Sources, purposes and recipients are described in sections 1 and 4 and the Service Providers list.
- We do not sell your personal information or "share" it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you.
- You can ask to know, delete or correct the personal information we hold about you, and you can authorise an agent to make a request for you (we will verify the authorisation). We will not discriminate against you for exercising these rights.
- When this policy is updated, we will notify you as described in section 11.
13.4 Japan
- Business handling personal information: 筆無界科技有限公司 (INKFINITE TECHNOLOGY LIMITED); address in section 12. We will promptly provide the name of our representative on request.
- Purposes of use are in section 1; how to request disclosure, correction, suspension of use and similar is in section 8, free of charge; complaints can be sent to support@inkoasis.ai.
- Security control measures are in section 10. The countries and regions where we and our providers handle personal data are listed in section 5.1 and the Service Providers list, and we have looked into the personal information protection systems of those countries and regions.
- We are not a business covered by an accredited personal information protection organisation.