InkStrip Privacy Policy
Plain-English Summary
InkStrip is built around a simple promise: your comics stay yours.
- We never upload your comic files. They stay on your device, or on a cloud folder you connect (iCloud Drive, Google Drive, Dropbox) that you already control.
- We do collect a small amount of account, subscription, and usage data needed to run the service — described in detail below.
- We do not sell your data, run ads, use advertising identifiers, or share data with third-party advertisers.
- You can request a copy of your data, or delete it permanently, at any time by emailing privacy@themattlabs.com.
If anything in this policy is unclear, email us and we’ll explain.
Contents
- Who We Are
- Scope
- App Store Privacy Label Summary
- What We Collect and Why
- Third Parties Who Process Your Data
- International Data Transfers
- How Long We Keep Your Data
- Your Rights
- Children
- Security
- Beta Testing (TestFlight)
- Cookies and Similar Technologies
- Automated Decisions and Profiling
- Changes to This Policy
- Contact
1. Who We Are
InkStrip is operated by TheMattLabs Ltd (“TheMattLabs”, “we”, “us”), registered at 2C Tudor Road, Kingston Upon Thames, KT2 6AW, United Kingdom.
For privacy questions or to exercise your rights, contact: privacy@themattlabs.com.
For users in the EU/UK, TheMattLabs is the data controller for personal data processed by InkStrip.
2. Scope
This policy covers the InkStrip iOS application, including beta builds distributed through Apple’s TestFlight program. It does not cover:
- Other TheMattLabs products (e.g., UpMark — see themattlabs.com/privacy)
- Third-party services you reach from within InkStrip (e.g., your Google Drive account, your Dropbox account)
- Comic content you legally obtain elsewhere
This website. This policy is published on inkstrip.themattlabs.com. Those pages are static: they set no cookies, run no scripts, load no fonts or resources from third parties, and contain no analytics or tracking of any kind. Visiting them leaves no record with us beyond the ordinary server logs kept by our hosting provider.
3. App Store Privacy Label Summary
| Category | Collected? | Linked to you? | Used for tracking? |
|---|---|---|---|
| Contact Info (email, name) | Yes — if you create an account | Yes | No |
| User Content (reading progress, preferences, library metadata) | Yes — local; synced if Pro | Yes | No |
| Identifiers (Firebase UID, device identifier) | Yes — if you create an account | Yes | No |
| Product Interaction (reading position, reading sessions) | Yes — local; synced if Pro | Yes | No |
| Diagnostics (crash logs, performance data) | Yes | Yes | No |
| Purchases (subscription status) | Yes | Yes | No |
| Comic files / page images | No — never uploaded | — | — |
| Advertising identifiers (IDFA) | No | — | — |
| Location, Contacts, Photos library, Health, Browsing history | No | — | — |
| Sensitive Info (race, religion, sexual orientation, political views) | No | — | — |
4. What We Collect and Why
4.1 Account Data
When you create an account or sign in:
- Sign in with Apple: Apple-provided email (or relay email), name (if you share it), and an Apple user identifier
- Sign in with Google: Email address, display name, profile picture URL, and a Google user identifier
- Email and password: Email address and a securely hashed password (managed by Firebase Authentication)
- Firebase user ID (UID): A unique identifier issued by Firebase that lets us recognise you across sessions and devices
Purpose: to create your account, authenticate you, sync your data across your devices, and contact you about service issues if needed.
Legal basis (EU/UK): performance of the contract you enter into when you sign up.
4.2 Subscription Data
When you subscribe to InkStrip Pro:
- Subscription status, plan, renewal date, trial state — managed by RevenueCat on our behalf
- Apple App Store transaction identifier — used to verify your subscription is valid
- Anonymous device identifier (if you are not signed in) — to associate the subscription with your device
We do not receive or store your payment card details, billing address, or Apple ID password. Those are handled entirely by Apple.
Legal basis: performance of the contract.
4.3 Reading Data (Synced for Pro Users)
If you have an active InkStrip Pro subscription and have signed in, the following data may be synced to your account so you can pick up where you left off on another device:
- Reading progress — which page of which issue you are on, last-read timestamps, completion status
- Reading preferences — reading direction (LTR/RTL/vertical), brightness, page-turn animation, per-series overrides
- Library manifest — your list of series, and the details attached to each: title, issue count, and your chosen reading mode, plus any series details you have entered or edited yourself (writer, artist, publisher, year, genre, summary). Your comic filenames are not sent in readable form — each issue carries a one-way hash used only to recognise the same comic on another device.
- Reading sessions — start time, end time, pages read, for the reading-stats feature
- Deletion tombstones — small markers indicating items you deleted, so the deletion propagates across your devices
- Device identifier — your device’s Apple-provided Identifier for Vendors (IDFV), sent with each sync so a device can recognise and ignore its own changes coming back. It is unique to InkStrip on your device and resets if you delete all TheMattLabs apps.
What is NOT synced: the comic files themselves, page images, your file paths, or any other content from your device’s storage.
Purpose: to provide the cross-device sync feature advertised for Pro users.
Legal basis: performance of the contract.
Server logs: Like any web service, our sync backend records the IP address of requests it receives. We use this only to operate the service and to rate-limit abuse; we do not use it to build a profile of you or to determine your location beyond what an IP inherently reveals.
Hosting: Sync data is stored on InkStrip’s backend infrastructure hosted by Railway (running on Google Cloud Platform) in the Netherlands (europe-west4). It is transmitted over TLS 1.2 or higher and encrypted at rest. Railway maintains SOC 2 Type II, SOC 3, HIPAA, and GDPR compliance and offers a Data Processing Agreement.
4.4 Local Library Data (Stored Only on Your Device)
The following data is stored locally on your device using Apple’s SwiftData framework and is not transmitted to us unless you have Pro and sync is enabled (see 4.3):
- File paths and security-scoped bookmarks for comic files you have imported or connected
- Locally generated cover thumbnails and reading-progress markers
- Free-tier reading history, preferences, and collections
If you delete the InkStrip app, all locally stored data is removed by iOS along with the app.
4.5 Cloud Library Sources (User-Connected Folders)
If you connect a cloud folder (iCloud Drive, Google Drive, or Dropbox) as a library source, InkStrip uses iOS security-scoped bookmarks to access the folder on your behalf. We store the folder reference and metadata about its contents (file names, sizes, modification dates, scan timestamps).
We do not upload your comic files to InkStrip servers, and we do not read file contents beyond what is needed to detect that a file is a comic archive (CBZ/CBR/PDF) and generate a thumbnail. The files remain in your cloud account under your control.
InkStrip does not sign you in to Google Drive or Dropbox and holds no account credentials or access tokens for them. You choose a folder through the standard iOS document picker, and iOS grants InkStrip access to that folder only. Access is stored on your device as a security-scoped bookmark, which we cannot use to reach anything else in your cloud account.
4.6 Analytics
InkStrip does not include an analytics SDK. The app links no usage-analytics library — not from Google, not from anyone else — and no advertising SDK. We do not collect screen views, in-app event streams, session counts, approximate location, or device-level advertising identifiers.
We do not use the Identifier for Advertisers (IDFA), and the app never presents an App Tracking Transparency prompt, because there is nothing to ask permission for.
The only automatically transmitted data is crash and stability diagnostics, described in 4.7.
4.7 Crash and Performance Diagnostics
InkStrip uses Firebase Crashlytics to receive automatic reports when the app crashes or hits a non-fatal error. Crash reports include:
- Stack trace and exception type
- App version, build, iOS version, device model
- A non-resettable Firebase installation identifier
- Anonymous breadcrumbs of the last few in-app actions (e.g., “opened reader”, “imported file”)
Alongside crashes, the app records a small number of counters for reliability problems it can detect itself — for example a sync clock-skew warning. Where such a counter references your device or a specific issue, the identifier is SHA-256 hashed before it is sent, so we see a fingerprint rather than the value.
Crash reports do not include the content of your comics, your file paths, your email address, or any personal account data.
Purpose: to detect and fix bugs.
Legal basis: legitimate interests in maintaining a stable product.
4.8 User-Initiated Diagnostic Export
InkStrip includes a Settings → Export Diagnostics feature. When you tap it, the app creates a ZIP file on your device containing your local error log, a count of items in your library (no titles), and basic app/device version information.
This ZIP is not uploaded anywhere. It is shared only to wherever you choose via the iOS share sheet (e.g., Mail, Messages, AirDrop, Files). If you send it to us for support, you are choosing to do so, and we will only retain it as long as needed to resolve your support request (typically under 30 days).
5. Third Parties Who Process Your Data on Our Behalf
These are our “data processors” (or “subprocessors”). They handle your data under contract on our behalf:
| Service | Provider | What it does | Where data is processed |
|---|---|---|---|
| Firebase Authentication | Google LLC | User sign-in, password management | United States |
| Firebase Crashlytics | Google LLC | Crash reporting | United States |
| RevenueCat | RevenueCat, Inc. | Subscription state management | United States |
| Apple Sign In | Apple Inc. | Apple ID sign-in flow | Per Apple’s policy |
| Google Sign-In | Google LLC | Google account sign-in flow | United States |
| Apple App Store / StoreKit | Apple Inc. | Subscription billing | Per Apple’s policy |
| InkStrip Sync Backend | TheMattLabs, hosted on Railway (GCP) | Cross-device sync of reading data (Pro) | Netherlands (europe-west4) |
Third Parties You Connect Yourself (Independent Controllers)
When you connect a cloud library source, those providers act as independent data controllers for the data they hold:
| Provider | Why it’s connected | Their privacy policy |
|---|---|---|
| Apple iCloud Drive | Comic file source | apple.com/legal/privacy |
| Google Drive | Comic file source | policies.google.com/privacy |
| Dropbox | Comic file source | dropbox.com/privacy |
We have no visibility into what you store with those providers beyond the specific folder you grant InkStrip access to.
6. International Data Transfers
If you are in the EU/UK and we transfer your data to the United States (e.g., Firebase, RevenueCat), the transfer is covered by Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner’s Office, and by each provider’s adherence to the EU-US Data Privacy Framework where applicable.
You can request a copy of the safeguards in place by emailing privacy@themattlabs.com.
6a. When We May Disclose Your Data
We do not sell your personal data, and we do not share it for advertising or cross-context behavioural advertising. This applies to every US state privacy law that uses those terms, including the CCPA/CPRA in California.
Beyond the processors listed in section 5, we may disclose personal data only where:
- The law requires it — for example a court order, a valid legal request from a regulator or law enforcement, or to comply with a legal obligation
- It is necessary to protect rights or safety — to investigate suspected fraud or abuse of the service, or to protect the rights, property or safety of our users or the public
- The business changes hands — if TheMattLabs Ltd is acquired, merged, or its assets are sold, your data may transfer to the new owner. If that happens, the data stays subject to this policy until you are given notice and a meaningful opportunity to delete your account first
US residents: whichever state you live in, you can exercise the rights described in section 8 by emailing privacy@themattlabs.com. We will not discriminate against you for doing so.
7. How Long We Keep Your Data
| Data | Retention period |
|---|---|
| Account data (email, Firebase UID) | Until you delete your account — immediately when you use Settings → Delete Account, or within 30 days if you ask us by email |
| Sync data (reading progress, preferences, library manifest) | Until you delete your account — immediately when you use Settings → Delete Account, or within 30 days if you ask us by email |
| Deletion markers (tombstones — small records that let your other devices know you deleted an item) | Up to 90 days, then automatically purged |
| Subscription records | Retained as required for tax and accounting (typically 7 years), anonymised after account deletion |
| Crash reports (Firebase Crashlytics) | 90 days (Firebase default) |
| Diagnostic ZIPs you send us by email | Up to 30 days after your support ticket is resolved |
| Support and privacy correspondence (emails you send us) | Up to 2 years, so we can follow up on related issues |
Deleting your account removes your data from our live database immediately. Copies may persist in our infrastructure backups for a short additional period, no longer than 90 days, before those backups are overwritten.
Local data on your device persists until you delete the app.
You can delete your account at any time from Settings → Delete Account in the app. This removes your account from our authentication provider and permanently deletes your synced data from our servers. Your imported comics, and the reading progress stored on the device itself, are deliberately left in place — deleting your account does not delete your library. You can also email privacy@themattlabs.com if you would rather we do it for you.
8. Your Rights
Regardless of where you live, you can:
- Access the personal data we hold about you
- Correct inaccurate data (most fields are editable in-app via Settings)
- Delete your account and your synced data — in the app via Settings → Delete Account, or by emailing privacy@themattlabs.com. Your comics and on-device reading progress are not affected.
- Export a machine-readable copy of your data
- Object to processing based on legitimate interests
- Lodge a complaint with your local data protection authority
Subscription expiry never deletes your data. If your InkStrip Pro subscription ends, your local comics, reading progress, and preferences remain intact on your device. Cross-device sync stops, and your synced data stays on our servers so that your reading position is waiting for you if you subscribe again later. It is deleted when you delete your account — see section 7.
To exercise any right, email privacy@themattlabs.com. We will respond within 30 days.
9. Children
InkStrip is intended for users aged 13 and over, or 16 and over in EU countries that set a higher minimum age for consenting to online services.
We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information to us, contact privacy@themattlabs.com and we will delete it.
We do not direct InkStrip at children, do not include child-targeted features, and have not been designed under Apple’s Kids Category.
10. Security
We protect your data with:
- TLS 1.2 or higher for all network connections (enforced by Apple’s App Transport Security; we use no exemptions)
- Encryption at rest for synced data — our backend runs on Railway (on Google Cloud Platform), where database and disk storage are encrypted at rest by default. Railway is SOC 2 Type II and SOC 3 certified, and HIPAA- and GDPR-aligned.
- iOS Keychain storage for sign-in credentials — Firebase Authentication, Apple Sign In and Google Sign-In each keep their own tokens there. We hold no credentials for your cloud storage: connecting a folder uses an iOS security-scoped bookmark, not an account login (see 4.5)
- Security-scoped bookmarks so that cloud-folder access (iCloud Drive, Google Drive, Dropbox) is sandboxed to the specific folder you select and revocable at any time from iOS Settings
- Archive extraction limits that protect against malicious or malformed comic files. We enforce a 100 MB per-file cap, a 4 GB total archive cap, a 5,000-entry cap, path-traversal protection, symlink rejection, and an image-type allow-list
No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify you and the relevant regulators as required by law (typically within 72 hours for GDPR/UK GDPR).
11. Beta Testing (TestFlight)
If you participate in the InkStrip beta program via Apple TestFlight:
- Apple shares your TestFlight tester email and basic install/crash information with us so we can manage the beta and respond to feedback
- Crash reports and feedback you submit via TestFlight are governed by Apple’s TestFlight terms and Apple’s privacy policy
- Beta builds may include additional logging that is removed before App Store release
- Your TestFlight participation can be ended at any time by removing the app or leaving the test group in TestFlight
Once a build is released on the App Store, the beta data collected by TestFlight is retained by Apple per Apple’s policy, not by us.
12. Cookies and Similar Technologies
InkStrip is a native iOS app and does not use browser cookies. It uses:
- iOS UserDefaults for non-sensitive preferences
- iOS Keychain for credentials and tokens
- SwiftData local database for your library
- Firebase Installation ID for crash attribution (there is no analytics SDK — see 4.6)
These are not transmitted to third parties beyond the processors listed in Section 5.
13. Automated Decisions and Profiling
We do not use your data to make automated decisions that produce legal or similarly significant effects about you. We do not profile you for advertising or scoring.
14. Changes to This Policy
We may update this policy as the product evolves. When we make material changes:
- We will update the Last Updated date at the top
- For significant changes, we will notify you via the app on next launch and, where required by law, by email
- The previous version will be archived and available on request
Continued use of InkStrip after a change indicates acceptance of the updated policy. If you do not agree, you can delete your account.
15. Contact
Privacy questions, requests, and complaints: privacy@themattlabs.com
Postal address: TheMattLabs Ltd, 2C Tudor Road, Kingston Upon Thames, KT2 6AW, United Kingdom