Privacy Policy

Introduction

At Inpages.me, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our digital journaling service. We believe your thoughts and memories deserve the highest level of privacy protection.

How We Protect Your Privacy

New memories start with Protected protection by default unless you change that preference. Protection is a choice you can see and change for each memory. Inpages.me also supports Standard private memories and intentionally published memories, which have different privacy properties.

• Protected memories: Their title, writing, links, keepsakes, and inline images are encrypted in your browser before upload. The server stores ciphertext and cannot derive the plaintext.
• Standard private memories: They are private to your account but stored in server-readable form so features that require server processing can work.
• Public memories: Publishing is explicit. Public content must be server-readable so it can be shown to anyone with the link. If you turn on Publisher mode, public memories may also appear in search engines.
• Your vault key protects Protected memories: Your Vault Password unlocks the key in your browser. You may also export a Recovery Key that only you hold.

What this protects you from:

• Protected memory content is not readable by our server or staff
• A database copy does not reveal the plaintext of Protected memories
• We cannot provide plaintext that we do not possess for Protected memories

What this does NOT protect you from:

• Malicious software on your computer that steals your Vault Password or active key
• Someone who has physical access to your device while you're logged in
• Harmful browser extensions that might access your data
• If you lose your Vault Password, Recovery Key, and every unlocked device, we cannot recover your encrypted memories

Information We Collect

Account Information

When you create an account, we collect:

• Email address: We need this to create your account and help you log in
• Password: We store a one-way password hash, not your password itself. We cannot tell you the original password if you forget it
• Google sign-in (optional): If you choose Google, we receive your email address and basic profile information and store the most recent sign-in time. A Google-only account creates a separate Vault Password for Protected memories.

Encryption Information

To protect memories you mark as Protected, we store technical information that helps your browser encrypt and decrypt them. This includes:

• A random code that works with your Vault Password to create your encryption key
• Your encrypted master key (this is like a locked safe—we have the safe, but only your Vault Password or Recovery Key can unlock it)

Important: We cannot use this information to read Protected memories. You must have your Vault Password, an exported Recovery Key, or an already-unlocked device to read them.

Your Journal Entries

When you write a memory, here's what we store:

• Protected memories: Their title, content, links, file attachments, and inline images are stored as ciphertext. We cannot read their plaintext.
• Standard private memories: They remain behind your account access but are stored in readable form on the server.
• Public memories: A Protected memory must be changed to Standard protection before publication. Published content is stored in readable form so others can view it.
• Basic information: We store when you created and last updated each memory, and whether it's encrypted or not. This basic information is not encrypted.
• Journal settings: Your journal name, author name, and theme preferences are stored normally (not encrypted) so we can display them properly.

Session Information

When you log in, we keep track of your session so you stay logged in. This includes:

• A special code that identifies your login session
• What browser and device you're using
• When you logged in and when your session expires

This information is automatically deleted when you log out or when your session expires.

Reminder Information

If you set reminders for memories, we store:

• Reminder date and time
• Optional reminder message
• Optional additional email recipients (up to 3 emails)

Reminders are automatically deleted after they are sent. Email addresses provided for reminders are used solely for sending reminder notifications.

Automatically Collected Information

When you use our service, we may automatically collect:

• Device information and browser type
• IP address and general location data
• Usage patterns and interaction data
• Cookies and similar tracking technologies (for session management)

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Authenticate your identity and manage your account
• Store Protected, Standard private, and intentionally published memories according to the protection and visibility choices you make
• Enable sharing features when you explicitly choose to share content
• Send reminder email notifications when you request them
• Send occasional Inpages notes and invitations to reflect. You can unsubscribe in any of these emails or in Settings → Account.
• For end-of-week emails sent by our team, keep the recipient address, send status, when a small image in the email loads, and clicks on the email’s main link. This helps us understand whether these notes are useful. Email apps may load images or check links automatically, so these signals do not confirm you read an email or used the app.
• Detect and prevent fraud or abuse
• Comply with legal obligations

We do not:

• Read or look at the content of your encrypted memories
• Use private journal entries for advertising or marketing
• Share your encrypted data with other companies (except if legally required)
• Read the plaintext of files or attachments belonging to Protected memories

Sharing Your Memories

Your memories are private by default. However, you can choose to share individual memories with others:

• You must unlock it first: If a memory is encrypted, you need to decrypt it before sharing. Once you decrypt it for sharing, it stays decrypted.
• Anyone can view it: When you share a memory, we create a public link that anyone can access—no login required.
• Search discovery: Publisher mode is off by default. While it is off, shared memories are excluded from search. Turning it on makes current and future public memories eligible for search unless Inpages excludes specific content for safety or policy reasons.
• You can stop sharing: Unpublishing removes public access from Inpages.me, but people or search engines may already have copied or cached it.
• No password protection: Anyone who has the link can view your shared memory.

Important: Think carefully before sharing. Once you share a memory, it becomes public and we cannot control who sees it or what they do with it. Only share content you're comfortable making public.

How We Store and Protect Your Data

Where Your Data Lives

Your information is stored in secure computer systems:

• Our database: This is where we keep your account information, encrypted memories, and settings
• File storage: Your photos, videos, and other attachments are stored separately in managed storage systems
• Your browser: We temporarily store your encryption key in your browser so you don't have to enter your password constantly. This is automatically cleared when you log out.

How We Keep It Safe

We use several methods to protect your data:

• Secure connections: All data is sent over encrypted internet connections (you'll see "https" in your browser)
• Password protection: Account passwords are stored as one-way hashes; Vault Passwords derive encryption keys using Argon2id in your browser
• Secure sessions: We use secure methods to keep you logged in safely
• Automatic cleanup: Old login sessions are automatically deleted
• Access controls: Only authorized systems can access our databases

While we do our best to protect your data, no system is 100% secure. We cannot guarantee that your data will never be accessed by unauthorized parties, but we use industry-standard security practices to minimize this risk.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With your explicit consent: When you choose to share a memory publicly
• Service providers: With service providers that help us operate hosting, storage, authentication, analytics, and email delivery
• Legal requirements: When required by law, court order, or government regulation
• Protection of rights: To protect our rights, privacy, safety, or property, or that of our users
• Business transfers: In connection with a merger, acquisition, or sale of assets (with notice to users)

Important note: We can provide data we possess when legally required. Protected memory content is stored as ciphertext that we cannot decrypt without a key held on your device or in an exported Recovery Key. Standard private and public content is server-readable.

Your Rights and Choices

You have the right to:

• Access your data: View all your memories and account information
• Update your information: Modify your email address, password, journal settings, and memory content
• Delete your account: Request deletion of your account and all associated data (encrypted memories, files, sessions, reminders)
• Export your data: Download your journal entries (Protected content remains encrypted and requires your Vault Password or Recovery Key)
• Control sharing: Choose which memories to publish and unpublish them later
• Manage reminders: Create, view, and manage reminders for your memories

Account deletion: When you delete your account, all associated data is permanently deleted, including:

• Your identity and account information
• All memories and journal entries
• All file attachments
• All sessions
• All reminders
• All external links

Shared memories: If you have shared memories, they will become inaccessible when you delete your account, but copies may have been made by others or cached by search engines.

Cookies and Browser Storage

We use cookies and browser storage to make the service work properly:

• Keeping you logged in: We use secure cookies to remember that you're logged in
• Storing your encryption key: We temporarily store your encryption key in your browser so you don't have to enter your password every time. This is automatically cleared when you log out.
• Understanding public journeys: Google Analytics measures public page views, interactions with links and buttons, calls to action, plan choices, signup paths, and blog engagement. It does not run inside the authenticated journal.
• Understanding account setup: We keep a limited first-party timeline of account creation, pricing, checkout, payment confirmation, and vault-setup milestones. It excludes journal content and encryption material and is retained for up to 90 days.

You can control cookies through your browser settings, but disabling them may prevent the service from working properly.

Third-Party Services

We work with other companies to provide the service:

• Google sign-in (optional): If you choose to sign in with Google, Google's privacy policy applies to information shared with them.
• File storage: Keepsakes attached to Protected memories are encrypted in your browser before upload. Files attached to Standard private or public content may be readable by the server so those features can work.
• Email services: We use email services to send account emails, reminders, and occasional Inpages notes.
• Google Analytics: It loads on public pages only. We do not send your email address, private journal content, or encrypted material to Google Analytics.

These companies have their own privacy policies. We recommend reviewing them to understand how they handle your information.

Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specifically:

• Account data: Retained until account deletion
• Memories: Retained until deleted by you or account deletion
• Sessions: Automatically deleted when expired or on logout
• Reminders: Automatically deleted after they are sent
• Shared memories: Retained until deleted by you or account deletion (but may be cached by search engines)
• Raw onboarding analytics: Retained for up to 90 days and deleted sooner when the linked account is deleted

International Data Transfers

Your data may be stored and processed in countries other than your country of residence. By using our service, you consent to the transfer of your data to these countries. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

Children's Privacy

Our service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately and we will delete the information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

Your continued use of the service after changes become effective constitutes acceptance of the updated Privacy Policy.

Contact Us

If you have any questions about this Privacy Policy, your data, or our privacy practices, email [email protected].