Privacy policy

Last updated 30 October 2026

1. Who is responsible

Inky Clips (inkyclips.com) is run by SIA Blinkovio, registration number 40203302386, VAT number LV40203302386, Atmodas iela 6-8, Aizpute, Latvia (“we”, “us”). We are the controller of the personal data described here under the EU General Data Protection Regulation (GDPR). You can reach us at support@blinkovio.com.

2. What stays on your device

Inky Clips is built so that your media never reaches our servers:

• Videos and projects are saved in your browser’s own storage (IndexedDB and the Origin Private File System) on your computer. We cannot see, access or recover them.
• Auto-captions are made by a speech-recognition model (Whisper) that runs inside your browser. The audio of your video is processed on your device and is not sent anywhere.
• Exports are encoded in your browser and saved straight to your computer.

Because this data never leaves your device, we do not process it, and clearing your browser’s site data for inkyclips.com deletes it permanently. Keep your own copies of anything you care about.

3. What we collect

When you sign in with Google

Signing in is optional for browsing the site and required to use the editor. When you sign in, we store:

• Account: your name, email address, whether Google has verified that email, the address of your Google profile picture, your Google account ID, and when your account was created and updated.
• Sign-in tokens from Google: the tokens Google issues when you sign in (for the basic “openid, email, profile” permissions only). We don’t use them to access anything else in your Google account.
• Sessions: for each device you’re signed in on, a random session token, its expiry time, the IP address and the browser’s user-agent string (browser and operating system) at sign-in.

We never receive your Google password.

When you buy a plan

You pay on Stripe’s checkout page. Your card details go to Stripe, never to us. Stripe tells us, and we store:

• Billing: your Stripe customer ID, which plan you have, its status, when it renews or ends, and whether a payment failed. Stripe keeps your name, email, billing address, country, payment method and invoices, and we can see them in our Stripe account.
• Exports: how many videos you have exported and how many of them carried the watermark. Not what they contain.

When you visit the site

Like any website, our server receives your IP address and browser details with every request, because that is how the internet delivers pages. We don’t keep access logs of the pages you visit. To protect sign-in from abuse, the server briefly counts requests per IP address in memory (for seconds, not stored). Technical error logs may occasionally contain an IP address.

Page-view statistics

We count visits with Umami, an open-source statistics tool that runs on our own server, so the data doesn’t go to any third party. It sets no cookies and stores no IP addresses. For each page view it records the page, the referring site, the browser, operating system, device type, screen size, language and the country (looked up from your IP address, which is then discarded), plus a visitor identifier derived from your IP address and browser with a secret that changes regularly, so visits can be counted without recognising you over time. We use it only in aggregate, to see which pages are useful.

We don’t use advertising, fingerprinting or third-party tracking of any kind.

4. Why, and on what legal basis

Providing your account and the editor

Name, email, profile picture, Google account ID, tokens and session token. Legal basis: performance of our agreement with you (GDPR Art. 6(1)(b)), the terms of use.

Keeping accounts secure

Session IP address and user agent, request counting, error logs. They let us spot sessions that don’t look like yours and stop automated abuse. Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f)).

Selling and managing plans

Billing details and export counts. Legal basis: performance of our agreement with you (Art. 6(1)(b)). Records of what Stripe pays us are also kept because accounting and tax law requires it (Art. 6(1)(c)).

Page-view statistics

To understand which pages people use and improve the site. Legal basis: our legitimate interest (Art. 6(1)(f)); the data can’t be used to identify you, and no cookies or similar storage are used on your device.

Answering you

If you email us, we use your message and address to reply. Legal basis: legitimate interest (Art. 6(1)(f)), or a legal obligation where you exercise a GDPR right (Art. 6(1)(c)).

We don’t use your data for marketing, profiling or automated decisions, and we don’t sell or rent it to anyone. If we ever want to email you about the product, we’ll ask first.

5. How long we keep it

• Account data: for as long as you have an account. When you ask us to delete it, we delete your account, sessions and Google tokens within 30 days. Encrypted database backups roll over and are gone within a further 7 days.
• Sessions: a session expires 30 days after you last used it, or immediately when you sign out. Expired session records are deleted within 90 days.
• Billing: subscription records for as long as you have an account. Records of payments for as long as Latvian accounting and tax law requires, even after you delete your account. Stripe keeps its own records of your purchase under its privacy policy.
• Page-view statistics: up to 2 years.
• Emails to us: as long as needed to deal with your request, and no longer than 2 years.
• Error logs: no longer than 30 days.

6. Who else is involved

Processors working for us

• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) hosts our server, database and DNS in the Frankfurt, Germany (eu-central-1) region. The database and disks are encrypted. AWS processes data only on our instructions under its data processing addendum.

Payments

• Stripe sells the plans as merchant of record, under its Link brand (Stripe’s Managed Payments): it takes the payment, handles tax, issues invoices and runs the page where you manage your subscription. For the purchase, Stripe is an independent controller of the data you give it, under its own privacy policy; it tells us what we need to run your plan (see “When you buy a plan”). See Stripe’s privacy policy.

Services your browser contacts directly

These are independent companies. They are not our processors, and their own privacy policies apply.

• Google (Google Ireland Ltd.) handles sign-in. When you choose “Sign in with Google”, you log in on Google’s page, and Google tells us who you are. Your profile picture is loaded from Google’s servers. See Google’s privacy policy.
• Hugging Face (Hugging Face, Inc., USA) hosts the speech model. The first time you use auto-captions, your browser downloads the model files (about 1.1–1.6 GB) from Hugging Face’s servers and its content delivery network, which therefore see your IP address and browser details. After that the model is cached in your browser. No audio or text is sent to them. See Hugging Face’s privacy policy.
• jsDelivr serves the speech engine’s runtime files (about 27 MB) to your browser together with the model, so it also sees your IP address and browser details. See jsDelivr’s privacy policy.

Our HTTPS certificates come from Let’s Encrypt. They never receive any of your data, and they aren’t a processor.

7. Transfers outside the EU

We store your data in the EU (Frankfurt). AWS, Google and Stripe are part of US groups, so US access cannot be fully ruled out; all three are certified under the EU–US Data Privacy Framework and use the European Commission’s Standard Contractual Clauses. Downloads from Hugging Face and jsDelivr may be served from outside the EU, depending on where their networks route your request.

8. Cookies and browser storage

We use only what the service needs to work, so no cookie banner is needed:

• Session cookie (set when you sign in): keeps you signed in for up to 30 days. Strictly necessary.
• Short-lived sign-in cookies: protect the Google sign-in flow from forgery and disappear when it finishes. Strictly necessary.
• Browser storage (IndexedDB, Origin Private File System, Cache Storage and local storage): holds your projects, videos, thumbnails, the downloaded speech model, and small preferences such as your last caption language. This stays on your device and is never sent to us.

Our page-view statistics use no cookies or browser storage. Stripe’s checkout and subscription pages, on Stripe’s own domain, set cookies of their own that Stripe needs for payments and fraud prevention. No advertising or third-party tracking cookies.

9. Your rights

Under the GDPR you can ask us to:

• give you a copy of your personal data (access and portability);
• correct it if it’s wrong (your name and picture come from Google, so changing them there also works);
• delete your account and all personal data we hold about you;
• restrict how we use it, or object to processing based on legitimate interests.

To do any of this, email support@blinkovio.com from the address you sign in with, so we can tell it’s you. We reply within one month. It’s free. You can also remove Inky Clips’ access from your Google account settings at any time; that stops new sign-ins but doesn’t delete what we already hold, so email us too.

Your videos and projects aren’t covered by a deletion request because we don’t have them. Delete them inside the editor or by clearing site data for inkyclips.com in your browser.

If you think we’ve handled your data wrongly, please tell us first. You also have the right to complain to a data protection authority, in the EU country where you live or work, or to ours: the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv).

10. Children

Inky Clips is not meant for children under 16. If you are younger than the age at which you can consent to online services yourself in your country, you need a parent’s or guardian’s permission. If you believe a child has given us personal data without that permission, contact us and we’ll delete it.

11. Security

Everything travels over HTTPS. The database is not reachable from the internet, is encrypted at rest, and its password is rotated automatically. Access to the servers is limited to the operator. No system is perfectly secure; if a breach ever puts your data at risk, we’ll tell you and the authorities as the GDPR requires.

12. Changes

If we change how we handle your data, we’ll update this page and the date at the top. For significant changes, such as collecting new kinds of data, we’ll tell signed-in users in the app before they take effect.

13. Contact

SIA Blinkovio
Registration number 40203302386
VAT number LV40203302386
Atmodas iela 6-8, Aizpute, Latvia
support@blinkovio.com