Privacy Policy
Effective date: September 21, 2026. Last updated: September 21, 2026.
This Privacy Policy explains how Inkyo.app collects, uses, discloses and protects personal information. It applies to the website at inkyo.app, the Inkyo.app retirement planning application, and the related services we provide (together, the "Service").
The Service is owned and operated from the United States under the name Inkyo.app. In this Privacy Policy, "Inkyo.app," "we," "us" and "our" refer to the operator of the Service. You can reach us at privacy@inkyo.app.
Please read this Privacy Policy before you use the Service. If you do not agree with it, do not use the Service.
Summary of key points
This summary is provided for convenience. The sections that follow it govern.
- We collect the information you give us to build your retirement plan, the account balances you choose to link, and the limited technical information needed to operate and secure the Service.
- We do not sell personal information. We do not share it for advertising. The Service carries no advertising and no advertising or analytics trackers.
- We do not receive or store the username or password for your bank or brokerage. Account linking gives us read access to balances. We cannot move money.
- If you sign in with Google, we store your email address and use it to create and secure your account. We do not access Gmail, Drive, Calendar or Contacts.
- The AI assistant is optional and requires your consent. We do not use your information to train artificial intelligence models.
- You may ask us to access, correct or delete your personal information by writing to privacy@inkyo.app.
| Reason we might disclose your personal information | Do we? |
|---|---|
| To operate the Service through the providers listed in Section 7 | Yes |
| To comply with law or protect rights and safety | Yes, where required or permitted by law |
| To sell it, or to let others market to you | No |
| For advertising, including cross-context behavioral advertising | No |
| To data brokers or information resellers | No |
| To assess creditworthiness, insurance eligibility or employment | No |
1. Information we collect
1.1 Information you provide
- Account information. Your email address. We do not set, receive or store a password. Sign-in is handled by our authentication provider (see Section 7).
- Household information. For you and, if you add one, your spouse or partner: name, date of birth, gender, a self-assessed health rating (excellent, good or poor), planned retirement age, life expectancy assumption, state of residence and ZIP code. We use the health rating, gender and date of birth as inputs to longevity and cost projections and for no other purpose.
- Financial planning information. Accounts and balances you enter, income and expenses, debts, housing and mortgage details, contribution and growth assumptions, scenarios, and estate planning details such as beneficiary names, relationships and allocations. It also includes notes you choose to write.
- Communications. Messages you send us, and feedback you give inside the Service.
If you use a planning calculator on our website before creating an account, the calculation runs in your browser. If you choose to carry your figures into a new account, we receive your age, savings and monthly spending, hold them in encrypted form for up to fifteen minutes, and then apply them to your new account or discard them.
1.2 Information from sign-in providers
If you sign in with Google or another identity provider, that provider sends identifying information to our authentication provider, which passes your verified email address to us. Section 3 describes Google user data in detail.
1.3 Information from linked financial accounts
If you choose to link an account, we receive from the linking provider the institution name, the account name, the account type, the last four digits of the account number and the current balance. We do not receive transaction history, investment holdings, full account numbers or routing numbers. See Section 4.
1.4 Billing information
Our payment processor collects your payment card details on pages it hosts. We do not receive or store your full card number or security code. We store your subscription status, invoice records, and the brand, last four digits and expiration date of your card. We also retain the event records our payment processor sends us, which can include your email address and billing details.
1.5 AI assistant information
If you use the AI assistant, we store your conversations, the record of your consent, facts you ask the assistant to remember, your ratings of its answers, and usage measurements such as message counts, processing time and cost. See Section 5.
1.6 Information collected automatically
- Session and device information. We set the cookies described in Section 8 and keep a record of your active sessions. Our application does not store your IP address. Our hosting, font and monitoring providers process your IP address and browser information in the course of delivering the Service to you.
- Diagnostic information. When the Service encounters an error, our error monitoring provider receives a technical error report and, for errors in the browser, a recording of the affected session. The recording tool is configured to mask all on-screen text and form entries and to block images, and it does not capture the contents of network requests. We also sample a portion of requests to measure performance.
We do not use third-party analytics, advertising networks, tracking pixels or social media plug-ins.
2. How we use information
We use personal information to:
- create, authenticate and secure your account;
- build and update your retirement plan, including forecasts, scenarios, alerts and reports;
- retrieve and refresh the balances of accounts you link;
- provide the AI assistant, if you consent to it;
- process subscriptions and payments;
- send you service messages, including security notices, alerts you have enabled, reports you have scheduled and billing notices;
- respond to your requests and provide support;
- detect, investigate and prevent fraud, abuse and security incidents;
- diagnose errors and maintain the performance of the Service; and
- comply with law and enforce our terms.
We do not currently send marketing email. We do not use personal information for advertising. We do not use it to make decisions about your eligibility for credit, insurance, housing or employment.
3. Google user data
You may choose to sign in with your Google account. This section describes how the Service accesses, uses, stores and shares Google user data.
- Access. Sign-in requests only Google's basic sign-in permissions for your email address and basic profile. We do not request access to, and cannot read, Gmail, Google Drive, Google Calendar, Google Contacts or any other Google service.
- Data received. Google sends our authentication provider, WorkOS, your email address, whether Google has verified it, your name, your profile picture address and an identifier for your Google account. WorkOS passes your verified email address to us.
- Storage. We store your email address. We do not store your Google profile name or picture, and we do not receive or store Google access tokens or refresh tokens. WorkOS retains the sign-in record it needs to authenticate you.
- Use. We use Google user data only to create your account, sign you in, secure your account and send you service messages.
- Sharing. We disclose Google user data only to WorkOS and the other service providers in Section 7 that host or deliver the Service, and as Section 7.2 describes. We do not sell Google user data. We do not transfer it to advertising platforms, data brokers or information resellers. We do not use it for advertising, to determine creditworthiness or for lending, or to train artificial intelligence models.
- Revocation and deletion. You may revoke the Service's access to your Google account at myaccount.google.com/connections. Revocation stops future sign-ins through Google. It does not delete your Inkyo.app account. To delete your account, follow Section 11.
Inkyo.app's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Linked financial accounts
Linking an account is optional. You may enter balances by hand instead.
We link accounts through Stripe Financial Connections. Some accounts linked earlier may be connected through Plaid. When you link an account, you enter your credentials in a window operated by the linking provider or by your financial institution. We do not receive, see or store those credentials.
You direct us and the linking provider to retrieve the information in Section 1.3 from your financial institution. Through Stripe Financial Connections we request permission to read balances only. We use this information for personal finance management: to build your retirement plan and keep it current. Our access is read-only. The Service cannot initiate payments, transfers or trades.
We do not sell information from linked accounts. We do not create anonymized or aggregated data sets from it.
You may unlink an account at any time in the Service. When you do, we ask the linking provider to revoke our access, and we delete the linked account and its balances from your plan.
The linking providers also process your information under their own privacy policies: the Stripe Privacy Policy and the Plaid End User Privacy Policy.
5. The AI assistant
The Service includes an optional AI assistant. We ask for your consent before your first use. You may withdraw consent at any time in Settings. Withdrawal stops further use until you consent again. It does not delete past conversations, which you may delete yourself.
- What the model receives. To answer you, we send the model your messages and relevant information from your plan. That can include account names and balances, income and expenses, ages, scenario results and facts you asked the assistant to remember. We remove email addresses, phone numbers, the last four digits of account numbers and linking-provider identifiers from the plan summary we supply to the model.
- Where it runs. The assistant runs on Cloudflare Workers AI through Cloudflare AI Gateway. Cloudflare states that it does not use customer content to train the models available on Workers AI or to improve its services without consent. Cloudflare's gateway service may retain logs of requests, which can include the content of prompts and responses.
- Web search. When the assistant looks up public information, it writes a short, general search question and sends only that question to Google Cloud. We do not send your identity, your plan or your conversation. Google states that it does not use this content to train its models and that it stores search prompts and results for up to thirty days.
- No training. We do not use your personal information to train artificial intelligence models.
- Human assistance. If you ask the assistant for help from a person, the Service emails our support mailbox a short summary and the relevant excerpt of your conversation so that we can respond.
- Changes to your plan. The assistant may propose changes to your plan. It does not apply them unless you approve them.
The assistant can make mistakes. Review its output before you rely on it. See Section 15.
6. No sale of personal information
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We have not done either in the preceding twelve months. These statements use the terms "sell" and "share" as the California Consumer Privacy Act defines them, and they apply to every user regardless of state of residence.
7. How we disclose information
7.1 Service providers
We disclose personal information to the following providers so that they can perform services for us. We do not authorize them to use it for their own marketing.
| Provider | Function | Information involved |
|---|---|---|
| Cloudflare | Hosting, network delivery, file storage, email delivery, report generation and AI model hosting | All information processed by the Service, in transit or at rest |
| PlanetScale | Database hosting | The contents of your account and plan |
| WorkOS | Sign-in and authentication | Email address, sign-in credentials and identity provider profile |
| Optional sign-in, web fonts in the application, and AI web search | Sign-in information (Section 3), IP address and browser information, and general search questions (Section 5) | |
| Stripe | Payments and account linking | Email address, internal account identifiers, payment details you give Stripe and linked account information |
| Plaid | Account linking for some earlier connections | Linked account information |
| Sentry | Error and performance monitoring | Diagnostic information described in Section 1.6 |
We will update this list when our providers change.
7.2 Other disclosures
- Legal process and protection. We may disclose personal information where we believe in good faith that disclosure is necessary to comply with a law, regulation, subpoena, court order or other legal process; to enforce our terms; or to protect the rights, property or safety of Inkyo.app, our users or others.
- Business transfers. If Inkyo.app is involved in a merger, acquisition, financing, reorganization, sale of assets or wind-down, we may transfer personal information as part of that transaction. We will require the recipient to honor this Privacy Policy or to give you notice and a choice before it uses your personal information differently.
- At your direction. We disclose personal information where you ask us to, for example when you schedule a report to be emailed to an address you specify.
8. Cookies and tracking signals
We set only cookies that the Service needs in order to function.
| Cookie | Purpose | Duration |
|---|---|---|
| harbor_session | Keeps you signed in | 24 hours, extended while you are active, and no more than 7 days of inactivity |
| harbor_oauth_state_*, harbor_workos_sid | Protect the sign-in process and allow a complete sign-out | 10 minutes, and the length of your session |
| harbor_plan_check_* | Carry calculator figures into a new account at your request | 15 minutes |
The application also keeps interface preferences and unsent message drafts in your browser's local storage. Stripe may set its own cookies on pages where you link an account or make a payment, in order to prevent fraud. Your browser settings let you block or delete cookies. If you block ours, you will not be able to sign in.
Do Not Track and Global Privacy Control. We do not track you across third-party websites or over time, and we do not permit third parties to collect information on the Service for that purpose. Because we do not engage in that activity, the Service responds the same way whether or not your browser sends a Do Not Track or Global Privacy Control signal.
9. Retention
We retain personal information for as long as your account is open and as described below.
| Information | Retention |
|---|---|
| Account, household and financial planning information | Until you delete it or we delete your account |
| Linked account information | Until you unlink the account or we delete your account |
| AI conversations and remembered facts | Until you delete them. We erase the content of a conversation when you delete it and purge the remaining record within about 30 days. |
| Generated report files | 7 days |
| Sessions | 24 hours, extended with activity, up to 7 days of inactivity |
| Cached forecast results | 1 hour |
| Calculator figures carried into sign-up | 15 minutes |
| Billing, invoice and payment event records | As long as needed for tax, accounting, dispute and legal purposes |
| Notifications, AI usage measurements and security records | Until we delete your account, unless law requires a longer period |
After deletion, residual copies may remain in our providers' backups and logs for a limited period before they expire. We may retain information where law requires it or where we need it to resolve a dispute, enforce our terms or prevent fraud.
10. Security
We maintain safeguards designed to protect personal information. They include:
- encryption in transit using TLS;
- AES-256-GCM encryption of the access tokens that linking providers issue to us, before we store them;
- session cookies that scripts cannot read, that browsers send only over encrypted connections and that are restricted to our site, with only a keyed hash of each session token stored on our servers;
- authorization checks that limit each request to the signed-in user's own data;
- verification of the cryptographic signatures on messages from Stripe and Plaid; and
- signed, expiring links for report downloads, which also require an active session.
No method of transmission or storage is completely secure, and we cannot guarantee the security of your information. You are responsible for securing the email or Google account you use to sign in. If we learn of a security incident that affects your personal information, we will notify you and the appropriate authorities as applicable law requires.
11. Your choices and rights
We extend the rights in this section to every user in the United States, regardless of state of residence.
- Access and portability. You may request a copy of the personal information we hold about you. Depending on your subscription, you may also generate reports and exports inside the Service.
- Correction. You may correct most information inside the Service. You may ask us to correct the rest, including your email address.
- Deletion. You may delete financial accounts, scenarios and AI conversations inside the Service, and you may ask the assistant to forget a remembered fact. To delete your entire account, write to us. The Service does not yet offer a self-service account deletion control.
- Consent. You may withdraw AI consent, unlink financial accounts and change email notification preferences in Settings.
- Sale, sharing and sensitive information. We do not sell or share personal information, and we use sensitive personal information only to provide the Service, so there is nothing to opt out of.
- No retaliation. We will not deny you the Service, charge a different price or provide a different level of quality because you exercised a right.
How to make a request. Write to privacy@inkyo.app from the email address on your account. We verify requests by confirming control of that address and may ask for additional information where the request is sensitive. An agent may submit a request for you with your signed authorization, and we may confirm the request with you directly. We will confirm receipt within 10 business days and respond within 45 days. Where reasonably necessary, we may extend that period once by 45 days and will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive.
Appeals. If we decline a request, you may appeal by replying to our decision. We will respond to an appeal within 60 days. If we deny the appeal, you may contact your state attorney general.
12. Children
The Service is intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information, contact us and we will delete it.
13. United States only
The Service is designed for retirement planning under United States tax and benefit rules. We offer it only to residents of the United States. We do not offer it to, or direct it at, individuals in the European Economic Area, the United Kingdom or Switzerland, and you should not use it if you reside there. We and our providers process information in the United States and in other locations where our providers operate.
14. Additional state notices
California. The categories of personal information we collect, as California law names them, are: identifiers; personal information described in California Civil Code section 1798.80(e), including financial information; characteristics of protected classifications, namely age and gender; commercial information; internet or other electronic network activity information; inferences we generate as part of your plan; and sensitive personal information, consisting of the health rating you provide. We collect them from you, from the providers you connect and from your browser, for the purposes in Section 2, and disclose them to the providers in Section 7. We do not disclose personal information to third parties for their direct marketing purposes. We do not have actual knowledge that we sell or share the personal information of consumers under 16.
Nevada. We do not sell covered information as Nevada law defines that term.
Accessibility. You may print this page from your browser. To receive this Privacy Policy in another format, write to us.
15. No professional advice
The Service is a planning tool. Its projections, and the output of the AI assistant, are for informational and educational purposes. They are not investment, tax, legal or accounting advice, and no fiduciary or advisory relationship arises from your use of the Service. Consult a qualified professional before you make financial decisions.
16. Changes to this Privacy Policy
We may amend this Privacy Policy. We will post the amended version on this page and revise the date at the top. If an amendment materially changes how we use or disclose personal information we have already collected, we will notify you by email or through the Service before it takes effect. We will not apply a material change to Google user data without notifying you first. The change log below records each revision.
17. Contact
For questions, requests or complaints about this Privacy Policy or our privacy practices, write to privacy@inkyo.app. We aim to reply within five business days.
Change log
- September 21, 2026: first version.