Privacy

What happens to my writing?

Short answer: in the prototype, your writing stays on the tablet unless remote processing is switched on. Then each reply sends a picture of the page to an outside AI provider. Our own device isn’t decided yet. On this website, nothing you could write is collected, because there is nowhere to write.

On the device · the prototype today

From your page to a reply

The software runs today as a prototype on a reMarkable Paper Pro, and what follows describes that prototype. The Enchanted Ink device is still being designed and may work differently. The device and this website are separate systems: buying or reserving never connects your journal to a shop account.

In the prototype, the tablet itself sends a picture of the page, the book’s instructions and relevant earlier conversation to an AI provider (OpenAI or OpenRouter), and only once remote processing has been switched on; it’s off by default. That provider’s own retention and training rules apply. How our own device will handle this hasn’t been decided.

Your page
You write with the stylus. In a plain notebook the flow stops here: nothing is read or sent. In a book, your strokes stay on the page, except in the Riddle.
Where it runs: On the tablet
A picture of the page
Once the pen has rested, and only if remote processing has been switched on (it’s off by default), the tablet draws the page into a temporary image. That file is deleted as soon as the request is prepared.
Where it runs: On the tablet
The AI provider
The picture, the book’s instructions and relevant earlier conversation from that book go to OpenAI or OpenRouter. The model reads the handwriting and writes a reply. The picture is sent once more, with the reply, to get a written transcript for the book’s memory. The provider’s own retention and training rules apply.
Where it runs: Outside AI provider (cloud)
Reply and memory
The reply is written beneath your words as pen strokes. The transcript of your entry and the reply are stored, encrypted, in that book’s memory on the tablet.
Where it runs: On the tablet

How the prototype software works today on a reMarkable Paper Pro. Enchanted Ink’s own device may work differently. We’ll publish its flow, and name every outside provider, before anything is sold.

Known limits of the prototype

It uses the tablet owner’s own AI account. That API key is stored in plain text on the tablet, readable by anyone with full (root) access.
Memory is encrypted, but its key is kept beside the database on the same tablet. That protects against casual copying of the files, not against someone with full access to the device.
The adult books have no content moderation, and there is no crisis detection.
The parent PIN is a convenience lock, not protection against someone with full access to the tablet.

Still to be decided for our own device, and published here before any sale

How replies are processed: a bundled device can’t rely on each owner’s own API key.
The name of every outside service that would process your writing, and its retention terms.
How long any copy of a page is kept for processing, and how deletion reaches it.
Whether and how pages sync or back up between devices.
What support staff could ever see. Our intent: never your journal content.

Memory · prototype and planned

What it remembers

Each book remembers what’s written in it, encrypted on the tablet, so a reply can pick up the thread weeks later.Working today

In the prototype, each book has its own database on the tablet (and each child profile its own). The text of your entries, the replies, running summaries and the Journal’s ink are encrypted field by field. Dates and page numbers are not. A reply draws on recent exchanges and a few older ones that share words with what you just wrote. Nothing in memory is sent anywhere unless remote processing is on, and then only the parts relevant to that reply.

Planned: choosing which pages a book may remember, reviewing what it has kept, and seeing which earlier page a reply drew on. The prototype can’t do these yet.In development

Planned: removing a page from memory so that it, and anything derived from it, is never used again. Backup and provider retention will be explained separately once they are known.In development

We treat saved pages, summaries, any search indexes and provider logs as different kinds of data, and will explain each one separately. A reply should never quote a page it didn’t actually retrieve.

On this website · current

What this site collects today

Pages load fonts and scripts from this site only. There are no advertising pixels or third-party trackers.

The animated exchanges on this site are scripted. Their handwriting and replies are written in advance, and no AI runs when you press play. The exceptions are the labeled recordings of the prototype.

Analytics

This site counts a short list of events, such as which example you played, without cookies, session recordings, or any text you see in the demos. It sends nothing when your browser signals Global Privacy Control.

The complete list of events, and nothing else:

page_view — which page was opened (the path only, never the query string)
demo_started — which scripted example was played (its identifier, not its text)
demo_completed — that a scripted example finished
transcript_opened — that a transcript was opened
privacy_opened — that this page was opened
reservation_checkout_started — that someone started a reservation checkout (only when reservations are open)
preorder_checkout_started — that someone started a preorder checkout (only when preorders are open)
waitlist_confirmed — that an address was confirmed (recorded by the server, without the address)
reservation_confirmed — that a reservation payment was verified (server-side)
refund_requested — that a refund was requested (server-side)
refund_completed — that a refund completed (server-side)
purchase — that a device order was verified (server-side; not in use)

Each event may carry only a page path, an example identifier, the site’s launch state, an experiment name, or a coarse performance class. The server discards anything else. There are no cookies for analytics, no fingerprinting, no session recording and no advertising audiences.

Ordinary server logs may record technical details such as your IP address for security and rate limiting. Error logs are written without request bodies or email addresses.

Preorder list

If you join the preorder list

Joining the waitlist stores your email address, the choices you ticked, and the version of the wording you agreed to. It does not reserve a device or charge you anything.

We store your email address, whether you ticked each box, the date, the site’s launch state at the time, and the version of the wording you agreed to (currently notify-preorders-2026-10-01, and news-2026-09-30 if you opted into occasional notes).
We send one email asking you to confirm. You’re not on the list until you do.
Unconfirmed sign-ups are deleted after 48 hours.
Joining means we’ll email you when preorders open; occasional notes are optional and separate.
Your place in line comes from when you confirmed, moved up 25 places for each friend who joined through your link and confirmed (up to 20). We store your referral code and, if you came through a friend’s link, their code. Positions and referral counts are private: only you see yours, through a link we email you.
To stop people referring their own aliases, we also store a simplified form of your address (without “+tags”, and without dots for Gmail). It’s used only for that check.
If you arrive through a friend’s link, the site sets one cookie, ei_ref, holding their code for 30 days so the referral still counts if you join later. It holds nothing about you and is cleared when you confirm.
Every email after confirmation includes a link to leave the list.
Your address is never combined with anything you might later write in a journal.

Preorders

If you preorder

Payment, your name, address and order details are handled by Shopify checkout under Shopify’s own privacy terms.
This site keeps a small record of each order line: the Shopify order and line IDs, quantity, batch, the terms version you saw, and the First Edition numbers assigned to it. It holds no names, addresses, card details or journal content.
When we invite you to a batch, we record that we did and your place in line at the time. An invitation link sets one cookie, ei_invite, that holds the invitation until a week after that batch opens to everyone.

Reservations · not open

If reservations open

Payment would be handled on Shopify’s hosted checkout; this site never sees or stores card details. For each reservation we would keep: a reservation identifier, the order and line-item reference, your Founding Writer number, status and its history, the amount and currency, the offer and terms version, your consent choices, timestamps, and the state of any launch benefit — and an optional display name for your certificate.

No journal content is ever part of a reservation, receipt, certificate or support record. Marketing consent stays separate from your receipt.

Claims we don’t make yet

Words we’re holding back, and why

Claim	Why we don’t make it yet
“Private”	In the prototype, every reply sends a picture of your page to an outside AI provider. We won’t use the word without explaining who can access what, where, and under which controls.
“Never used for training”	That’s set by the AI provider and the account used, not by us, and the prototype can’t promise it.
“End-to-end encrypted”	A provider has to read the page to reply, so it isn’t. Memory on the tablet is encrypted, which is a different thing.
“Works offline”	Writing works offline in the prototype; replies don’t.
“Delete your memory”	The prototype can only delete a whole child profile. Removing a page and everything derived from it isn’t built or tested yet.
“No subscription required”	Included features and ongoing service costs haven’t been decided.

Children

Enchanted Ink is being designed for adults. This site does not knowingly collect information from children, and the demos do not ask anyone to write anything. The prototype includes a Tutor book with child profiles, a parent PIN and stricter, age-based moderation of replies; it keeps each child’s memory separately and can delete a child’s profile. The Tutor book, child profiles and a parent PIN exist in the prototype. They won’t be offered until there’s a verified parental-consent process and an independent safety review.

Contact

Privacy requests, including access and deletion: [email protected]
Security issues: [email protected] (see security.txt)
Everything else: Support

No social-media account is needed to reach us.