Effective date: 31 August 2026

This Privacy Policy explains how Inklay GmbH ("Inklay", "we", "us", or "our") processes personal data when you use the Inklay mobile app, an Inklay device, our cloud services, or an integration made available through the app (together, the "Service"). The app is available for iOS and Android and is intended for adults aged 18 or older.

1. Controller and Contact Details

The controller responsible for the processing described in this Privacy Policy is:

Inklay GmbH
Steinackerstrasse 1
5210 Windisch
Switzerland
Email: info@inklay.app

2. Data We Process

Account and authentication data

To use the Service, you create an account. We process your first and last name, email address, Firebase user ID, email-verification status, and authentication information. We use your name to identify your account and communicate with you when you request support. Authentication is provided by Firebase Authentication. Firebase processes your password for authentication; we do not have access to your password in readable form.

Device pairing and configuration data

The app uses Bluetooth Low Energy (BLE) to discover and pair with a nearby Inklay device and to send setup information to it. On Android, the operating system may require location permission for Bluetooth discovery. We do not use that permission to collect, store, or transmit your GPS or precise location.

During pairing, the app sends the selected Wi-Fi network name (SSID), Wi-Fi password, and device authentication credentials to the Inklay device. The Wi-Fi password is transmitted only to the device and is never sent to our backend. Credentials stored on the device are protected using device-level encryption. Our backend stores only the information necessary to authenticate authorised device requests and applies appropriate technical security measures.

Device information, telemetry, and logs

To operate, maintain, and support your Inklay device, we process data associated with its unique device ID, including:

Current device telemetry is overwritten as new telemetry is received. We retain a rolling history of the latest 100 device updates and aggregate monthly and lifetime update counters while the device remains active. This device data is associated with your account through the device ID.

Gallery images and image or website URLs

If you choose images from your photo library for the Gallery app, the selected images are uploaded to Firebase Storage. They are protected by authentication and access controls, are accessible only through the authenticated account, and are used to generate content for the linked Inklay device. The app accesses only images you choose through the operating system's image picker.

For the Local Image app, we store only the URL you provide for an online or locally hosted image. We do not receive or store the image itself. The linked Inklay device retrieves the image directly from the specified URL and displays it.

If you configure the Website app, we store the publicly accessible URL you provide. Our backend retrieves content from that public URL to generate and periodically refresh the image displayed on your Inklay. Do not submit private, access-controlled, or credential-bearing URLs.

Weather-location data

For weather features, you manually search for and select a location. We store the selected city, region, country, latitude, and longitude with the device configuration and send the coordinates to OpenWeather to retrieve forecast data. This location is selected by you and is not obtained from your phone's GPS.

Optional third-party integrations

You may choose to connect an optional third-party service. Depending on the integration, we process and store OAuth access and refresh tokens, API credentials, external account or system identifiers, and the configuration required to retrieve and render your selected information. We retrieve only the information needed to provide the feature you configure.

Connecting these services is optional. When you disconnect an integration, we delete its credentials and configuration stored in our systems. The third-party provider processes data under its own privacy policy.

Push-notification data

If you allow notifications, we process a Firebase Cloud Messaging token associated with your account or device. We use it only to notify you that an Inklay device is offline. We do not use push notifications for advertising.

Technical and operational logs

When the app, device, or backend communicates with our Service, Firebase and Google Cloud may process technical information such as IP address, device and operating-system information, request time, user ID, device ID, request ID, service response, and error details. We use these logs for security, abuse prevention, troubleshooting, and reliable operation. We do not use Firebase Analytics in the mobile app.

Communications

If you contact us by email, we process your email address, message, and any information you choose to send. The app does not contain a feedback form and does not automatically attach diagnostics to your email.

We may send essential service emails concerning outages, security, required account or device actions, material service changes, or important firmware and safety information. We may separately offer optional product news or feature-update emails. We send optional emails only if you consent, and you can withdraw that consent in the app at any time. Withdrawing marketing consent does not affect essential service communications.

3. Why We Process Data

We process personal data for the following purposes and legal bases:

4. Service Providers and Data Recipients

We disclose data only as needed to operate the Service, including to:

We do not sell or rent personal data. We do not use personal data for third-party advertising or behavioural profiling.

5. International Data Transfers

Inklay GmbH is based in Switzerland. We primarily operate our backend services in the European Union. Some service providers, including Google/Firebase, Apple, and providers you choose to connect, may process personal data in the United States or other countries. For example, Firebase Authentication processes account data in the United States.

When personal data is processed outside Switzerland or the EU/EEA, we use service providers and contractual protections intended to ensure an appropriate level of data protection in accordance with applicable law. You may contact us for more information.

6. Retention and Deletion

We retain account, device, configuration, integration, and uploaded-image data for as long as the relevant account, device, or integration remains active. When you remove an integration, we delete its credentials and configuration from our systems. When you remove a device, we delete the associated device data and uploaded images. When you delete your account, we delete the account and associated user and device data.

Operational server logs are normally retained for up to 30 days. Certain administrative audit logs may be retained by Google Cloud for longer periods under its mandatory service settings or where retention is required by law. Email correspondence may be retained for as long as reasonably necessary to answer your request and document the communication.

7. Security

We use technical and organisational measures designed to protect personal data. Traffic between the app and backend is encrypted in transit. Firebase encrypts stored data at rest and access is restricted through authentication, database rules, and administrative access controls. Device credentials are stored in an encrypted device partition, and the backend verifies a peppered hash of the device secret using a constant-time comparison.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security.

8. Your Rights

Subject to applicable Swiss and EU/EEA data-protection law, you may have the right to request access to your personal data, receive a copy, correct inaccurate data, request deletion, restrict or object to processing, and receive certain data in a portable format. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing.

You can delete your account in the app or submit a deletion request at www.inklay.app/account-deletion.html. For other privacy requests, contact info@inklay.app. We may need to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if the EU/EEA GDPR applies to you, with the data-protection authority in the country where you live or work or where you believe an infringement occurred.

9. Adults Only

The Service is intended only for adults aged 18 or older. We do not knowingly offer the Service to or collect personal data from children. If you believe a child has provided us with personal data, contact us so we can investigate and delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, our providers, or applicable law. We will publish the updated policy and revise the effective date. If a change materially affects how we process personal data, we will provide an appropriate notice through the app, by email, or through the Service.

11. Contact Us

Questions or privacy requests can be sent to info@inklay.app.