Inkwell — PDF Reader & Scanner

Privacy Policy

Effective date: 21 August 2026 · Version 3.0

This policy explains what the Inkwell Android app does with your information. It describes the app as it is actually built. If we change what the app collects, we change this policy in the same release.

1. Who we are

Inkwell is published by:

For the purposes of the UK GDPR and the EU GDPR, TACTIX ADS LP is the controller of the limited analytics data described in section 4 and of the advertising described in section 5. We have not appointed a Data Protection Officer, because we are not required to. Write to the address or email above for anything covered by this policy.

2. The short version

3. What stays on your device

Everything in this section is stored only in the app's private storage on your phone, or in files you choose to save. None of it is transmitted to us or to anyone else.

A few specifics worth stating plainly:

Text recognition (OCR) runs on your device. Inkwell uses the bundled ML Kit text recognition model, which ships inside the app. It does not upload page images to a server, it does not need an internet connection, and it works on a device with no Google Play services installed at all. We tested exactly that on a bare Android image with Google services removed.

Document scanning runs on your device. The camera preview, the page corners you position by hand, perspective correction and image processing are all local. Captured photos are written to the app's own cache folder and are used to build the PDF you save. They are never uploaded.

Your signature stays on your device. It is stored in the app's private storage, and it is only ever drawn into the PDF you are signing.

The app has no backup to the cloud. Android's automatic app-data backup is switched off for Inkwell, so your saved signature, reading position and Ink balance are not copied to your Google Drive.

When you use Copy, Share or Print, you are handing that content to another app or service that you chose. What happens to it after that is governed by that app's or service's own privacy policy, not this one.

4. What is collected and sent off your device

Two components in the app send anything over the network, and there are only two. Google Analytics for Firebase, which is what the rest of this section is about, and the Google Mobile Ads SDK, which requests the ads described in section 5. Nothing else in the app makes a network request at all.

The statistics are switched off when you install the app — the published build ships with collection disabled, so nothing is sent before the app has worked out whether it may.

What happens next depends on where you are:

• In the UK and the EEA we ask, and the question is about the statistics only. A dialog appears on first launch. Nothing is collected while it is on screen. Choose Allow and the statistics start; decline and nothing is sent. Closing the dialog without answering is not treated as a yes. Declining costs you nothing: every feature works exactly the same either way. It says nothing about the ads, and it does nothing to them — in version 2 one answer governed both, and since version 3 it governs the statistics alone. The ads in those countries are governed by Google's certified consent form instead, which is described in section 5 and is a separate question with a separate record.
• Everywhere else, no dialog is shown. The statistics start when you first open the app, on the legitimate-interests basis set out in section 6, and so do the ads — personalized, on the same basis.

Either way, you can change the statistics whenever you like. The app's Settings screen — the gear icon in the top bar of both the Library and the Tools screen — has a switch for exactly this, and it works in every country. It covers the statistics and only the statistics: it does not turn the ads off anywhere, and the wording underneath it says so rather than letting the switch imply otherwise. Where Google's consent form is offered, the same screen carries a separate Manage ad privacy entry that reopens it. Section 11 has the steps.

The region rule covers the UK and the 30 countries of the EEA, and also the Crown Dependencies, Gibraltar, and the EU territories that carry their own country code — 42 in all. The app works out where you are from your SIM's country and the country of the mobile network you are connected to, falling back to your device's region setting when there is no SIM at all. It does not use your location and never asks for the location permission; deciding whether to ask for consent is not worth a location prompt. That method is rough, and it is built to err towards asking: a device it cannot place is asked rather than assumed.

Your own answer always outranks that rule, in both directions and permanently. If you decline in Berlin and later move somewhere we would not have had to ask, you stay declined; if you allow, you stay allowed until you say otherwise.

4.1 What Firebase collects

• A pseudonymous app instance identifier generated by Firebase for your installation. It is the only identifier on the copy of this data we hold ourselves (section 9). The app never shows it to you, and clearing the app's data or uninstalling replaces it with a new one.
• Your device's advertising ID. The permission that reaches it is in the app from this release, and Firebase Analytics reads it when it is there — see section 7 for what that reverses, and section 5 for what it is for. What we tell the analytics about your ad consent is coarse: where Google's form says ads may be requested, we mark advertising storage, advertising user data and ad personalization all as allowed, and where it says they may not, all three as refused. There is no finer record on our side, and none is needed — the purpose-by-purpose answers you gave in the form are the authoritative ones, they are kept in the record described in section 3, and Google's ad SDK reads them from there directly.
• Device and app information: device model, operating system version, app version, device language and Android's own country/region setting.
• Approximate location, worked out by Google from your IP address. This is coarse — typically country, and sometimes region or city. We do not receive or store your IP address, and we do not receive precise or GPS location. The app does not request any location permission.
• How you came to install the app, via the Google Play install referrer.
• Usage events: which parts of the app you used and when. Firebase also records its own standard events, including first open and session start.

The usage events we send are limited to the following, and they are all we send:

• opening the app, opening and closing a document, completing a tool such as merge, split, watermark or OCR;
• events from the in-app rewards system — Ink earned and spent, chests opened, streak changes, reading-meter progress, opening the Rewards screen;
• whether a reward or upgrade prompt was shown, taken or declined;
• whether a daily reminder notification was sent, and whether you granted notification permission;
• which variant of a feature experiment you were shown, including which of the two advertising groups in section 5 your installation is in;
• every ad shown to you, with what that impression was worth: an amount and its currency, how exact Google says that amount is, which of the placements in section 5 it filled, and which ad unit it came from. There is no other advertising network's name to record, because there is no other network — see section 8.

Alongside these, we send small numeric or short text values such as an amount of Ink, a streak length, or the name of a feature. The only long-lived flag we set is the advertising group one described above; there is no paid-upgrade flag, because there is nothing to buy yet and the code that would set one is never reached.

An ad request is separate, and it does not go to Firebase. When the app asks for an ad, that request goes from your device to Google's advertising servers, and it is the one thing here we cannot itemise for you: what the ad SDK puts in it is Google's, not ours, and Google describes it at the link in section 8. What we can tell you is the part we are answerable for. It carries your advertising ID, which is new in this release and is the thing that makes a personalized ad possible (sections 5 and 7). It carries your IP address, because that is how any request over the internet finds its way back to you, and Google works your approximate location out from it, the same way it does for the statistics above. In the UK and the EEA it also carries the record of what you allowed in the consent form, so that Google serves within it. Beyond that identifier we add nothing of our own — no profile we built, no interests, nothing about which documents you have opened.

4.2 What is deliberately not collected

One item left this list in version 3. Until version 2 the list began "No advertising ID — even though the app now shows ads", and called it the strongest claim in this document. It is not a claim we can make any more. Section 7 says what changed and why.

4.3 Why

To understand whether people can find and use the app's features, to see which features are worth improving, to find the places where people get stuck, to measure whether the app is growing, and to know what the advertising earns. Aggregate counts, not individual profiles: we do not attempt to identify anyone, and we hold no information that would let us do so.

The app contains no crash-reporting tool, so we do not receive stack traces, logs or any other diagnostic data from your device.

5. Advertising

Inkwell is free, and the ads are what pay for it. This section is where they are, where they are not, and what decides which ones you get.

They come from Google. The app contains Google's Mobile Ads SDK (AdMob), which is the second of the two components in section 4 that reach the network — and the only one you can see.

No ad is ever placed on the page you are reading. The document view carries no placement of its own — no banner, no strip, nothing over the page, nothing when you turn one. The two banner strips are on the Library and the Tools screen and nowhere else. That is deliberate: reading is the thing you installed the app for.

One case does come between you and a document, and it belongs here rather than in a footnote: leave the app running with a document open, then make a plain return to the foreground — the home button, then back — and the full-screen ad in the first row above is shown on the way back in. That is the return being interrupted rather than the reading, and it is the only time an ad appears over a document.

One further placement is built and switched off: a full-screen ad after a tool finishes, at the end of a merge, a split or an OCR run. It exists in the code and it is disabled in this release. If we turn it on, this policy will say so in the release that does it.

The ads may be personalized. This changed in version 3 of this policy, and it changed against you. Until version 2 every ad was non-personalized, for everyone, in every country. That is no longer true. The app now reads your device's advertising ID and sends it to Google with the ad request, and Google may use it to choose an ad that fits a profile built from it. Section 7 says what we withdrew in order to do that. The rest of this section says what governs it.

What personalization means here. Your advertising ID is a stable identifier your phone gives to apps that ask for it. It follows you from app to app, and it is what an advertising profile is built on — the apps you use, the ads you have been shown, and what you did after them. A personalized ad is one chosen out of that profile. A non-personalized ad is chosen from the country the request came from and the app it will appear in, and from nothing else. The profile is Google's; we do not build one, hold one, or see one.

Who serves them. Google. The ad request goes to Google's advertising business, which runs the auction and decides what to serve. Google is the only ad tech provider involved. We run AdMob directly, with no mediation, so the request is never passed to another advertising network to fill, and no other network receives your advertising ID from us.

What governs it, and where.

• In the UK and the EEA, your answer governs it — and governs whether there are ads at all. Before any ad is requested, the app shows you a consent form that Google built and Google certifies, running on the IAB Transparency and Consent Framework. It asks whether Google may use your data for personalized advertising and for the related purposes the framework names, and it records what you say. It is fail-closed: until it has been answered, the app asks for no ad at all, so a fresh install shows you none. Our own dialog plays no part in this — since version 3 it asks about the statistics only, and it has no effect on advertising in any country (section 4).
• Everywhere else there is no form, and the ads are personalized by default. The lawful basis for that is in section 6, and the control that works there is in section 11.

If you decline. You still see ads — they are what pays for the app — but they are non-personalized, or limited to whichever of the framework's purposes you did allow. Nothing else changes: every feature works exactly the same either way.

You can change your answer. Where the law requires that form to be reopenable, the app's Settings screen carries a Manage ad privacy entry that reopens it, and your new answers replace the old ones. Where the form is not shown, that entry is not shown either, because a menu item that opened nothing would be worse than no menu item. Section 11 has the route that works in every country, including the one that is not ours to give or withhold.

A paid upgrade would remove them. The app already contains the switch that turns off every placement above for a paid user. There is nothing to buy yet — see section 4.2.

6. Lawful basis for processing

Under the UK GDPR and the EU GDPR we rely on the following:

The two analytics rows are the same processing under two different bases, and so are the two advertising rows. Which one applies to you is not a choice we make about you after the fact. The app decides it at launch, from the country signals in section 4, and an answer you have given always beats that decision — so a user who turns the switch off is off everywhere, and a user who said yes is on the consent basis even in a country where we could have relied on legitimate interests instead. We would rather hold the stronger of the two than the more convenient one.

One thing about the advertising rows is worth spelling out rather than leaving to be worked out. The legitimate-interests row for advertising applies only outside the countries in section 4 — which is to say, only where we were not required to ask. Inside them, the ads run on your consent or they do not run, and they are personalized on your consent or they are not personalized.

7. Permissions the app asks for

Android also lists one permission that Inkwell defines for itself, which no other app can hold. It exists so an internal message inside the app cannot be read from outside it, and it gives the app access to nothing about you.

Inkwell deliberately does not request All Files Access (MANAGE_EXTERNAL_STORAGE). It reads only the documents it created itself and the folders you explicitly grant it through Android's own folder picker.

Two components in the app ask for advertising permissions of their own. Firebase Analytics asks for three; the Google Mobile Ads SDK asks for those same three and a fourth. One of the four is now in the app. The other three are still removed when the app is built:

• AD_ID — the Google Play services door to your device's advertising ID. It is a stable identifier that follows you between apps, and it is what an advertising profile is built on. This is the one that is back, and it is what makes the personalization in section 5 possible.
• ACCESS_ADSERVICES_AD_ID — the Privacy Sandbox door to that same identifier. Still removed. One open door is all the personalization needs, so the second one stays shut, along with the rest of the sandbox module below.
• ACCESS_ADSERVICES_ATTRIBUTION — for crediting ad campaigns. Still removed.
• ACCESS_ADSERVICES_TOPICS — Android's interest-inference system, which infers coarse interest categories from the apps on your phone and offers them to advertisers. Still removed.

The check that reads the finished app file still runs, and it still refuses the release unless the permission list is exactly what this section says it is — eleven permissions expected, these three forbidden. Any of the three reappearing would fail it, just as the one we let back in disappearing would. If you want to see the list rather than take our word for it, Google Play shows every permission an app declares, under About this app → App permissions → See more.

8. Third parties and international transfers

The only third party that receives any data from the app is Google. It receives it in two different capacities, and the difference is worth stating rather than blurring.

• Google Analytics for Firebase, for the statistics in section 4. Firebase's privacy and security information: firebase.google.com/support/privacy. Google's privacy policy: policies.google.com/privacy.
• Google Mobile Ads (AdMob), for the advertising in section 5. How Google uses information from apps that use its services: policies.google.com/technologies/partner-sites.

For the analytics, Google acts as our processor, under Google's Firebase Data Processing and Security Terms: it holds that data on our instructions and for our purposes.

For the advertising, "processor" is not an honest description and we are not going to use it. An ad request goes to Google's own advertising business, which decides what to serve and uses what it receives — including your advertising ID — for its own purposes as well as ours: running the auction, choosing a personalized ad where section 5 allows one, measuring and reporting on the ads, and preventing fraud. For that part Google acts as a controller in its own right, not merely on our instructions.

Google is the only ad tech provider. We run AdMob directly and have configured no mediation, so the request is never handed to another advertising network to fill, and no other network receives your advertising ID from us. In the UK and the EEA the consent form in section 5 runs on the IAB Transparency and Consent Framework, and the vendor it asks you about is Google.

Google processes and stores this data on servers in the United States and in other countries where Google or its sub-processors operate. Where data is transferred out of the United Kingdom or the European Economic Area, the transfer relies on the safeguards built into Google's data processing terms, which incorporate the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

What we still do not do. We do not sell your data. We do not share it with data brokers. We do not pass it to anyone other than Google, and we do not give Google anything beyond the two purposes above. Two claims that stood in earlier versions of this policy no longer stand. Version 1 said we do not share data with advertising networks; that went when Google became one we send to. Version 2 replaced it with something narrower — that no advertising ID goes with the ad request — and version 3 has taken that too. Your advertising ID goes with it. What is left is smaller and still checkable: it goes to Google and to nobody else, and we build no profile of you ourselves.

9. How long data is kept

On your device: for as long as you keep the app installed, or until you clear the app's data. Uninstalling Inkwell removes everything the app stored on your phone — your signature, reading position, Ink balance, your answer to the statistics question, and the record of your answers in Google's consent form. Documents you saved yourself are your files and stay where you saved them; uninstalling does not delete them.

Analytics data: held by Google Analytics under the retention window we set in the Google Analytics console. The maximum Google offers for event-level data is 14 months, after which Google deletes it. Aggregated reports — counts and trends that no longer identify any device — are kept for as long as we run the app.

A copy we hold ourselves. Since 19 August 2026 the raw event rows are also exported once a day out of Google Analytics into BigQuery — still a Google service, but into a dataset under our own account, in the EU region. The export is configured to exclude advertising identifiers. In version 2 that setting had nothing to exclude; since version 3 it does, and the rows we hold still carry only the app instance ID. It runs on the free tier, where rows are deleted automatically 60 days after they arrive. The export arrived in version 2 of this policy, and it is the first copy of this data that we hold rather than only read in a dashboard. Section 10 says what that changes about your rights, and — more to the point — what it does not.

10. Your rights

If you are in the United Kingdom or the European Economic Area, you have the right to:

• access the personal data we hold about you;
• rectify it if it is inaccurate;
• erase it;
• restrict how we process it;
• object to processing we carry out on the basis of legitimate interests — which covers the analytics described in section 4, and the advertising described in section 5, for everyone we were not required to ask first (section 6);
• data portability — receive the data in a structured, commonly used, machine-readable format;
• withdraw consent at any time for anything you consented to — the statistics and the ads, if you were asked and agreed, the personalized advertising you allowed in the form described in section 5, and the notification and camera permissions — without affecting anything done before you withdrew it.

Objecting and withdrawing both take one tap, and both work. The law requires that withdrawing consent be as easy as giving it. Here it is easier: consent was given in a dialog, and it is withdrawn with a switch in Settings, one tap from either of the app's two main screens. That same switch is how an objection under legitimate interests takes effect, since the two amount to the same thing in practice — stop collecting. Collection stops immediately, the app remembers the answer across updates and restarts, and nothing turns it back on, including travelling to a country where we would not have had to ask you in the first place. That switch covers the statistics and only the statistics: it does not stop the ads in any country, and section 11 says so plainly rather than letting a switch imply otherwise. Withdrawing your ad consent is a separate action on a separate record — Manage ad privacy, on the same screen, reopens Google's form wherever that form exists.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

If you are in the EEA, you may complain to your national data protection authority. We would rather you contacted us first at tech@tactixadslp.com, but you are not required to.

11. How to opt out or delete your data

Turn the statistics off inside the app. This is the direct route, and it is the one to use. Open Settings — the gear icon in the top bar of either the Library or the Tools screen — and turn off the switch at the top. It is labelled Anonymous usage statistics, in every country. That is the whole procedure. It takes effect immediately, it is remembered across updates and restarts, and it holds wherever you are: an answer you have given always outranks the region rule in section 4. The same switch turns it back on if you change your mind.

What that switch does about the ads: nothing. Not in any country. In version 2 it stopped the ads as well in the countries where we had asked you first; since version 3 it does not, anywhere, because our question is no longer a question about the ads at all (section 4). The wording underneath it describes the statistics only, because a switch that claimed to stop ads it does not stop would be the worse dishonesty. The three routes below are the ones that reach the advertising. If you think the app has placed you in the wrong country — you live in the UK or the EEA and were never shown Google's form — write to us and say so: that is a fault in the country detection described in section 4, and it is worth fixing for everyone it affects and not only for you.

What the switch does not do anywhere is delete what was already collected. It stops the collection; it does not reach back into it. Section 10 explains why we cannot do that part for you.

The three ways to control the advertising. They are different levers, they reach different things, and only the last of them works everywhere.

1. Google's consent form, in the UK and the EEA. It is shown before any ad is requested, and it is where the advertising is allowed or refused, purpose by purpose. Until it is answered, no ad runs at all. Decline the personalization and you still see ads, but non-personalized ones, or ones limited to whatever you did allow.
2. Settings → Manage ad privacy, where it is offered. In the countries where the law requires that form to be reopenable, the app's Settings screen has an entry that reopens it, and your new answers replace the old ones. Everywhere else the entry is not shown, because there would be no form behind it.
3. Android's own advertising ID controls, in every country. Android Settings → Privacy → Ads (the exact path varies by manufacturer) lets you reset the advertising ID, which starts the profile again from nothing, or delete it altogether, after which apps that ask for it get nothing — Inkwell's ad requests then carry no identifier, and the ads you are shown are non-personalized. This one is not ours to give or withhold, it does not depend on where you live, and it is the strongest of the three.

Reset the app instance ID, and clear what is on your phone. Android Settings → Apps → Inkwell → Storage and cache → Clear storage (older versions call it Storage → Clear data; the exact path varies by manufacturer). This does two things at once: it deletes the app's local storage — signature, reading position, and Ink balance — without removing any of your documents, and it resets the app instance ID, so nothing collected from then on is joined to anything collected before. It is the closest thing to a reset switch the app has.

One caveat, because leaving it out would be dishonest: clearing the app's data also clears both of your answers — the one about the statistics and the one you gave Google's form — since both are stored on your phone like everything else. Outside the countries in section 4 that means the statistics start again under section 6's legitimate-interests basis the next time you open the app, and so do the ads. Inside them you are asked both questions again, and until you answer, nothing is collected and no ad is requested. So if you want the statistics off and to stay off, use the switch — and if you clear the data as well, set the switch again afterwards.

Uninstall. Removing the app stops all analytics collection and all advertising permanently, and deletes everything the app stored locally. Documents you saved yourself stay where you saved them.

Turn off notifications. Android Settings → Apps → Inkwell → Notifications, or turn off just the "Reminders" channel.

Ask us. Email tech@tactixadslp.com. Please read the honest note in section 10 first: we have no identifier you can quote at us, so on a request about your own analytics data the likely answer is that we cannot find it. We will still reply, within one month, as the UK GDPR requires — and we will tell you exactly what we could and could not do.

12. Children

Inkwell is not directed at children. It is a document tool intended for adults, our Google Play target-audience declaration is 18 and over, and the app is not part of Google Play's Teacher Approved or Designed for Families programmes.

We do not knowingly collect data from children. We have no way to determine a user's age, because the app has no account and asks for no personal details. If you believe a child has used the app and you want the associated analytics data deleted, email tech@tactixadslp.com — but the limit in section 10 applies here too, and we would rather say so now than promise something we cannot deliver: we have no way to pick one device's data out of the rest. Turning the statistics off in Settings stops any further collection at once, and clearing the app's data or uninstalling it (section 11) severs the link as well. That is the remedy that actually works.

13. Security

The practical protection here is architectural rather than procedural: your documents, your signature and your recognised text are never transmitted, so there is no copy of them for us to lose. Local data sits in the app's private storage, which Android isolates from other apps, and Android's automatic cloud backup is switched off for this app. Analytics data in transit is encrypted by the Firebase SDK, and once it reaches Google it is held under Google's own security terms. It carries no name, no email address and no account, and the copy we hold ourselves carries no advertising ID either (section 9) — there is simply not much in it to lose. The advertising ID that does leave your device goes to Google with the ad request, over the ad SDK's own encrypted connection.

No system is completely secure, and we make no guarantee beyond describing what the app actually does.

14. Changes to this policy

If we change what the app collects, we will update this policy and change the effective date at the top. The current version is always at the URL published on our Google Play listing.

Material changes — a new SDK that collects something new, advertising, in-app purchases — will be described here before or at the same time as the release that introduces them, not afterwards. Two of these versions are that:

• Version 2 — advertising arrived. It changed every section of this policy from 1 to 11, and section 7 corrected a prediction that version 1 got wrong.
• Version 3 — the advertising became personalized. The app now reads your device's advertising ID and sends it to Google, on your consent in the UK and the EEA and by default elsewhere; section 7 withdraws the promise version 2 made not to read it at all; and our own question stopped covering the ads, which are now governed by Google's certified consent form instead.

The version number at the top is a whole number on purpose. The app records which version of this policy was on screen when you answered our question, and compares it with the version the installed release carries — so there is no such thing as version 3.1. If you are in one of the countries in section 4 and you answered the version 2 question, what you answered was a question about the statistics and the ads together. Version 3's question is about the statistics alone, so your old answer is not an answer to it. The app asks you again, and collects nothing until you reply.

Google's consent form is not versioned by this policy. It is a separate record with its own lifecycle: Google's SDK decides when it must be shown or shown again, it is put to you before the first ad in the countries that require it, and clearing the app's data clears it along with everything else (section 11).

15. Contact

Inkwell — PDF Reader & Scanner. Copyright © 2026 TACTIX ADS LP. Last updated 21 August 2026.