Privacy Policy

Who we are

Slow Ink is operated by Wallabout, LLC (doing business as Wallabout Studios), a Delaware limited liability company, of Brooklyn, New York. Wallabout, LLC is the data controller for the personal information described here.

This policy covers the app at app.slow.ink and this site at slow.ink. It sits alongside our Terms of Service.

What we hold about you

Your account

• Your email address — how you sign in, and the only address we send anything to.
• A display name, an optional avatar photo, and an optional line about yourself, all of which your groups see.
• A hashed password. We never see the password itself.
• How you like to read — typeface, size, page and line spacing — and, per group, when new writing should be delivered to you and whether that group may notify you by email.

What you write down

• Posts, comments and notes — the writing itself, and any pictures you attach to it.
• Which groups you belong to, and, if you have invited somebody, the invitation itself.
• Read state — when you last opened a post, and whether you have kept it to your commonplace book. This is private to you; see section 4.

Technical

• Server logs, which include IP addresses, timestamps and the requests made. These are also what our rate limits are counted against.
• Nothing else. There is no analytics, no advertising, no tracking pixel and no third-party script — on the site or in the app. The site’s content-security policy forbids scripts outright.

Why we hold it, and on what basis

We do not profile you, make automated decisions with legal effects about you, or use anything here for advertising.

Who can read what you write

A post, comment or note is readable by the current members of the group you wrote it to, once it has been delivered to each of them on the schedule they chose — and by nobody else. That is enforced as a clause in the database query itself, not as a filter applied afterwards: every read your account makes is scoped to what has actually been delivered to you, plus your own writing. Leaving a group ends your access to what is delivered there from that point on, though your own writing stays reachable to you through /my-content.

We do not connect your groups to each other, and one group cannot see another’s writing or membership.

Whether you have read something, and whether you have kept it, are private to you. No query anywhere in the app lets one member see another’s read state, and there is no count, badge or ranking built on it — adding one would put back exactly the pressure the app’s pacing rules exist to remove.

Reports and moderation

If a piece of writing is reported, that report — and that one piece of writing, and nothing else in the reported account — becomes visible to whoever at Wallabout, LLC handles it, so they can decide whether to remove it or suspend the account that posted it. That is the only door into a member’s writing that a report opens; it does not open the rest of what they have written or the rest of their group. We do not screen content automatically today — every review follows a report a member made.

Who else touches it

We use a small number of companies to run the service. They may handle your data only to do the job listed, and may not use it for anything of their own.

We also disclose information if the law genuinely requires it, and would tell you unless we were forbidden to. If the business is ever sold or merged, your data may transfer with it, under this policy until you are told otherwise.

A small number of people at Wallabout, LLC can reach the database to operate and repair the service. We look at account contents only when it is necessary to fix something, when a report requires it (see section 5), or when you have asked us to.

Cookies, sessions and what sits on your device

Slow Ink sets no cookies. Not for sessions, not for preferences, not for analytics. That is why you have never been asked to accept any: there is nothing to consent to. This site ships no JavaScript at all.

Three things are kept in your browser’s local storage, on your device only:

• Your session token, which is what keeps you signed in. Logging out removes it.
• How you like to read — typeface, size, ground and line spacing — so a device you have already set keeps its own answer rather than being overwritten from your account.
• An unsent copy of what you are writing, kept only until the server confirms a save, so a closed tab or a save that failed does not cost you the words. It is cleared the moment a save lands.

None of this is readable by us, and none of it is sent anywhere.

Email we send

Verifying your address, resetting a password, an invitation into a group, and — if you have opted in, per group, on /settings/delivery — a digest naming what landed in a group at most once a day. The digest names titles, authors and counts; it never quotes what was written. There is no other marketing or newsletter email.

We would also write to you about a material change to this policy or the terms, or about something that affected your account.

How long we keep it

• While your account is open, we keep what it holds, so the app can show it to you and your groups.
• Closing your account always removes your name, photo, bio, reading preferences and sign-in identity — nothing about who you were stays attached to anything. For your published writing you choose: leave it in the groups you sent it to, under a blank “former member” byline instead of your name, or have it erased along with everything else. There is no default; we ask. Unpublished drafts, which nobody but you had read, are always deleted outright.
• Removing something inside the app is a real deletion, not an archive — your own post, comment or note is gone from the database, not merely hidden, once you delete it.
• Backups of the database are kept for a limited window for recovery, so deleted data can survive there briefly before ageing out.
• Server logs are short-lived and kept only for operating the service.

Your rights, and how to use them

Wherever you live, you can ask us to do all of the following, and we will do it: tell you what we hold, give you a copy in a portable format, correct it, delete it, or stop a particular use of it. Depending on where you live you may also have the right to object to processing, to restrict it, and to complain to your data-protection authority.

Export and deletion are both built into the product. /my-content can send you a ZIP of everything you have written — as files, plus an export.json and your original pictures — any time, with no request needed. /settings/leaving closes your account. For anything else, write to hello@wallabout.studio from the address on your account; we will reply within 30 days, at no charge.

Where it is held

Everything is stored and processed in the United States. If you are in the UK, the EU or elsewhere, using Slow Ink means your data is transferred there. Where those transfers need a legal mechanism, we rely on the European Commission’s standard contractual clauses, or the equivalent UK addendum, in our agreements with the companies listed in section 6.

Security

Everything travels over HTTPS. Passwords are stored hashed. Every read and write in the app is scoped to the account that made it and, for a group’s writing, to whether it has actually been delivered to that account. The endpoints that can be brute-forced or made to send mail are rate limited.

No system is perfectly secure, and this one is a beta. If you find a problem, write to hello@wallabout.studio; we would rather hear it from you than not. If a breach ever put your data at risk, we would tell you and the relevant authority within the time the law requires, and tell you what to do about it.

Children

Slow Ink is for people aged 16 or over. We do not knowingly collect information from anybody younger, and we will delete an account we learn belongs to one. If you believe a child has an account, write to hello@wallabout.studio.

Changes to this policy

If we change it in a way that materially affects you, we will email the address on your account before it takes effect. The date at the top of this page always says when it was last changed.

Contact

Wallabout, LLC, Brooklyn, New York, United States.
hello@wallabout.studio

A real person reads that address. Access requests, deletion requests, exports and questions about this policy all go there.