Privacy Policy
Ingrid is built local-first: if you don’t turn on Sync, your notes stay on your device and Tanji Systems does not receive them. This policy explains that boundary, ordinary service metadata, who processes it, and the control you have over it.
1Who we are
Ingrid is operated by Brian Merriman, an individual sole proprietor doing business as Tanji Systems, based in New York, United States, and is the data controller for the information described here. Contact: hi@tanji.systems.
2The short version
- No Sync → no note collection by us. Used locally, Ingrid stores your content on your device. It isn’t sent to Tanji Systems. As with any web app, the hosting service receives ordinary connection metadata when you load the public site.
- With Sync, we store your email (your account name) and the content you choose to sync, so it stays consistent across your devices.
- We never see your card details — payments are handled by Polar.
- We don’t sell your data, show ads, or run third-party tracking or advertising analytics.
- You can export your data or delete local grids in Ingrid at any time. To delete your account and synced data, email hi@tanji.systems.
3What we collect and why
| Data | Why |
|---|---|
| Email address | It’s your Sync account identifier and how we send your one-time sign-in codes and essential account or billing notices. |
| Content you sync (your grids, media and their structure) | Stored and transmitted so your work stays in step across your devices. Only what you actually sync; local-only content is never collected. |
| Billing records (customer and checkout references, subscription status and billing dates, cancellation and refund references) | Account-linked checkout, subscription, cancellation and refund records let us manage Sync access, handle billing changes and prevent duplicate purchases. |
| Connection and security metadata (such as IP address, time, route, status, and error category) | Netlify processes this to deliver and protect the billing endpoint. Our checkout limiter stores only a secret-keyed, opaque network identifier, not the raw IP address. Cleanup removes network keys older than one hour when billing requests or scheduled repair run. We don’t use this information to profile you. |
We do not collect payment card numbers, and we do not run advertising or third-party behavioural analytics in Ingrid.
4Where your data lives
On your device. Ingrid keeps your content in your browser’s local storage (IndexedDB). Local-only data stays there until you delete it or clear your browser data.
Synced data is stored by Dexie Cloud, our sync provider, which runs on Microsoft Azure infrastructure. Depending on region, this may be processed in the United States or other countries (see International transfers below).
5Who else processes it (subprocessors)
We keep third parties to the minimum needed to run Ingrid:
| Provider | Role | Data |
|---|---|---|
| Polar (merchant of record) | Sells the subscription, processes payments, handles tax | Your billing details and card data — handled entirely by Polar; we receive account-linked billing references, status and dates as described above. See Polar’s privacy policy. |
| Dexie Cloud | Cloud storage and synchronization for Sync | Your email and the content you sync. See Dexie Cloud. |
| Netlify | Runs the billing service, PostgreSQL database, abuse controls and operational logs | Your authorization request, account identifier, billing records, connection metadata and an opaque network key. See Netlify’s privacy policy. |
| GitHub | Hosts the public website and web app through GitHub Pages | Ordinary connection metadata when you load the site, including your IP address. Your locally stored grids are not uploaded to GitHub Pages. See GitHub’s privacy statement. |
| Cloudflare (retired billing archive) | Holds the legacy D1 billing database retained during retirement | Earlier account-linked billing records may remain in this archive. Cloudflare no longer runs Ingrid’s billing endpoint. See Cloudflare’s privacy policy. |
6Payments
When you subscribe, Polar acts as the merchant of record and processes the transaction. Your card information goes directly to Polar and its payment processors; we never receive or store it. We receive the account-linked billing records described above so we can manage Sync access and billing changes. Your purchase is also subject to Polar’s terms and privacy policy.
7Security
We take reasonable steps to protect your information. Traffic between your device and the sync service is encrypted in transit (HTTPS/TLS), and access to your synced data is tied to your authenticated account — sign-in is by a one-time code sent to your email, so keeping that email secure is what keeps your data secure. We limit third parties to the minimum described above. No online service can promise perfect security, but we work to keep your data safe and will act promptly on any issue we become aware of. Data stored locally on your device is protected by your device and browser — a device passcode and an up-to-date browser help keep it private.
8How long we keep it
Local data stays on your device until you remove it — we have no hand in it. One exception worth knowing if you use Sync: signing out removes the local synced copy from that device (your data stays in your account and returns when you sign back in — Ingrid syncs and offers an export first). A lapsed or cancelled subscription does not do this; only an explicit sign-out does.
Synced data is retained while your account exists so Sync can work. If your subscription lapses, Sync stops but your data is not immediately erased — this lets you resubscribe or sign back in and retrieve it. When you ask us to delete your account, we delete the active Dexie Cloud user, synced content, email, and Ingrid entitlement rows.
Billing and security data follows service-specific schedules. Cleanup removes network keys older than one hour when billing requests or scheduled repair run; scheduled repair normally runs every six hours. Netlify retains service logs and database backups under its provider and plan retention policies. Some deployment backups are kept by deployment count rather than a fixed number of days. See Netlify function logs and database backup retention. Earlier billing records may also remain in the retired Cloudflare D1 database and our retained exports until removed. Account-deletion requests include those records. Polar may retain transaction records for tax, fraud, chargeback and accounting obligations. We otherwise keep billing identifiers only while needed to operate the account or meet those obligations.
9Your rights and choices
Wherever you live, you can:
- Access & export — export your data from within Ingrid at any time.
- Correct — edit your content directly; contact us to correct account details.
- Delete — delete local grids in Ingrid at any time; email us to delete your account and synced data (see below).
- Withdraw — stop using Sync at any time; local-first use requires no account at all.
Depending on your location (for example the EU/UK under the GDPR, or California under the CCPA/CPRA), you may also have rights to object to or restrict certain processing, to data portability, and to lodge a complaint with your local data-protection authority. We don’t sell personal information or use it for targeted advertising. To exercise any right, email hi@tanji.systems; we’ll respond within the time your law requires.
10Deleting your data
You can delete local grids in Ingrid at any time. To delete your account and synced data, email hi@tanji.systems from your account address. We’ll verify the request, remove the active Dexie Cloud account and synced content, remove the account-linked records from Ingrid’s current billing database and any retained legacy billing archive or exports, and confirm completion. Provider-controlled logs and backups may retain earlier data under their retention policies; Polar keeps only records it is required or permitted to retain as merchant of record. Before requesting deletion, export a separate copy of the grids you want to keep. Signing out removes the local synced copy from that device.
11Cookies & local storage
Ingrid doesn’t use advertising or tracking cookies. It uses your browser’s local storage (IndexedDB and similar) to hold your content and remember your preferences and sign-in session — this is essential to how a local-first app works, not a tracking mechanism.
12Children
Ingrid isn’t directed to children, and Sync isn’t intended for anyone under 13 (or the minimum age in your country). Before sending a sign-in code from the email form, we ask for age in years and block submissions from anyone under 13. The entered age is checked on your device; it is not sent to us or saved. If access is declined, the tab remembers only that decision until its session ends. This screen is not identity verification or parental consent. If you believe a child has given us personal data, contact us and we’ll delete it.
13International transfers
We’re based in the United States and our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for such transfers. By using Sync, you understand your data may be processed outside your home country.
14Changes to this policy
We may update this policy as Ingrid changes. We’ll revise the date above and, for material changes, provide notice where appropriate. Continued use after an update means you accept it.
15Contact
Questions, requests, or concerns about privacy? Email hi@tanji.systems.