Privacy policy · RoutineInk

This policy explains what information RoutineInk processes, why it is needed, who helps us process it, and the choices available to you.

1. Who is responsible

The controller of personal information described in this policy is Panda Learning Labs LLC, which provides RoutineInk through routineink.com, its apps and extensions. Questions and privacy requests may be sent to contact@routineink.com.

2. Information we process

Information processed, purpose and retention
Category	Purpose	Typical retention
Account information	Email address, password hash when you use password sign-in, Google or Apple account identifier and optional name when you use social sign-in, timezone and account preferences used to authenticate and operate your account. RoutineInk does not request or store your Google profile photo. Apple may provide a private relay address when you choose Hide My Email.	Until account deletion, unless a limited record must be kept for security, fraud prevention or legal compliance.
Kindle and delivery information	Kindle addresses, labels, RoutineInk sending addresses, delivery status and Amazon refusal notices used to deliver and troubleshoot files.	Addresses until removed; delivery records follow your plan's retention period.
Sources, schedules and preferences	Feeds, newsletter rules, schedules and formatting choices used to build the reading you request.	Until you remove them or delete the account.
Reading content	Page text, images, feed items, forwarded newsletters and generated files used to preview, build, deliver, re-send, download and—on eligible plans—search or translate content.	Generated content follows your plan's retention period. Raw forwarded email is removed after processing and no later than 24 hours.
Uploaded documents	PDF, EPUB, Word, Markdown, HTML or text documents you deliberately select for conversion, delivery and retained download.	The processing copy is removed after processing; any library copy follows your plan's retention period.
Billing information	Stripe, App Store and Google Play subscription identifiers, purchase history and status, an opaque in-app purchase account token, and limited billing lifecycle events used to manage access, trials, invoices, refunds and payment status. RevenueCat processes App Store and Google Play purchase status for us. We do not receive full card numbers or store-account passwords.	Billing event records are normally kept for 90 days. Opaque purchase and provider identifiers may be retained after account deletion on an ongoing basis when needed to prevent repeated trials or fraud, handle delayed store events, refunds or disputes, and meet accounting or legal obligations. They are detached from the deleted profile and reading content.
Technical and security information	IP address, browser, extension or mobile-app version, device and operating-system type, request timestamps, error details, security events, and limited subscription-SDK diagnostics used to operate, protect and debug the service. RevenueCat may receive the opaque purchase account token, app and device information, and store transaction status needed to verify purchases.	Only as long as needed for security and operations, generally no more than 90 days unless an incident requires longer retention.
Marketing-site analytics	Public-page usage collected only after you choose “Allow analytics.” Marketing analytics never runs in the dashboard, browser extension or mobile app. RevenueCat separately provides operational subscription reporting as described above.	According to the configured analytics retention settings and your browser controls.

3. Mobile app and share extension

The mobile app and its operating-system share extension process only the URL, text or file you deliberately select in RoutineInk, a document picker or a share sheet. A selected file may come from device storage, iCloud Drive or another storage provider you choose. RoutineInk does not browse unrelated files, monitor other apps or read your general browsing history. Selected content is sent to RoutineInk only to perform the preview, conversion, schedule or delivery action you request.

The app keeps a limited on-device cache of account details, library metadata, recent delivery status, Sources, schedules and subscription status so it can open calmly and recover from a temporary network interruption. The share extension also keeps a protected sign-in credential and a local list of available schedules so it can send without opening the main app. Temporary share-extension file copies are removed after the share finishes. App caches and the shared schedule list are cleared when you sign out or delete the account; the subscription SDK may retain its own purchase cache under RevenueCat's platform rules.

If you turn on the optional app lock, iOS uses Face ID or Touch ID to unlock RoutineInk. Biometric matching is performed by the operating system; RoutineInk does not receive, store or transmit your face, fingerprint or biometric template.

4. Browser extension

The extension uses temporary access to the active tab. It reads and submits the page URL, title and article content only after you choose Preview, Send now or Add to schedule. RoutineInk therefore handles web browsing activity for that one user-facing action, but it does not continuously monitor tabs or query, build or store a history of other pages you visit. It does not run advertising analytics. Connection credentials are stored in the browser's extension storage so the extension can access your RoutineInk account.

Chrome Web Store Limited Use

Information received through browser extension APIs is used only to provide and improve the extension's single purpose: processing the page you select and delivering it through your RoutineInk account. We transfer that information only when necessary to provide or secure that feature, comply with law, or complete a business transfer after obtaining any required prior consent. We do not use or transfer it for personalised advertising, retargeting, creditworthiness or lending. We do not permit people to read it except with your specific consent for support, when necessary for security or legal compliance, or after it has been aggregated and anonymised for internal operations. RoutineInk's use of information received from Chrome extension APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

5. Why we process information

We process information for the following purposes and legal bases, where those concepts apply:

Contract — to create your account and provide previews, conversion, schedules, delivery, billing and support.
Legitimate interests — to secure the service, prevent abuse, diagnose failures and improve reliability without overriding your rights.
Consent — for optional public-site analytics, optional product announcements, and the disclosure accepted before AI translation sends selected article text to Cloudflare's AI service. Consent may be withdrawn at any time; turning AI translation off stops future article text from being sent for translation.
Legal obligations — to maintain records or respond to valid legal requests where required.

We do not use reading content to train shared AI models, build advertising profiles, or make decisions that have legal or similarly significant effects on you.

6. Content retention

Plus — retained for 90 days, unless you delete it sooner
Pro — retained until you delete it or delete the account
Lapsed account — retained files remain available for up to 7 days.

When content expires, its body, images, generated files, search data and related delivery records are removed from active systems. Residual copies may remain temporarily in protected backups or provider logs until their normal rotation completes.

7. Service providers and disclosures

We disclose information only as needed to operate the service:

Cloudflare — hosting, storage, caching, security, inbound mail routing and requested AI translation processing.
Neon — managed database hosting.
Resend — account email and document delivery.
Stripe — checkout, subscriptions, invoices and payment processing.
Apple — optional Sign in with Apple and App Store purchase processing.
Google — optional account sign-in using your verified email and Google account identifier, and Google Play purchase processing.
RevenueCat — verification and lifecycle processing for App Store and Google Play purchases using an opaque RoutineInk account token.
Amazon — documents submitted to the Kindle destination you provide are processed under Amazon's terms and privacy practices.
Google Analytics — optional public-site analytics, loaded only after consent.

When a provider processes personal information on our behalf, we use applicable service agreements, data processing terms and platform rules that require safeguards consistent with this policy and applicable law and limit the provider's use to providing the requested service. We remain responsible for selecting and instructing those providers consistently with this policy. We do not authorise them to use reading content for their own advertising. Apple, Google and Amazon may also act independently under their own terms and privacy policies when you direct content or a purchase to their services.

We may also disclose information when reasonably necessary to comply with law, protect users or the service, investigate fraud or security incidents, or complete a merger, financing, acquisition or sale. In a business transfer, this policy continues to apply until you are notified of a change.

We do not sell personal information, share it for cross-context behavioural advertising, or disclose reading content to data brokers. Because we do not engage in those activities, there is no separate sale or sharing opt-out to exercise.

8. International processing

RoutineInk and its providers may process information in the United States and other countries where they operate. Where required, international transfers rely on recognised safeguards such as adequacy decisions or contractual protections.

9. Cookies and analytics

The dashboard uses secure session cookies to keep you signed in. These cookies are marked HttpOnly, Secure and SameSite=Lax.

The public site stores your analytics choice in the browser. Google Analytics loads only after you allow it, and can be disabled later through Analytics settings in the footer. Google signals and ad personalisation are disabled. We do not respond differently to browser Do Not Track signals because no advertising profile is created; recognised consent choices continue to apply.

10. Your choices and rights

Depending on where you live, you may have rights to know, access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, or appeal a denied request. You may also have the right to complain to your local privacy or data-protection authority. RoutineInk will not discriminate against you for exercising a privacy right.

Update email, password, timezone and preferences in Settings.
Delete individual content, sources and Kindle destinations from the dashboard.
Export retained content before closing the account.
Turn AI translation off in Settings to stop future article text from being sent to the translation provider.
Delete the account from Settings or contact contact@routineink.com.

We may need to verify a request before acting on it. An authorised agent may submit a request where local law permits, subject to verification of the agent's authority.

11. Account deletion

Account content is removed from active systems within 30 days after deletion, subject to protected backup rotation and records that must be retained for security, fraud prevention, billing disputes or legal compliance. We retain a one-way marker of introductory-trial use and limited identifiers for retired payment-provider objects on an ongoing basis so repeated trials can be prevented and delayed billing events cannot attach to a later account. Those records are detached from the deleted profile and reading content and are not used for marketing. Apple, Google, Stripe and RevenueCat may retain transaction records under their own legal, fraud, accounting and platform obligations; deleting a RoutineInk account does not delete the user's separate store account or cancel a store subscription.

12. Security

We use administrative, technical and organisational safeguards designed to protect personal information, including transport encryption, platform storage encryption, access controls, salted password hashing, and SPF, DKIM and DMARC for sending domains. No internet service can guarantee absolute security. Please use a unique password and contact us promptly if you believe your account has been compromised.

13. Age requirement and children

RoutineInk is intended only for people who are at least 16 years old. It is not directed to children under 16, and we do not knowingly collect personal information from anyone below that age. If you believe a child under 16 has provided personal information, contact us and we will review and delete it as required.

14. Changes to this policy

We may update this policy as the service or law changes. The current version and effective date will remain on this page. We will provide additional notice before a material change takes effect when required by law.

15. Contact

Privacy questions and requests: contact@routineink.com.