What we collect, what we don’t.

We collect the minimum we need to make the kanji verification service work and to keep it from being abused, and we never sell it.

• Your search queries (the kanji you check or the English phrases you search). Stored so we can show you your own history if you provide an email, and to improve our database coverage.
• A hashed identifier of your IP and User-Agent (SHA-256 + daily salt). We do not store raw IP addresses. Used only for daily rate limits (10 free checks per day) and abuse detection.
• Your email — only if you choose to provide one. Used to email you results or to notify you when paid tiers go live. We do not send marketing email without explicit opt-in.
• Payment data (when you purchase a Tattoo Ready Pack or Expert Review). Handled entirely by Stripe — we never see your card number. We store the Stripe customer ID and the purchase metadata.

We use first-party cookies from our hosting platform (Vercel) for essential session functionality. We also use Vercel Web Analytics + Speed Insights for aggregate, anonymized usage metrics — these do not identify you personally and do not require a cookie banner under current EU guidance.

We do not use Google Analytics, Facebook Pixel, or any third-party advertising trackers.

The Matsuyama-based operator (one person — see the About page) and a small set of trusted infrastructure providers:

• Supabase (PostgreSQL + Storage) — hosts the database
• Vercel — hosts the website
• Upstash — rate limiting (stores only hashed identifiers)
• OpenAI — receives your kanji / search query for natural-language output (per their API data-retention policy, queries are not used to train models)
• Stripe — payment processing
• Resend — transactional email delivery
• Sentry — error monitoring (we strip personal data from error reports)

We do not sell, rent, or trade your data with anyone outside this list. We may disclose data when legally required (court order, etc.) and will tell you when possible.

Search history rows are kept indefinitely for anti-abuse and product improvement, but your raw IP is never stored (only hashed daily). You can request deletion of any email-linked data at any time (see below).

You can ask us to access, correct, or delete any personal data we hold about you. Email info@inkfirst.ink and we’ll respond within 14 days. If you’re in the EU/UK, you also have GDPR rights including data portability and the right to lodge a complaint with your local data protection authority.

InkFirst is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, email us and we’ll delete it.

We’ll update the “Last updated” date at the top when we change this policy. Material changes will also be announced on the homepage.