Privacy Policy

Effective September 28, 2026

The short version

We collect what it takes to run your notebook: your name, email and picture from Google, and the notes and files you put in.
We don't sell your data, show ads, use tracking cookies, or train AI models on your content.
People you share a workspace with can see what's in it. Agents you connect can do what you can do.
You can ask us for a copy of your data, or to delete it, at any time.

Who we are

Common Ink (“we”, “us”) is a notebook for people, their teams and their AI agents, at commonink.app. It is operated by Audrow Nash LLC. Questions about this policy go to support@commonink.app.

What we collect

Your Google account basics. When you sign in with Google we receive your name, email address, profile picture and a Google account ID. We don't ask for access to your Gmail, Drive, contacts or anything else.
What you put in Common Ink. Notes, uploaded files, and the workspaces, members and invites you create.
History. Each change records who made it (you, a teammate or an agent), when, and the note's previous text, so changes can be seen and undone.
Technical logs. Our hosting provider records requests (such as IP address, browser and the page requested) to keep the service running and secure. These logs are kept for up to 7 days.

How we use it

To sign you in and show you the workspaces you belong to.
To store, search, sync and display your notes and files, including to the people you share them with.
To keep the service secure, prevent abuse and fix problems.
To contact you about your account or important changes to the service.

We don't sell or rent your personal information, use it for advertising, or use your notes and files to train AI models.

Google user data

Common Ink only uses the basic profile information described above, and only to identify you and show your name and picture to people you work with. Common Ink's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who can see your content

Your personal workspace is visible only to you.
Team workspaces are visible to every member. Anyone with a valid invite link (valid for 7 days) can join the team it was created for.
Agents and apps you connect act with your access. What they read and write is up to you and their providers, whose own privacy policies apply to what they do with it.
Service providers who run Common Ink on our behalf (below).
The law. We may disclose information if we believe it is required by law, or to protect the rights and safety of our users, the public or us.

Service providers

Cloudflare hosts Common Ink and stores its data (databases and files) on its global network, which may be outside your country.
Google provides sign-in. Your profile picture is loaded from Google's servers.

Links and embeds

When you paste a link, our servers fetch that page to build a preview, so the site sees a request from us rather than from you. Embedded content such as YouTube videos or social posts loads from those services in your browser, and they may collect data or set cookies under their own policies.

Cookies and local storage

We use two cookies, both needed for Common Ink to work:

ci_session keeps you signed in for up to 30 days.
ci_oauth protects the Google sign-in step and expires after 10 minutes.

Your browser's local storage also remembers preferences such as your theme and the last note you had open. We don't use analytics, advertising or tracking cookies.

How long we keep it

Your account, notes and files are kept until you delete them or ask us to delete your account.
Deleted items are removed from your workspace right away. Copies in backups and storage are erased within 30 days.
A note's earlier versions stay in its workspace's history so changes can be undone. Ask us if you want a workspace's history erased too.

Your choices and rights

You can ask us to see, correct, export or delete your personal information by writing to support@commonink.app. Depending on where you live, you may have further rights, including to object to or restrict how we use your information, and to complain to your local data protection authority. We'll respond within 30 days. You can also remove Common Ink's access in your Google Account settings.

Security

All traffic is encrypted in transit. Every request is checked against the workspaces you belong to, and uploaded files are served in a sandbox so they can't run code in your session. No system is perfectly secure; if we learn of a breach affecting your data we'll tell you promptly.

Children

Common Ink isn't intended for children under 13, and we don't knowingly collect their information. If you believe a child has given us personal information, contact us and we'll delete it.

Changes to this policy

If we make material changes we'll tell you in the app or by email before they take effect, and update the date at the top.