Privacy Policy

01Who we are

Inkstone (砚台) is operated by the Inkstone project team and is currently in an invite-only beta: only people invited by an admin can use it.

Inkstone has two sites, which run independently and do not share data with each other:

• Singapore site: lab.vibescience.net
• China site: currently at 112.124.38.230; it will switch to a domain name once the ICP filing is complete

This policy applies to both sites; where the two differ, this is stated separately. If you have any questions, please write to support@vibescience.net.

02What information we collect

• Account information: username, display name, email, role, and the team spaces you can use. Passwords are stored only as salted hashes (scrypt); we cannot see the original password. For accounts that sign in with Google, the only thing we obtain from Google is your email address.
• Content you put in: project files, uploaded archives, reference libraries, version history, team chat messages, conversations with the AI assistant, and content generated or modified by the AI.
• Usage records: sign-in times, records of administrative and authorization actions (who did what and when, without file or conversation content), AI usage (number of tokens and conversations), and storage space used.
• Content moderation records: messages blocked because they matched the sensitive-word list, and messages refused by the AI under its rules. Each record contains only the account, time, project, category, the matched word(s), and at most the first 300 characters of the message.
• Technical information: server access logs (IP address, time, the address accessed and the result), used for troubleshooting and for defending against attacks.
• Cookies and browser storage: there is only one sign-in session cookie (it expires after 8 hours); when you sign in with Google, there is an additional anti-forgery cookie valid for 10 minutes. Interface preferences (such as the page you last opened and unsubmitted form drafts) are kept in your own browser’s local storage. We do not use any advertising, analytics or third-party tracking.

03How we use it

• Providing the service itself: saving and compiling your projects, running the AI assistant, and sharing with others according to your settings.
• Sending email: invitation emails, password recovery, and project-sharing notifications; admins also receive alert emails about service failures.
• Security and compliance: preventing abuse, enforcing quotas, moderating content against the word list, and investigating the cause when something goes wrong.

We do not sell your information, do not use it for advertising, and do not use your content to train our own models. For how AI providers handle the content sent to them, see the next section.

04Who we share it with

Only when necessary to provide the service, we share only the necessary part with the following providers:

• AI providers handle the content sent to them under their own policies (Anthropic, DeepSeek). Please do not have the AI process material that you have no right to give to third parties.
• When you ask the AI to look things up online or download code, the AI accesses those websites from our servers, and those sites can see that access.
• Where required by law (for example, when a competent authority lawfully requests data), we will provide it as the law requires and will tell you to the extent the law allows.

05Where it is stored, and whether it leaves the country

• Singapore site: data is stored in Singapore. When you use AI, the relevant content is sent to Anthropic (USA) for processing; email is sent via Resend (USA).
• China site: data is stored in mainland China, and the AI is also within mainland China (DeepSeek). Only two things leave mainland China: email (recipient email addresses and email bodies are sent via Resend, a provider based in the USA), and reference search (search terms such as paper titles and DOIs are sent to public literature databases outside mainland China). Your project files and conversations do not leave mainland China.

No user data is transferred between the two sites.

06How long we keep it

• Account: kept for as long as you use the service; after the account is deactivated or deleted at your request, it disappears completely according to the backup cycle below.
• Projects and conversations: kept until you delete them. Projects moved to the trash are still kept; they are removed only once you delete them permanently from the trash.
• Backups: one backup is made every day. 30 backups of accounts and settings are kept, and 7 backups of project files; in addition, one copy is saved each week and kept for 6 weeks. So content you delete disappears from all backups after at most about 6 weeks.
• Content moderation records: kept on a rolling basis up to a capacity limit; once it is full, the oldest records are deleted.
• Access logs and activity logs: used for troubleshooting and security audits, and kept only for as long as necessary.
• Sign-in sessions: expire after 8 hours; changing your password immediately invalidates the sign-ins on all devices.

07Who can see your content

• You, and the people you share with (according to the read-only or write permission you grant).
• Admins can see a member overview (number of projects, storage used, AI usage, last sign-in time; no content), moderation records (the beginning of blocked or refused messages) and activity logs.
• Operations staff have administrative access to the servers and can technically access stored data. We do this only to troubleshoot, handle security incidents, carry out your deletion requests, or when required by law.
• The AI assistant can access, in each turn, only the project you currently have open; it cannot see other projects.

08How we protect this information

• The Singapore site uses HTTPS encryption for all traffic.
• Only salted hashes of passwords are stored; invitations and password recovery use one-time links, and passwords are never written in emails.
• The AI runs in an isolated sandbox, and in each turn only the current project is opened to it; the account credentials for the model services are not given to the AI, and the AI cannot read them.
• Automatic daily backups; the servers are automatically checked every five minutes, and admins are notified if something goes wrong.

No system can guarantee absolute security. If a security incident occurs that may affect you, we will tell you promptly, including what we have done and what you can do.

09Your rights

• Access and export: you can download project files, or export them in full, at any time.
• Correction: you can change your display name, email and password in “Profile”.
• Deletion: you can delete projects yourself; to delete your entire account and all of its data, write to support@vibescience.net, and we will process your request and reply within 15 working days.
• Withdrawal of consent: you can stop using the service and request deletion of your account at any time; withdrawal does not affect processing carried out before it.
• Complaints: if you are not satisfied with how we have handled something, you can first write to us; you can also lodge a complaint with the personal information protection regulator where you are located (Singapore: the Personal Data Protection Commission, PDPC; mainland China: the cyberspace administration authorities).

This service is intended for researchers and not for minors.

10Changes and contact

When this policy is changed, the changes will be published on this page and the effective date at the top will be updated; significant changes will also be announced separately by email.

Contact us: support@vibescience.net (Inkstone project team)