Legal

Privacy Policy

Draft prepared: 12 October 2026

1. Who we are and what this policy covers

ARKADE CLUB PRIVATE LIMITED, India (“we”, “us” or “our”), operates Indicon. This policy covers the Indicon iOS and iPadOS app, its handwriting keyboard extension, writing and note features, purchase processing and related support. We are responsible for the purposes of personal-data processing described here and act as controller where that concept applies.

Contact: support@arkade.club, with the subject “Indicon privacy”. Our address and telephone number are in section 13.

Indicon works without an Indicon account. This does not mean that no information leaves your device: the keyboard uses Google’s online recognition service, and the main app includes Google/Firebase and RevenueCat services. The following sections explain the differences.

This policy describes our practices. Reading it, using the app or enabling Full Access does not substitute for any separate consent required by law.

2. Handwriting in the keyboard

When you write in the Indicon keyboard with Full Access enabled, the keyboard can automatically send completed strokes for recognition after you pause. A request can happen before you select or insert a suggested word.

The request goes directly from your device to Google Input Tools using an encrypted HTTPS connection. It contains the positions and relative timing of handwriting points, the writing-area dimensions, the selected recognition language and an app label identifying Indicon. Google also receives connection information, such as your IP address and request metadata. Handwriting can reveal the words or personal information you write; stroke coordinates are not inherently anonymous.

Google returns possible text matches so that the keyboard can display suggestions. Indicon does not route these handwriting requests through an Arkade handwriting server. The request does not include the text already present in the host app, your note library, an Indicon account profile or a Google sign-in token supplied by Indicon.

For local spacing and punctuation, the keyboard reads limited text before or after the cursor when the host app makes it available. That nearby text is not included in the handwriting recognition request. The keyboard is not designed to maintain a persistent history of everything you type. Current strokes and suggestions are held temporarily in memory while the keyboard runs; they can remain when it is hidden and reopened until cleared or the process ends.

The recognition connection uses no persistent URL cache or cookie storage configured by Indicon. This does not prevent Google from receiving requests or keeping server-side records. Google’s processing is subject to its applicable terms and Privacy Policy at https://policies.google.com/privacy. We do not promise that Google immediately deletes submitted handwriting or that its processing has a particular retention or model-training restriction.

You can stop future online keyboard recognition by switching keyboards, removing Indicon’s keyboard or disabling Allow Full Access in Settings → General → Keyboard → Keyboards → Indicon. These actions do not recall information already sent. Avoid entering confidential or sensitive information through online recognition if you do not want it transmitted.

3. Handwriting inside the app

The app’s own handwriting canvas uses Google ML Kit to recognise supported languages on your device after the relevant model has downloaded. ML Kit does not send the handwriting input or recognition output to Google for this on-device processing. The model download needs an internet connection and can use cellular data.

ML Kit separately communicates with Google for model delivery and related operation, and sends technical usage and performance information. This can include device and operating-system details, app version, installation identifiers, configured recognition language, feature and download events, errors and processing performance. Offline recognition therefore does not mean that every part of the app is free of network communication or measurement.

See Google’s ML Kit disclosures at https://developers.google.com/ml-kit/terms and https://developers.google.com/ml-kit/ios-data-disclosure.

If you activate the Indicon keyboard in a text field inside the app, its online recognition still follows section 2. The on-device description applies to the app’s own drawing and recognition feature.

4. Notes, preferences and exports

Notes are saved locally in the app’s storage. They can contain titles, typed or edited text, recognised text, original handwriting strokes, language information and creation or modification dates. Note search runs against this local information. Indicon does not upload the note library to an Arkade server or provide CloudKit note synchronisation.

The app also stores preferences such as selected languages, keyboard appearance, writing pace, spacing settings, onboarding progress and review-prompt history. A shared on-device app container lets the app and its keyboard exchange relevant settings and keyboard setup status. This sharing is between components of Indicon, not a public online profile.

Device backups or transfers managed by Apple or your computer may include local app data, depending on your settings. They are separate from an Indicon cloud synchronisation service.

If you use Share as Text or Share Original Handwriting, the selected app or recipient receives the exported text or image. A handwriting export creates a temporary image on your device. Shared copies are controlled by their recipients and services; deleting a note in Indicon does not delete those copies.

5. Analytics and crash information

The main app uses Google Analytics for Firebase to understand use and Firebase Crashlytics to investigate failures. Analytics is enabled when the app starts. The current app does not provide an in-app analytics or crash-reporting opt-out.

Analytics processes app-instance and available device/vendor identifiers, device and app details, language and region information, approximate location, session and engagement information, and automatically collected events such as first use. Eligible purchase events may also be collected. Approximate location is different from access to precise GPS location. For details of Google’s default collection, see https://support.google.com/analytics/answer/11593727.

Crashlytics processes installation identifiers, crash stack traces, relevant app state and device/operating-system details. Analytics events may appear as breadcrumbs associated with a crash. We use this information to understand failures and improve reliability. See https://firebase.google.com/support/privacy and https://firebase.google.com/docs/ios/app-store-data-collection.

Indicon does not deliberately attach note contents, handwriting strokes or surrounding keyboard text to analytics events or crash reports. These SDKs are integrated in the main app, not the keyboard extension. The keyboard’s recognition requests remain a separate data flow.

Full Access controls the keyboard’s capabilities; turning it off does not disable main-app analytics, crash reporting, ML Kit metrics or purchase services. Where applicable law requires consent for a type of measurement, that requirement applies independently of this policy and device permissions. A support email requesting deletion does not automatically stop SDK collection on your device.

6. Purchase information

Apple handles payment for optional support purchases. We do not receive your complete payment-card number through Apple’s purchase flow.

RevenueCat provides purchase validation and purchase-status services. Its SDK starts with the app and can communicate before you make a purchase. It creates a randomly generated app user identifier and processes transaction or receipt information, product identifiers, purchase dates and status, and related app/device and connection information. The identifier can link activity or transactions without a name or email; it should not be understood as fully anonymised information.

Indicon does not ask you to sign in or supply a name or email to RevenueCat. RevenueCat’s services help us verify contributions, investigate billing problems and understand purchase activity. Apple and RevenueCat may retain transaction records even after you remove the app.

Provider information: https://www.apple.com/legal/privacy/ and https://www.revenuecat.com/privacy.

7. Support, external links and other disclosures

If you contact us, we receive the contact details available through your chosen channel, your message and anything you attach. Indicon’s email and WhatsApp links prefill device model, operating-system version, app version, locale/language and a subscription-level label. You may review and change a message before sending it. Opening a WhatsApp link can pass its prefilled contents to WhatsApp as part of the link itself.

Email, WhatsApp, social networks and external websites process information under their own policies. Their handling of website cookies or messaging information is separate from local note storage. This app policy does not describe all technologies used on external websites you open.

We use support correspondence to answer you and resolve the issue. Only share the information needed; do not send passwords, full card numbers or unrelated private notes.

The service providers described above receive information relevant to their functions. We may also disclose information when you direct us to share it, when a valid legal obligation requires it, when reasonably necessary and lawful to protect rights or security, to advisers with confidentiality duties, or in a business transfer subject to applicable protections. We remain responsible for processing performed on our behalf as required by law.

8. Why we process information

We process handwriting and local settings to provide the recognition and editing features you choose; note data to save, find and export your writing; transaction information to validate purchases and handle purchase issues; technical usage and diagnostic data to understand performance and improve the app; and correspondence to provide support and address privacy requests. Records may also be needed to meet legal duties or resolve disputes.

For processing covered by European data-protection rules, the relevant bases are performance of a contract for information necessary to provide requested functions; legitimate interests in proportionate reliability, security and support work, subject to your rights; consent where required for measurement or other optional processing; and an applicable legal obligation where one requires processing. A legitimate-interest basis does not override a separate requirement to obtain consent.

Handwriting recognition produces text suggestions. It is not used by Indicon to make decisions about legal rights, employment, credit or other similarly significant matters.

9. Storage, retention and security

Local notes remain until you delete them or their app data is removed. Deleting a note removes its database entry and attempts to remove its associated handwriting files. Failed file cleanup can be retried later. Old unreferenced handwriting snapshots and temporary export images older than seven days are eligible for cleanup when the relevant library opens; this is not a guarantee of deletion exactly seven days after creation. Copies in backups and receiving apps may remain separately.

Google Input Tools handles server-side recognition records under its applicable policies. Clearing the canvas does not delete those records. ML Kit telemetry is also governed by Google’s applicable practices.

Analytics data is retained according to the configured Analytics retention settings and the type of record. Google states that Crashlytics keeps crash traces and associated identifiers for 90 days before beginning removal from live and backup systems. This is not a guarantee that all records held by every provider disappear after 90 days.

Purchase and support records are kept for the period needed for transaction validation, resolving the issue, applicable accounting or legal requirements, and the establishment or defence of claims. Where information is no longer needed and no lawful retention requirement applies, it should be deleted or effectively anonymised. You can contact us for the retention criteria applicable to a particular request.

Network services described here use HTTPS. Local handwriting files use iOS file-protection facilities. Device security, backups and recipient behaviour also affect confidentiality. No storage or transmission method is completely secure. These limitations do not reduce our legal responsibilities for protecting personal information.

10. International processing

We operate from India. Apple, Google, RevenueCat and communication providers operate internationally, so information sent to them may be processed outside your country. Local notes are not uploaded by Indicon merely because these services are present.

Where a transfer is subject to legal restrictions, an appropriate transfer mechanism and any required safeguards must apply. You may contact us to request information about the destinations and safeguards applicable to your information, including how to obtain a copy where legally available.

11. Your choices and rights

You can edit or delete local notes, export writing through the sharing controls, adjust keyboard settings, disable Full Access, remove the keyboard and delete the app. Offloading an app may preserve its documents. Review device backups separately if you want to remove copies stored there. There is no Indicon account-deletion screen because there is no Indicon account.

Uninstalling the app does not automatically erase information already received by Google, RevenueCat, Apple or support services. To request access, correction or deletion of information under our control, email support@arkade.club with the subject “Indicon privacy request”. Explain the information or activity involved. We may request a purchase reference or other proportionate information to locate records and verify your request. Do not send a password or full card details.

Depending on applicable law, you may also have rights to portability, restriction, objection, withdrawal of consent and an appeal of a refused request. Some records may be subject to lawful exceptions. We will explain an applicable refusal or extension and respond within the legally required period. You may complain to the relevant privacy regulator without first completing our support process.

Without an account or a relevant identifier, we may be unable to associate particular installation records with you. We will explain what is reasonably needed to find the information. Providers acting independently also offer their own privacy-request routes; this does not remove our duties for processing for which we are responsible.

12. Children and policy changes

Indicon does not ask for a date of birth or create child profiles. A parent or guardian concerned that a child has supplied personal information can contact us to request assistance and appropriate deletion. Where law requires verifiable parental consent or another child-specific safeguard, general permission to use a device or its keyboard does not replace it.

We will revise this policy when the app or our practices change and identify the applicable effective date. Material changes will receive notice appropriate to their effect, and any required consent must be obtained before new consent-based processing. A revised policy does not retroactively authorise an undisclosed use of information.

13. Contact details