Privacy information

Last updated: 28 September 2026

Controller

Andreas Hirzinger

6134 Vomp, Austria

Email: hello@mymath.ink

Summary

The editor runs in your browser. Formula text, imported note text, rendered glyphs, personal handwriting, stroke data and exported files are not sent to the operator.

Note sheets you edit are saved in the browser's own storage on your device so that they are still there on your next visit. Saving them involves no upload and no account, and the operator never receives them.

The current release has no account, product backend, contact form, waitlist, newsletter or payment. Visits are counted with Vercel Web Analytics, which uses no cookies. Separately, anonymous page views of the studio, clicks on named buttons and menu items, and a few named usage events are sent to a PostHog EU Cloud project so the operator can see how the tool's main functions are used. None of them contains anything you write, import, draw or export.

Handwriting and files on your device

Formula input and note sheets are typeset and rendered locally in the browser. Local `.txt`, `.md` and `.tex` imports are read on your device and are not uploaded.

If you draw characters and choose to keep them, the browser stores a personal handwriting bank in local storage under `handschrift.hand.v1`. It can contain the character, stroke coordinates, stroke order, point timing, pointer type and pressure information. It remains on that device until you use “Forget my handwriting”, clear the site's browser storage or remove it through browser settings.

“Save my hand” creates a JSON backup that your browser downloads to a location you choose. PNG and PDF exports, and the handwriting image or source text you copy, are also generated locally. A note-sheet PDF also contains the prose and headings of your sheet as machine-readable text, so that the PDF can be searched and has an outline of its headings; formulas are not included as text. Anyone you give the PDF to can search, copy or extract that text. If you use Share, your device hands the file to the app you pick; the operator receives none of these files.

When you edit a note sheet, the browser saves it on that device in the application's own local database (IndexedDB, named `mymath-ink-documents`). A saved record holds the note's own content — its headings, prose and formula source — together with a local identifier, the time it was created, the time it was last saved and a counter that keeps two open tabs from overwriting each other. Saving happens entirely in your browser: nothing about a note sheet is uploaded for it, and the operator never receives it. Other visitors' note sheets are stored the same way in their own browsers and are not on the operator's computer.

Saved note sheets remain on that device until you delete a single note or all notes in the studio, clear the site's browser storage or remove it through browser settings. This kind of browser storage is kept on a best-effort basis, so a browser may remove it when storage runs short. After your first saved note the application asks the browser once to keep the data persistently; the browser may grant or refuse that, and its answer is neither recorded nor sent anywhere. “Back up this note” downloads the note's content as a JSON file to a location you choose; that copy is yours and the operator does not receive it.

A single formula in formula mode is not saved. It exists only while the page is open.

This browser storage exists only for the local function requested by the user. It is not used for tracking, advertising or profiling. The application code sets no advertising cookie or cross-site identifier.

Analytics uses no cookie, local storage or session storage. Its random identifiers, event caps and up to two local content fingerprints exist only in the open page's working memory and disappear when that page is closed or reloaded. The fingerprints prevent repeated downloads of unchanged content from being counted twice and are never transmitted.

Hosting and technical request data

The public website is delivered by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. Loading any hosted website necessarily sends a technical request to its host.

Vercel states that it receives website and service-generated information such as the end user's IP address, city and country derived from that address, request timestamps, pages requested, browser and device information, system configuration, telemetry, diagnostics and log data. Vercel uses this information to deliver, operate, secure and improve its services.

The operator's legal basis for the technically necessary delivery and security processing is the legitimate interest in providing a secure and functioning website under Article 6(1)(f) GDPR. The operator has no user database, Log Drain or separate copy of these request logs and does not use them to build visitor profiles.

Vercel's current public DPA describes its processor terms for Pro and Enterprise plans. For service-generated data, Vercel describes itself as a controller under its current legal notices. Because the website uses the Hobby plan, the application is deliberately static and local-first so that formulas, note content, imported files and handwriting never become hosted customer content. Details are in the current Vercel Privacy Notice, Vercel Terms and Vercel DPA.

Visitor statistics (Vercel Web Analytics)

On the production website, the page loads Vercel Web Analytics from the website's own domain and reports each page view to Vercel. According to Vercel's documentation, a page view can carry the time, the page address and its route pattern, the referring page, filtered query parameters, an approximate location (country, region, city), the operating system and browser with their versions, the device type and the script version. Vercel states that it uses no third-party cookies, identifies visitors by a hash created from the incoming request, discards that visitor session after 24 hours, and provides the operator with aggregated statistics only.

The application sets no cookie and writes nothing to local or session storage for this purpose, and it records no custom events with Vercel. No formula, note, import, filename, glyph or stroke data is part of the page address, so none of it can reach these statistics. The operator uses the statistics only to see how many people visit and which pages and referrers bring them, and does not combine them with the product events below. Details are in Vercel's Web Analytics privacy documentation.

Contact by email

If you contact the operator, the contact details, message content and ordinary delivery metadata you provide are processed only to answer the request, document the response and meet legal duties. The legal basis is Article 6(1)(f) GDPR for ordinary enquiries and Article 6(1)(c) GDPR where handling a legal or data-protection request is required.

Messages to the domain contact address are forwarded by Porkbun LLC to the operator's existing mailbox provider. These providers may process the message outside the EEA under their own transfer mechanisms and privacy notices. Do not send handwriting backups, formulas or note files by email unless the operator specifically requests them for a support case.

Retention

The operator retains no formula, note, handwriting, import or export because those remain on the user's device. Local handwriting and locally saved note sheets remain until the user deletes them as described above.

Ordinary contact correspondence is kept only for as long as reasonably necessary to answer and document the request, and longer only where this is needed for a legal obligation or an existing or expected legal claim.

Vercel states that it retains technical platform information only for as long as needed for its contractual and legal obligations, security, disputes and legitimate business purposes, then deletes or anonymises it where possible. The operator does not export or extend that retention and will delete the Vercel project if the website is discontinued.

Recipients and transfers outside the EEA

The technically necessary hosting request and the visitor statistics are received by Vercel and the providers it uses to deliver and secure its service. The product analytics described below are received by PostHog's EU Cloud service. Contact messages are received by Porkbun and the destination mailbox provider. These providers may be located in the United States and state that they use the EU-US Data Privacy Framework, standard contractual clauses or another appropriate mechanism where required for international transfers. No other recipient receives data from the current application code.

Product analytics (PostHog EU Cloud), email and payment

On the production website, the studio (the English and German start pages) uses the PostHog browser library, delivered from the website's own domain, to send the following to PostHog's EU Cloud. The legal pages send nothing.

• Page views and page leaves of the studio.
• Clicks on named controls: menus, menu items, toolbar and footer buttons, the notes drawer, the Appearance tray, the walkthrough, the handwriting capture buttons and the import dialog. A click is recorded only as a fixed name chosen by the operator, such as `action:pdf` or `notes:new`, never as the text on screen. Clicks in the editor, the Preview, the drawing area or a file picker are not recorded.
• Named events: `first_export`, `first_sheet_export`, `second_export`, `personalisation_started`, `personalisation_completed`, `personal_export`, `walkthrough_completed`, `walkthrough_skipped`, `note_saved` and `style_changed`. They say that something was exported, that a note sheet was exported, that a second, different content was exported, that the handwriting capture was opened, that at least one character was drawn and kept, that an export contained your own handwriting, that the first-use walkthrough was finished or left early, that a note was saved in the browser, and that a built-in handwriting style was chosen. Each is sent at most once per open page, and the style event once per style. Only three carry a value, taken from a fixed list: how the walkthrough ended (`finish` or `help`), the step at which it was left, and which built-in style was chosen.

How these analytics requests are made

Each request carries random identifiers for the open page, its tab and its session. They exist only in the page's working memory: the application stores nothing in cookies, local storage or session storage for analytics, so a reload or a new tab starts over and a later visit cannot be linked to an earlier one. Each request also carries the page address reduced to domain and path (no query, no fragment), the referring website's domain only, the browser, operating system and device type (such as desktop or mobile), how long the previous page view lasted and how far it was scrolled, the library version, and the instruction not to create a person profile and not to derive a location from the IP address. The project anonymises IP addresses.

Before anything is sent, the application removes every other property the library would add, including the page title, the clicked element's text, classes and attributes, the full user agent, screen and window sizes, language, time zone and campaign parameters. The application sends no formula, LaTeX, note text, note title, imported file content, filename, clipboard content, saved note, character, glyph geometry, stroke, pressure, handwriting image, handwriting backup or other text from the page. It uses no session replay, heatmaps, surveys, feature flags, person profiles or `identify()`, loads no further script from PostHog and builds no advertising profile. Nothing links the PostHog identifiers to the Vercel visitor statistics.

This measurement serves the operator's legitimate interest under Article 6(1)(f) GDPR in understanding how the free tool's main functions are used, so that it can be maintained and improved. The editor and every export still work if analytics is blocked. The operator deletes the analytics project if the website is discontinued.

There is no on-site email collection, account, payment or Stripe integration. Email is processed only when a person chooses to contact the published address. Formula, note, glyph and stroke data must never enter analytics.

Your rights

Subject to the legal requirements, you may request information, access, correction, deletion, restriction or portability, or object to processing. Contact the controller at the email address above. The controller normally has one month to respond.

You may also complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria.

The local handwriting bank can be deleted immediately in the studio with “Forget my handwriting”. Saved note sheets can be deleted there too, one at a time or all at once. Because neither ever reaches the operator, the operator cannot inspect or remotely delete the copies on your device.

Automated decisions and profiling

The application makes no automated decision about a person and performs no profiling.

Changes to this information

The date at the top identifies this version. The notice will be updated before the product's data flow changes.