← Back

Privacy Policy

Last updated: 31 July 2026 (version 2026-07-31)

1. What We Are

Inwitt is a Socratic thinking assistant that helps you think through decisions, problems, and ideas. The AI asks questions. It does not provide answers or store your data for AI training purposes.

2. Data We Collect

  • Account data: Email address, hashed password (or Google OAuth profile).
  • Session data: Chat messages, whiteboard canvas state, session titles, all tied to your account.
  • Usage data: Credits used, plan type, session counts.
  • Analytics data: Page views, feature usage, session duration, collected via PostHog (only with your consent).
  • Payment data: Processed by LemonSqueezy. We store your customer ID and subscription status, not your card details.

3. How We Use Your Data

  • To provide the thinking assistant service (chat, whiteboard, receipts).
  • To manage your account, credits, and subscription.
  • To improve the product based on aggregated, anonymized usage patterns.
  • To send transactional emails (receipts, account changes), never marketing unless you opt in.

4. AI and Your Data

Your chat messages are sent to Anthropic's Claude API to generate responses, and voice recordings are sent to Groq for transcription. Neither provider uses this input to train their models.

Anthropic deletes API inputs and outputs within 30 days. They may keep them longer only where the law requires it, or to investigate a suspected breach of their usage policy. We do not have a zero-retention agreement in place, so this 30 day window is what applies to your conversations today.

Inwitt's assistant is an AI. It is not a person, and it is designed never to give you an answer, a recommendation or a decision. Everything it produces is a question or a record of what you said.

5. Data Storage and Security

  • Data is stored in Supabase (PostgreSQL), hosted on AWS infrastructure.
  • All data is encrypted in transit (TLS/HTTPS) and at rest (AES-256 disk encryption).
  • Row-Level Security ensures you can only access your own sessions.
  • Authentication is required for all data access.

6. Cookies and Analytics

We use PostHog for product analytics. PostHog sets cookies to track session behavior. You can accept or decline analytics cookies via the consent banner. Declining does not affect the core functionality of Inwitt.

Analytics is off until you turn it on. We do not wait for you to decline. If you have not accepted the banner, nothing is collected, which is the default state for every new visitor and every new account.

6b. Who is responsible

The person responsible for the protection of personal information at Inwitt is our founder, reachable at [email protected]. Write to that address for any question about your data, to make a request under this policy, or to raise a concern.

We answer data requests within 30 days.

6c. Where your data goes

Inwitt is operated from Malaysia and our processors are largely in the United States and the European Union, so your data is transferred outside your own country. Those transfers are covered by the data processing terms we hold with each provider listed below, which include the European Commission's Standard Contractual Clauses where they apply.

6d. If something goes wrong

If a personal data breach happens that is likely to cause you significant harm, we will notify the Malaysian Personal Data Protection Commissioner within 72 hours of becoming aware of it, and tell you within 7 days. Where other regulators have a claim, we will notify them on their own timelines. We will say what happened, what data was involved, and what you should do.

6e. Which law applies

Inwitt is operated from Malaysia, so the Personal Data Protection Act 2010 (as amended) applies to everything we do with your data, and the Malaysian Personal Data Protection Commissioner is our regulator. If you live in the EEA, the UK, California or Quebec, you also keep the rights your own law gives you, and the sections above are written so that the strictest requirement is the one we follow for everyone.

7. Third-Party Services

  • Anthropic (Claude API): Processes chat messages. Privacy policy
  • Groq: Transcribes voice recordings, only when you use voice input. Privacy policy
  • Vercel: Hosting. Processes request data including IP addresses. Privacy policy
  • Supabase: Database and authentication. Privacy policy
  • PostHog: Product analytics (consent-gated). Privacy policy
  • LemonSqueezy: Payment processing. Privacy policy
  • Sentry: Error tracking (no personal data, only stack traces).

8. Your Rights

You have the right to:

  • Access your data. All your sessions are visible in your dashboard.
  • Delete your data. You can delete individual sessions, or delete your whole account.
  • Export your data. Settings has a “Download my data” button that gives you every record we hold for your account as a JSON file. You can also export a board as PNG or SVG.
  • Correct your data, or object to how we use it, by writing to us.
  • Complain to your local data protection authority if you think we have got this wrong.
  • Withdraw consent for analytics via the cookie settings or by contacting us.

9. Data Retention

Active sessions are retained as long as your account exists. Deleted sessions are soft-deleted and permanently purged after 30 days. If you delete your account, all data is removed within 30 days.

10. We do not sell your data

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either. The companies listed above process data on our behalf so the product works; they are not allowed to use it for their own purposes.

We also do not make automated decisions that produce legal or similarly significant effects about you. The assistant asks questions; it does not decide anything about your account.

11. How long we keep things

  • Your sessions, notes and tasks stay until you delete them or close your account.
  • Deleting your account removes your data, including uploaded files, within 30 days.
  • Anthropic deletes the API inputs and outputs behind your chats within 30 days. See section 4.
  • We may keep a minimal record of a transaction where tax or accounting law requires it, even after your account is gone.
  • If you use the mobile app without creating an account, what you write stays on your device. We do not receive it and we hold nothing about you. It is carried into our systems only if you choose to create an account, and clearing the app data removes it while it is still only on your device.

12. Contact

For privacy questions or data requests, contact us at [email protected].

Inwitt is operated by INWIT TECHNOLOGIES (Registration No. 202603154719 (003859770-W)). Our registered address is being finalised and will be published here.