Skip to main content

Menu

Navigate to different pages.

Login

Privacy Policy

of InkDev GmbH, Allgäuer Straße 33, 86391 Stadtbergen, Germany

We are responsible for processing your personal data when you visit, read, publish or make purchases on mosa.ink. For questions about privacy, you can reach us at support@mosa.ink.

Data comes from you, your use of the service, the login and payment services you select and, where applicable, reports from other users.

Legal bases under Article 6(1) GDPR: (a) consent, (b) processing necessary to perform a contract and requested pre-contractual measures, (c) legal obligations, (f) the legitimate interests specified in each case.

Acknowledging this notice does not constitute consent to optional data processing.

For delivery and security, we process your IP address, time of access, requested address, browser information, referring page where applicable, and status and error messages.

The legal bases are Article 6(1)(b) GDPR for requested contractual services and (f) for our secure and reliable operation.

For tax calculations and purchase and availability checks, we determine the approximate country from the IP address using a server-side geolocation database (Article 6(1)(b) GDPR).

For your account, we process your email address, username, account identifier/status, settings, sessions, password hash, verification and two-factor authentication data, including verification attempts.

We document the versions of the contractual terms and privacy notices to keep a record of the contractual relationship.

Legal bases: Article 6(1)(b) GDPR for the account, (f) for protection against unauthorised access.

An email address, username and the selected authentication method are required for an account. Without the mandatory information identified in the purchase or author form, a purchase or payout is not possible. You may omit optional profile information.

Signing in with Google

If you choose to sign in with Google, we receive a provider identifier, email address and its verification status to create your account or sign you in. We do not receive your Google password.

Our processing is based on Article 6(1)(b) GDPR. Google learns of the login and processes data under its own responsibility; see Google’s privacy notice. The controller is Google Ireland Limited, Ireland, for users in the EEA and Switzerland; for other users, it is Google LLC, USA.

For the features you choose, we process profile information, texts, images, comments, reviews, posts, reactions and book lists, together with attribution to their creators and timestamps (Article 6(1)(b) GDPR).

Published content, usernames and optional profile information are public and may be indexed by search engines; your account email address is not publicly visible. For new accounts, favourites, “Read later” and “Already read” are initially hidden. Existing visibility settings are retained. “Already read” also includes books identified automatically from reading markers. You can hide or share these lists in the settings.

Removing content from mosa.ink does not automatically remove copies already downloaded, screenshots or entries held by other providers.

Reading markers, book/chapter interactions, lists, following relationships and settings enable recommendations, personal reading features and requested notifications (Article 6(1)(b) GDPR).

For purchases, downloads and subscriptions, we process the association with the account and offer, price, currency, billing country, term, payment status and transaction identifiers, as well as evidence relating to contractual terms and, where applicable, early commencement of performance and loss of the right of withdrawal.

Legal bases: Article 6(1)(b) GDPR for payment, unlocking access, subscription management and invoicing, (c) for legal obligations, (f) for necessary prevention of abuse and defence against claims.

Payment service provider Stripe

Stripe collects payment data through its payment interface. We receive payment, customer and status data and also store technical payment events and retry jobs. Depending on the transaction, these contain customer identifiers, contact and billing data, and contractual and payment information.

Depending on the processing activity, Stripe acts as a processor or an independent controller, in particular in relation to its own legal obligations and certain fraud checks. See Stripe’s privacy notice.

We use Stripe (Stripe Payments Europe, Limited, Stripe Technology Europe, Limited and Stripe Technology Company, Limited, all in Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) to process payments. We offer credit and debit cards, Apple Pay, Google Pay, Link and PayPal. We process the contact, payment and transaction data required for this to perform the contract under Article 6(1)(b) GDPR. Depending on the payment method, Apple, Google and participating financial service providers are also involved. Data may also be processed outside the EU. Further information is provided in the privacy notices of Stripe including Link, Apple Pay, Google Pay and PayPal.

Information for authors

Authors receive sales, subscription and accounting information relating to their offers (Article 6(1)(b) GDPR). Sales notifications do not contain buyer profiles.

For author contracts and payouts, we process legal names or company names, addresses, countries, legal forms, tax and VAT information, and required supporting documents.

This also includes Stripe account identifiers, verification status, revenue and payout records. Stripe may collect additional identity, business and banking data for account verification.

Legal bases: Article 6(1)(b) GDPR for performing the contract, (c) for legal obligations.

For our bookkeeping and tax advice, we transmit necessary invoice, accounting and payment data to the tax advisory firm we engage in Germany and to competent authorities for statutory reporting obligations.

Necessary account, security, purchase, subscription and payout emails are based on Article 6(1)(b) GDPR or, in the case of legal obligations, (c).

You expressly enable optional emails about followed content, interactions, Platform events and sales in the settings (Article 6(1)(a) GDPR). We document your selection, the time and the version of the text. You can withdraw your consent there with effect for the future; unsubscribe links relate to the book, author or series specified in each case. Necessary contractual messages remain unaffected.

Resend (Plus Five Five, Inc., USA) receives the recipient’s address, subject, content and any attachments. Resend stores data in the USA even when a European sending region is selected. For reliable delivery and record-keeping, we also store copies of messages, sending jobs, status data and previous recipient addresses. Resend’s data-protection information

Under the plan we use, Resend retains the email and log data generated when sending emails for 30 days. Resend’s open and click tracking are disabled.

We process contact details and enquiry content to handle contractual matters (Article 6(1)(b) GDPR), or otherwise in our legitimate interest in handling your enquiry (f).

We use our own cookies and local browser storage exclusively for functional purposes, in particular for login, security features and storing reading and display settings. We do not use our own advertising or analytics cookies. You can delete this data or restrict its storage through your browser settings; doing so may impair website features.

View statistics within mosa.ink

For statistics and rankings, we record book, chapter and profile views, as well as reading events.

To avoid duplicate counting, we store a hashed identifier, target, event and timestamp. The identifier is derived from the login session or from a truncated IP address, browser information and a broad referrer category. A successful cleanup run removes the identifiers of events older than two hours. The target, event and timestamp remain stored.

Web analytics with Umami

Umami processes page views, referrers, browser, operating system, device type and approximate country of origin. Query parameters of the requested URL are excluded.

Sentry (Functional Software, Inc., USA) processes technical error and performance data, requested addresses, timestamps, browser/device information and identifiers for troubleshooting and performance monitoring. In addition to error reports, we collect trace and runtime data from browser and server operations, as well as server performance profiles. This data may relate to individuals. We do not use session recordings (Replay).

Error reports are retained for 90 days, performance data for 90 days and, in some cases, as samples for up to 13 months. Processing in the USA is possible. Further information is provided in Sentry’s privacy policy.

For the purposes described, we use the following services and transfer data to the external recipients listed; processing on our behalf and independent controllership must be distinguished for each activity:

Service Function and data
Hetzner Online GmbH, Germany, hosting in Nuremberg Hosting the application, database and file storage; stored content, account, usage and connection data
bunny.net, BunnyWay d.o.o., Slovenia Website, file and image delivery through a content delivery network (CDN); delivered content, IP addresses, HTTP requests and other connection data
Backblaze, Inc., USA, EU Central storage region (Amsterdam, Netherlands) Backups of databases and files, including the personal data they contain
Resend, Plus Five Five, Inc., USA Email delivery; recipient addresses, subject, content, any attachments, and sending and delivery data; storage in the USA
Sentry, Functional Software, Inc., USA, Germany data region (Frankfurt am Main) Error diagnosis and performance monitoring; technical error and performance data, requested addresses, timestamps, browser/device information and identifiers
Umami, operated by InkDev GmbH, Germany Web analytics on our own hosting infrastructure; page views, referrers, browser, operating system, device type and approximate country of origin; no transfer to an Umami cloud provider
Stripe Payments Europe, Limited, Stripe Technology Europe, Limited and Stripe Technology Company, Limited, Ireland Payments, subscriptions, identity verification and payouts; contact, billing, payment, transaction and identity data; processing on our behalf or independent controllership depending on the activity, see section 6
Google Ireland Limited, Ireland, for users in the EEA and Switzerland; Google LLC, USA, for other users Selected Google login; provider identifier, email address, verification status and technical connection data; independent controllership
Axiom, Inc., USA, EU Central data region Storage and analysis of server logs for operational monitoring and error diagnosis; connection, status and error data contained in those logs
Tax advisory firm engaged in Germany Bookkeeping and tax advice; necessary invoice, accounting and payment data; independent controllership

Other recipients include authorised employees, the public to the extent described and, where necessary, authorities, courts and advisers subject to professional duties of confidentiality.

Even where data is stored in the EU, processing, support access and subprocessors outside the EEA are possible, particularly in the USA.

The providers specify the following transfer mechanisms under Articles 45 or 46 GDPR: the EU-US Data Privacy Framework (DPF), EU Standard Contractual Clauses (SCC) or approved Binding Corporate Rules (BCR). The DPF applies only to certified US recipients and to the data covered by their certification.

Provider Published transfer mechanisms
Resend DPF; SCC for transfers not covered by an adequacy decision
Axiom SCC
Sentry DPF; alternatively SCC
Backblaze DPF and SCC
Stripe including Link Primarily DPF; additionally SCC
Google DPF; SCC for transfers not covered by an adequacy decision
Apple including Apple Pay SCC
PayPal BCR within the group; otherwise, among other mechanisms, SCC

We use the EU and USA zones for CDN delivery through bunny.net.

Information about these mechanisms is available in the linked provider documentation.

Unless this privacy policy specifies a different retention period, we delete your personal data as soon as it is no longer necessary for the purposes for which it was collected or processed.

Data is also deleted or blocked once statutory retention periods have expired. Data may be stored for longer where this is necessary to conclude or perform a contract or where statutory retention obligations prevent deletion.

Certain data may therefore be stored for a longer period because of legal requirements.

You have the right at any time to request information about the data stored about you.

Account closure ends access and withdraws published content; it is not complete deletion or anonymisation. The account and affected content are marked as deleted internally. Account, profile, usage and accounting data, as well as internal associations with creators, initially remain stored. In discussions, entries may remain in a restricted display to preserve context. Send deletion requests to support@mosa.ink. Your statutory right to erasure remains unaffected.

For reports and moderation, we process the content concerned, information about the parties involved, reasons and decisions.

This serves to protect the community and enforce the rules (Article 6(1)(f) GDPR), as well as to fulfil specific legal obligations.

Checks of login, access rights, payment status and country availability may prevent content from being unlocked or purchases from being made.

If you believe such a restriction is incorrect, you can contact support@mosa.ink and request a review.

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR).

You may withdraw consent you have given at any time with effect for the future. Processing carried out before withdrawal remains unaffected.

Right to object: Where we process data on the basis of Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the processing to establish, exercise or defend legal claims.

Send your requests to support@mosa.ink

If you believe that we are processing your personal data in breach of the General Data Protection Regulation (GDPR), you may lodge a complaint with a data-protection supervisory authority under Article 77 GDPR.

The supervisory authority responsible for our company is:
Bavarian State Office for Data Protection Supervision (BayLDA)
PO Box 1349
91504 Ansbach
Telephone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de

We will inform you of material changes in good time and in an appropriate manner; before processing data for new purposes, we will provide you with the required information.

Privacy Policy · October 8, 2026