Privacy information

Last updated: 2 August 2026

Controller

Andreas Hirzinger

Fiecht 8e, 6134 Vomp, Austria

Email: hello@mymath.ink

Summary

The editor runs in your browser. Formula text, imported note text, rendered glyphs, personal handwriting, stroke data and exported files are not sent to the operator.

The current release has no account, product backend, contact form, waitlist, newsletter or payment. It sends eight strictly limited anonymous usage events to a separate PostHog EU Cloud project so the time-limited product test can be evaluated.

Handwriting and files on your device

Formula input and note sheets are typeset and rendered locally in the browser. Local `.txt`, `.md` and `.tex` imports are read on your device and are not uploaded.

If you draw characters and choose to keep them, the browser stores a personal handwriting bank in local storage under `handschrift.hand.v1`. It can contain the character, stroke coordinates, stroke order, point timing, pointer type and pressure information. It remains on that device until you use “Forget my handwriting”, clear the site's browser storage or remove it through browser settings.

“Save my hand” creates a JSON backup that your browser downloads to a location you choose. PNG export is also generated locally. The operator receives neither file.

This browser storage exists only for the local function requested by the user. It is not used for tracking, advertising or profiling. The application code sets no advertising cookie or cross-site identifier.

Analytics uses no cookie, local storage or session storage. One random identifier, event caps and up to two local content fingerprints exist only in the open page's working memory and disappear when that page is closed or reloaded. The fingerprints prevent repeated downloads of unchanged content from being counted twice and are never transmitted.

Hosting and technical request data

The public website is intended to be delivered by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. Loading any hosted website necessarily sends a technical request to its host.

Vercel states that it receives website and service-generated information such as the end user's IP address, city and country derived from that address, request timestamps, pages requested, browser and device information, system configuration, telemetry, diagnostics and log data. Vercel uses this information to deliver, operate, secure and improve its services.

The operator's legal basis for the technically necessary delivery and security processing is the legitimate interest in providing a secure and functioning website under Article 6(1)(f) GDPR. The operator has no user database, Log Drain or separate copy of these request logs and does not use them to build visitor profiles.

Vercel's current public DPA describes its processor terms for Pro and Enterprise plans. For service-generated data, Vercel describes itself as a controller under its current legal notices. Because this validation uses Hobby, the application is deliberately static and local-first so that formulas, note content, imported files and handwriting never become hosted customer content. Details are in the current Vercel Privacy Notice, Vercel Terms and Vercel DPA.

Contact by email

If you contact the operator, the contact details, message content and ordinary delivery metadata you provide are processed only to answer the request, document the response and meet legal duties. The legal basis is Article 6(1)(f) GDPR for ordinary enquiries and Article 6(1)(c) GDPR where handling a legal or data-protection request is required.

Messages to the domain contact address are forwarded by Porkbun LLC to the operator's existing mailbox provider. These providers may process the message outside the EEA under their own transfer mechanisms and privacy notices. Do not send handwriting backups, formulas or note files by email unless the operator specifically requests them for a support case.

Retention

The operator retains no formula, note, handwriting, import or export because those remain on the user's device. Local handwriting remains until the user deletes it as described above.

Ordinary contact correspondence is deleted no later than six months after the request is closed unless it must be kept longer for a legal obligation or an existing or expected legal claim.

Vercel states that it retains technical platform information only for as long as needed for its contractual and legal obligations, security, disputes and legitimate business purposes, then deletes or anonymises it where possible. The operator does not export or extend that retention and will delete the Vercel project if the validation is ended.

Recipients and transfers outside the EEA

The technically necessary hosting request is received by Vercel and the providers it uses to deliver and secure its service. The limited analytics events are received by PostHog's EU Cloud service. Contact messages are received by Porkbun and the destination mailbox provider. These providers may be located in the United States and state that they use the EU-US Data Privacy Framework, standard contractual clauses or another appropriate mechanism where required for international transfers. No other recipient receives data from the current application code.

Limited product analytics, email and payment

The application sends only these event names to PostHog EU Cloud: `landing_session`, `first_export`, `sheet_created`, `first_sheet_export`, `second_export`, `personalisation_started`, `personalisation_completed` and `personal_export`. The only optional event values are a campaign source reduced to a 32-character letter/number slug and the number of personally drawn glyphs.

Each request contains a random identifier that lasts only for the open page and the instruction not to create a PostHog person profile. The project anonymises IP addresses. The application does not load the PostHog browser SDK and therefore has no autocapture, automatic page views, session replay, heatmaps, surveys, advertising profile or analytics cookie. It deliberately sends no URL, referrer, formula, note, filename, character, glyph geometry, stroke, pressure or handwriting backup.

This narrow measurement serves the operator's legitimate interest under Article 6(1)(f) GDPR in deciding whether the free, time-limited validation should continue. The editor and every export still work if analytics is blocked. Validation events or the project will be deleted no later than 30 days after the campaign decision unless a concrete legal claim requires a limited record for longer.

There is no on-site email collection, account, payment or Stripe integration. Email is processed only when a person chooses to contact the published address. Formula, note, glyph and stroke data must never enter analytics.

Your rights

Subject to the legal requirements, you may request information, access, correction, deletion, restriction or portability, or object to processing. Contact the controller at the email address above. The controller normally has one month to respond.

You may also complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria.

The local handwriting bank can be deleted immediately in the studio with “Forget my handwriting”. Because it never reaches the operator, the operator cannot inspect or remotely delete the copy on your device.

Automated decisions and profiling

The application makes no automated decision about a person and performs no profiling.

Changes to this information

The date at the top identifies this version. The notice will be updated before the product's data flow changes.