InkMirage

InkMirage account privacy notice

This page is not legal advice.

Last updated: 4 October 2026

Who collects

The account service at https://account.inkmirage.xyz is operated by one person under the name InkMirage. Contact: support@inkmirage.xyz. https://inkmirage.xyz is the site.

What the account service does

It gives you one InkMirage account for sign-in, product keys, invites, project membership and usage across InkMirage products (Endleaf and SysMLEdge).

Sign-up is by invite. Invite keys issued directly by each product still work, and using an account is not the default way into a product yet.

What we handle, and why

Your account

  • Email address. We store it with an account ID and the date the account was created. It is how you sign in and how we reach you.
  • Sign-in by email link. When you ask to sign in, we email you a single-use link that lasts 30 minutes. We store only a hash of the link's code.
  • Sign-in with Google. If you choose Continue with Google, Google tells us your email address and whether Google has verified it. We ask Google for your email only. We keep the email address and nothing else from Google.
  • Sessions. When you sign in we create a session that lasts 12 hours. We store only a hash of the session code.

Invites

  • An invite record holds a hash of the invite code, the product, when it expires, how many times it can be used, and any promotional plan and its dates. If we send the invite to a named person, the record also holds that email address, and only that address can claim it.

Product keys

  • When you create a key for a product, we store a hash of the key, a key ID, a short fingerprint, the product, its permissions, when it was issued and whether it is active, rotated or revoked. The key itself is shown to you once and is not stored.
  • When you create, rotate or revoke a key, we record the action with a salted hash of your IP address, not the address itself.
  • When we act on your account (for example, assigning a plan, creating an invite or ending a session), we record who did it, what changed, the reason and the time.

Project membership

  • For SysMLEdge projects we record the project, the owner's account, the member's account, the role (owner, editor or viewer), whether sharing is active or revoked, and whether access came through an invite key or the account.

Plans and usage

  • We record which plan applies to your account for each product (free, or a promotional plan with start and end dates) and any extra allowance we grant you, with the reason.
  • For Endleaf we record how many jobs your account used each UTC day. Each report from Endleaf carries your account ID, a report ID and a count, and we keep the result of applying it to your daily quota. It never includes your documents.

What products receive from us

  • When a product checks one of your keys, we tell it your account ID, the product, the key's permissions, your plan, your limits and, for Endleaf, today's usage. We do not send your email address.
  • When SysMLEdge asks about project membership, we return the membership record only.

We use this data to sign you in, issue and check keys, apply plans and limits, and manage invites and project access.

Cookies

The account service uses only cookies it needs to work. All are HttpOnly.

  • im_session: keeps you signed in. Lasts 12 hours.
  • im_form: protects sign-in and invite forms. Lasts 30 minutes.
  • im_google: protects a Google sign-in while it is in progress. Lasts 10 minutes.

No analytics.

How long we keep it

  • Sign-in links: valid for 30 minutes. Sessions: valid for 12 hours. Signing out ends your session. Cookies last as already stated.
  • Account, keys, invites, membership, plan, usage, and security records: our code sets no fixed period.

Who else receives data

  • Cloudflare carries all traffic to account.inkmirage.xyz.
  • Resend delivers sign-in emails and invite emails. It receives your email address and the link.
  • Google is involved only if you choose Continue with Google.
  • InkMirage products (Endleaf and SysMLEdge) receive the key check and membership answers described above.

The account service takes no payment today. Checkout is not live, and the service does not store card numbers.

Leaving Taiwan

Cloudflare carries the traffic, Resend sends the email, and Google processes the sign-in only if you choose it. Those providers process the data outside Taiwan.

Other people

An invite or a project membership can name another person. We use that only to run the invite or the membership.

If you refuse

Without an email address there is no account. Google is optional; an email link still works. Without a key a product cannot check access.

How to ask

Email support@inkmirage.xyz to ask what we hold or to ask for removal.