Skip to content

Privacy

Last updated October 14, 2026

The short version

Your thoughts belong to you. We do not run ads, sell your data, or track you across other apps and websites. There is no analytics or advertising code in ThoughtFree at all. You can use the app without an account, export everything at any time, and delete your account and its data yourself.

Without an account

Signed out, ThoughtFree works and nothing you write leaves your device. Notes, diary entries, tracker data and settings live in the app's own storage. Delete the app and that data goes with it. The AI features are the exception: they run on our servers, so they need an account and are simply absent until you sign in.

With an account

Signing in turns on sync. Your notes, diary entries and attachments are stored on our servers so your devices can stay in step. Access is restricted to your own account. We use Supabase for accounts and storage, and PowerSync to move changes between devices. You can sign in with an email code or with Google. If you use Google, we receive your email address, name and profile picture, and nothing else from your Google account.

To be straight with you: this is not end to end encrypted. Your data is encrypted in transit and at rest, but we hold the keys, so we could technically read it and we do not except when we have to operate or repair the service. If you want writing that nobody but you can ever open, keep it on a signed-out device, where it never leaves the phone.

AI features

AI is on when you sign in, and one switch turns it off: Settings, then AI, then Use AI.

With AI on, some of it runs by itself. Each new thought, and its first photo, is sent to a model to file it, tag it and sum it up. Your thoughts and saved web pages are added to the search index behind Brain. Voice transcripts have their punctuation tidied. A new category gets an emoji picked from its name. The rest runs when you ask: Brain, research, merging thoughts, suggesting a category, a weekly insight, a painted book cover, and automations you set up.

With AI off, none of that happens and no model receives your writing. The search index is deleted, and built again if you turn AI back on. Summaries and tags already made stay on your thoughts until you edit them. Voice notes are still turned into text by Deepgram, which keeps nothing.

We send your writing to a provider only to return the result, and we do not use it to train anything. Every request asks for zero data retention: it goes only to model providers that keep nothing and train on nothing. The list below says which provider receives what.

Your diary and AI

No AI model ever receives what you write in your diary, including anything about sleep, money, food or how a day went. Weekly insights are made from thoughts only. Our servers do not read your diary; they only add to it, when you ask an automation to file thoughts there. This is enforced on our servers and checked by our tests, not left to a setting.

Diary voice clips are the one exception: Deepgram turns them into text, keeps nothing, and the text goes into your diary.

Health data

If you connect Health Connect on Android, ThoughtFree reads sleep, workout and drink entries on your phone and sends them to our server, which files them into your diary. This keeps your diary up to date even when the app is closed. From then on they are part of your diary, synced like any diary entry and never sent to AI. The copy used for filing is cleared once it has been filed. Health data is never shared with anyone else or used for advertising.

Services you connect

Google Calendar, Todoist and Notion connect only if you ask them to, and exchange only what the feature needs. Once Google Calendar is connected, each thought you schedule is copied there, with its full text. Access tokens are held on our servers, encrypted, never sent to your devices, and destroyed when you disconnect or delete your account.

Payments

Subscriptions are handled by RevenueCat and Stripe. They receive your payment details; we never see or store a card number. What reaches us is whether your account is on the free or paid plan, and when the plan renews.

Who processes your data

  • Supabase. Accounts, and the synced copy of your notes, diary and attachments. Stored in Frankfurt, Germany.
  • PowerSync. Moves those changes between your devices. EU region.
  • Deepgram. The audio of voice notes and diary voice clips, to turn speech into text. Processed in the EU and kept for no time at all. This happens with AI on or off.
  • OpenRouter. With AI on: the text of each new thought and its first photo, to file, tag and sum it up; voice transcripts, to tidy punctuation; and the thoughts you use Brain, research, merge or a book cover on. It passes them only to model providers that keep nothing and train on nothing, preferring servers in the EU where the model has them. OpenRouter itself runs in the US and does not store your text. Never a diary entry.
  • OpenAI. With AI on: the text of your thoughts and saved web pages, and your Brain questions, to build and search the index behind Brain. Not used for training. OpenAI keeps API requests for up to 30 days to check for abuse, and runs in the US.
  • Replicate. With AI on, when a book gets a painted cover: a scene description the AI wrote from the book. Deleted within an hour.
  • Web search. When you run research: the question, sent through OpenRouter to its web search partner.
  • Resend. Books, digests and insight emails, with the address they go to. Kept for 30 days, in the US.
  • Amazon. A book you send to Kindle, delivered to your Kindle address.
  • Google Firebase. Delivers push notifications. Carries the notification text, such as a reminder's title.
  • Google Calendar, Notion and Todoist. Only if you connect them. Google Calendar receives the title, text and summary of thoughts you schedule. Notion and Todoist receive what you send them.
  • Websites you link to. When a thought contains a link, our server fetches that page to build a preview, and your device loads its image. The site's icon comes from Google's favicon service, which sees the site's address.
  • AI assistants you connect. If you create a key for an assistant such as Claude, it can read and change your thoughts through that key, under that assistant's own terms. Revoke the key in Settings to stop it.
  • Sentry. Crash reports, when the app or a server function fails. Stored in Frankfurt. Scrubbed before sending: no screenshots, no screen contents, and no thought or diary text. It receives the error and where in the code it happened.
  • Grafana. Daily totals that keep the service healthy, such as how many captures and AI calls there were. Totals only, never content.
  • RevenueCat and Stripe. Handle subscriptions. They receive payment details, we do not.

Export and deletion

Export your data as Markdown or JSON at any time from Settings. The export is a file handed to you, not uploaded anywhere. Deleting your account from Settings removes your account and the data attached to it, including attachments, recordings and any tokens for services you connected. Export first if you want a copy, because deletion is final.

What we measure

The app contains no analytics or tracking code. To keep the service running, our servers count things: how many captures and AI calls there were each day, and how many failed. These go to our dashboards as totals, never with content. For each AI call we also record which feature and model it used and its size, so we can see costs and limits. That record holds no text and is deleted after 35 days. You can read your own record in the app, under Settings, then AI, then AI activity: each request, when it was made, what for, which service and model it went to, and which thought it was about.

What we never do

No advertising. No selling or sharing your data with data brokers. No analytics or tracking code in the app. No reading your writing except to give you back the result you asked for, or to run a feature you have turned on.

Changes

If this policy changes in a way that affects what leaves your device, we will say so before the change takes effect rather than after.

Questions

Write to hello@thoughtfree.io.