Last updated: 4 October 2026 Effective date: 4 July 2026
This Privacy Policy explains how think-app Pty Ltd ("THINK", "we", "us", "our") collects, uses, shares, and protects personal information when you use the THINK mobile application and related services (the "Service"). THINK is an anonymous yes/no sentiment social app: you vote on questions, comment, follow people, meet people near you, message others, play the Like-Minded Quiz with a friend over a live video call, and can talk to Think AI, THINK's voice guide, about what the world thinks.
If you do not agree with this Policy, please do not use the Service.
The data controller responsible for your personal information is:
think-app Pty Ltd[JURISDICTION OF INCORPORATION][BUSINESS ADDRESS][DPO CONTACT] — or email founder@think-app.com[EU REPRESENTATIVE NAME & ADDRESS][UK REPRESENTATIVE NAME & ADDRESS]Lawyer note: if THINK has no EU/UK establishment but offers the app to people in the EU/UK, you likely must appoint an Art. 27 representative in each region. Confirm and fill in.
An account is required to use THINK. There is no anonymous browsing or auto-created guest session — you create an account with an email and password, or by signing in with Apple (Google sign-in is planned but not yet offered), before you can vote, comment, or use any feature.
"Anonymous" in THINK describes two specific, narrower things, not the account itself:
Signing in with Apple may give us a relay email address (via Apple's "Hide My Email") instead of your real one — see Section 18.
| Data | When / why |
|---|---|
| Username/handle, display name, initials | Created at onboarding; shown publicly with your content. |
| Email address | Only for "saved" accounts (email/password, Google, or Apple sign-in). Used for login, account recovery, and required service emails. |
| Password | For email/password accounts. Stored only as a salted hash by our authentication provider — we never see your plaintext password. |
| Profile photo OR short looping video avatar | Optional. Uploaded to our avatars storage bucket and shown publicly on your profile. |
| Voice context on a question (audio, up to ~30 seconds) | Optional. When you submit a question you may record a short voice clip to give it context; it is stored and played alongside the question. See Section 6 (Voice data) — this is a sensitive category. |
| Voice intro in THINK Meet (audio, up to 30 seconds) | Optional. When you go live in THINK Meet you may record a short intro so people can hear you before inviting you. It is attached to that live session only and is removed when the session ends. See Section 6 (Voice data). |
| Yes/No sentiment votes | Your votes on questions. The split is shown in aggregate; votes drive your "Like-Minded" matching. |
| Questions you ask / submit for publishing | Public. Note: "anonymous questions" hide the author's identity from other users, but we still associate the question with your account internally. |
| Comments and replies; comment up/down-votes; content reports | Public (comments/replies). Your comment up/down-votes also feed Like-Minded matching — reacting the same way as another person to the same comments (both up, or both down) signals alignment; reacting oppositely signals the reverse. |
| Follows / follow requests | Who you follow / who follows you. For private accounts, a follow request is recorded until the other person approves it. |
| In-person meets (THINK Connect) | Optional. When you meet another user in person by scanning their QR code, we record that a meet happened, the other user's ID, and the timestamp. Used to award Ripples and as a strong Like-Minded signal. No Bluetooth, proximity, or location data is collected — the meet is confirmed solely by scanning a code. |
| Like-Minded Quiz | Optional. When you play the quiz with another user (passing one phone, or live on two phones by scanning a QR code or challenging a connection), we record each player's yes/no answers, the topic, the resulting score for that pair, who played whom, and (in a live session) which question card is currently shown. In live play, the two players see each other's answers as they are revealed. Your first completed quiz with a given person counts toward your Like-Minded score with them; replays are just for fun and do not change it. Challenging a connection sends that person an in-app notification. |
| Live video quiz call | Optional. A live quiz can be played over a video call between the two players. The call exists only if the host asks for video and the guest accepts with video; either one declining means no call, and the quiz still works without it. Your camera and microphone are on only during the call, and only while THINK is in the foreground; putting the app in the background pauses both. The call runs through Daily.co in a private room for exactly two participants; the room and both join tokens expire with the session, and the session is capped at up to 20 minutes. We do not receive or keep the call audio or video unless you both choose to record (next row). The on-screen connection indicator and the "Use less data" control change your own video quality on your device and send nothing to us. See Section 5.8. |
| Quiz call recording ("Keep this call") | Optional, and only with both players' in-app consent. During the discussion part of a live call, either player can propose recording; nothing is recorded until both have agreed in the app. A 30 second clip is available to everyone; recording the full discussion is a THINK+ benefit and the server checks that entitlement, never the phone. The recording is made by Daily.co's cloud recording of the two camera tiles and is held there; the question screen is not recorded. Both players can download and share the file. See Section 5.8 and Section 6. |
| End-of-call compliments and reports | Optional. After a live quiz you can leave positive-only compliment chips for the other player (stored against the match, currently shown to nobody) and, separately, report the other player with a reason and a short note. Reports go to our moderation queue tagged with the match, like any other report. |
| Think AI conversations | Optional. When you open Think AI, THINK's voice guide, and speak or type to it, we process your voice while that screen is open, the transcript of both sides, and anything you type to it, together with the app's language setting, your first name and handle (so it can greet you and know who "you" means), and the THINK data it looks up to answer you. We keep no audio and no transcript after the session; we keep a small usage log (Section 3.2). See Section 5.1. |
| Direct messages / conversations | Private 1:1 messages between you and another user. See Section 8 on how we access these. |
| Interests / topics | Chosen at onboarding to personalise your feed. |
| Optional demographics | Birth year, country, gender, political stance. Never required; not shown publicly; used for aggregate sentiment context and age-gating. Some of these (e.g. political opinion) may be special-category data under GDPR — see Section 4. |
| Bio and social links | Optional, public. Handles you enter for other platforms (Instagram, TikTok, X, YouTube, LinkedIn, a website) are shown on your profile to other people, so they can find you elsewhere. They are never required, and they are not shown on your own view of your profile. |
| "Your People" (your close circle) | Optional. A private list on your side of people whose answers you want to see at a glance, with an optional private label you choose (for example "Mum"). The other person is never told they are on your list, and never sees your label for them. Adding someone also follows them (or sends a follow request if their account is private), exactly as pressing Follow would. Whether you can actually see how they answered is decided by their "Share voting history" setting, not by this list. Anyone who joins THINK using your invite link is added to your list automatically; you can remove anyone at any time. |
| Reports / appeals / support messages | When you contact us or appeal a moderation action. |
| Data | Source / purpose |
|---|---|
| Account identifier (uid) | Assigned to every account on creation. |
| Approximate country, locale, timezone | Derived on-device from your system locale and timezone (no GPS involved). Stored on your profile (country, locale, timezone) for aggregate "how the world feels" context. |
| Coarse location (city, region, country, area) | Some features ask for the device's when-in-use location permission. You can decline; those features simply do not run and the rest of THINK is unaffected. When you use one, the app takes a single GPS reading and converts it to a place name on your device. The coordinates are then discarded and are never sent to us or stored. Only the resulting place text leaves your device: • THINK Meet — while you choose to be "live", we store your city, region, country and a coarse area name (a suburb or district, e.g. "Newstead"). Who can see whom is decided on the city alone; anyone signed in and browsing Meet in your city can see your line while you are live. It is deleted when you go offline and expires automatically after 4 hours. Browsing Meet without going live sends your city name with the request so we can show you who is live there; it is used for that lookup only and not stored. • THINK Places "near me" — used to sort nearby lobbies at the moment you search; not stored. • THINK+ Local mode — your city only, to show comments and voices from where you are. The map in THINK Meet does not show people. It draws a circle over an area, and everyone live in that area sits on the same single point at its centre. Nobody is given their own position, and an area holding fewer than two live people is not drawn separately. We never store, and therefore cannot show, anyone's street or address. Separately, a lobby you create has a meeting place you type in yourself, and its coordinates are stored — that is a venue, not a person, and it is shown only to people you accept into the lobby. |
| Last-seen timestamp / activity signals | Vote velocity, listen counts, engagement events — used for ranking and product analytics. |
| Questions you skip | When you swipe a question away on the Explore deck we record that you dismissed it, so we stop showing you the same one. It is a list of question IDs against your account and is used for nothing else. |
| Think AI usage log | One row per Think AI session, typed turn or data lookup, holding the start time, how many seconds a voice session ran, why it closed (you tapped Done, silence, the app went to the background, the daily cap, a dropped connection), and cache counters. It exists to enforce the 3 minutes a day free allowance and the 15 minutes a day THINK+ allowance, the 10 minute hard cap per session, and rate limits. It never holds what you said. |
| Device & technical data | Standard log/connection data needed to operate the app (e.g. IP address used to make requests, app version, error/crash diagnostics). |
| Push notification token | Optional. If you allow notifications, the device push token issued by Expo is stored against your account (push_tokens, with platform and last-seen time) and sent to Expo's push service to deliver notifications such as new direct messages and quiz invites. Turning notifications off in Settings stops device push; the token is deleted with your account. |
| Crash reports | If the app hits an error, a short record (what failed, the app version, iOS or Android, the time) is sent to us so we can fix it. It carries no name, account or device identifier. |
Engineering note for the lawyer: country/locale/timezone come from
recordOrigin()via the device'sIntlsettings. Location permission IS now requested (when-in-use,NSLocationWhenInUseUsageDescription) for THINK Meet, Lobby "near me" and THINK+ Local mode. In every casegetCurrentCoords()takes one fix which is reverse-geocoded on device;detectPlace()returns only{city, area, region, country}and the latitude/longitude are dropped before anything is transmitted. There is no coordinate column onmeet_presence, and no distance between people is computed anywhere. The Meet map derives each circle's position from the stored area name via a place-name lookup, so every member of an area shares one point. Lobby venues do store coordinates (lobbies.lat/lng) because a venue is a place, not a person. THINK Connect remains QR-code only (no Bluetooth, no proximity/RSSI). The App Store privacy label must now declare Coarse Location — seelegal/APP_STORE_PRIVACY_LABELS.md.
THINK+ can be bought in two places: in the app, where Apple processes the payment through the App Store, or on our website (think-app.com), where Stripe processes it. We never receive or store your full card number; Apple or Stripe does.
For a subscription bought on our website we store your Stripe customer identifier, your subscription status and renewal date, the price paid, the tax (GST) and payment-processing fee on each payment (for our accounting), and, if you used one, the promotion code. Stripe Tax collects your billing country and postcode to work out the right tax. For a subscription bought in the app we store Apple's subscription identifier and its renewal date.
If you arrived through a partner's code (for example a creator's link), we record which code brought you. The partner sees only counts and amounts (how many people joined or subscribed through their code and the revenue share owed), never your name or email.
When you delete your account we cancel any website subscription immediately and delete your Stripe customer record. Stripe and Apple keep their own payment records where the law requires them to. Stripe's handling of your payment data is governed by Stripe's privacy policy, and Apple's by Apple's.
Engineering note for the lawyer (28 Sep 2026): the earlier Apple question is answered. Web sales follow App Store Guideline 3.1.3(b) (Multiplatform Services): the app unlocks THINK+ bought on the web, sells it itself only through In-App Purchase, and contains no link, price or call to action pointing to the web purchase. See
docs/WEB_PLUS_STRIPE_PLAN.mdsection 4.
Where GDPR or UK GDPR applies, we rely on the following legal bases (Art. 6):
| Purpose | Legal basis |
|---|---|
| Creating and running your account; delivering core social features (votes, feed, follows, comments, messages) | Contract (Art. 6(1)(b)) |
| Voice recordings, profile photo/video avatar, and other optional content you choose to post | Consent (Art. 6(1)(a)) — given by choosing to record/upload; withdrawable by deletion |
| Think AI (voice guide), AI fact-check and summaries, and AI moderation of content | Contract (Art. 6(1)(b)) for the Think AI, fact-check and summary features you actively open; consent (Art. 6(1)(a)) for the microphone, given through the system permission prompt and withdrawable in your phone's Settings; legitimate interests (Art. 6(1)(f)) for keeping the community safe |
| Live video quiz calls | Contract (Art. 6(1)(b)) for the call you and the other player both chose; consent (Art. 6(1)(a)) for the camera and microphone via the system prompts |
| Recording a quiz call | Consent (Art. 6(1)(a)), given by both players in the app before anything is recorded; withdrawable by not agreeing, or by deleting your account |
| Safety, anti-abuse, ban enforcement, fraud/bot prevention | Legitimate interests (Art. 6(1)(f)) and legal obligation where applicable |
| Email verification, security, account recovery | Contract and legal obligation |
| Marketing/optional analytics, optional push notifications | Consent (Art. 6(1)(a)) |
| Processing payments and managing subscriptions | Contract (Art. 6(1)(b)) |
Special-category data (Art. 9): Some optional information you may provide or generate — notably political opinions (the optional "political stance" field), and potentially voice recordings to the extent they are used to uniquely identify you — can be "special category" data. We process such data only with your explicit consent, or another Art. 9 condition, and you can delete it at any time. Do not provide special-category data you don't want processed.
Lawyer note: confirm the legal basis for AI processing and whether explicit consent (not just legitimate interests) is needed for (a) voice recordings, (b) the political-stance field, (c) streaming live microphone audio to OpenAI for Think AI, and (d) the Daily.co call and its optional recording. A balancing test/LIA should be documented for any legitimate-interests basis. The microphone is used only after the system microphone prompt is granted, and the guide can also be used by typing, with the microphone off.
THINK uses AI in several places. We want to be transparent about this because it involves sending content to third-party AI providers. In every case we send only the minimum content needed for the feature, the provider is chosen and called from our servers (your phone connects to OpenAI's voice service directly for Think AI, but only through a session our server created; no provider key is ever in the app), and results are cached and reused where possible so the same content is not repeatedly sent.
Think AI is switched off in the app as of 15 September 2026. Nothing in this section is collected while it is off; it stays here so you know what happens the day it returns.
Think AI is a voice you can talk to, or type to, about THINK's sentiment data: what the world thinks about a topic, how a question splits, how that has moved over time, how different groups answered, the strongest case on each side, what people in your own circle voted, and how THINK itself works. It is read-only: it cannot post a question, vote, follow, invite or change anything on your account.
Provider. Think AI runs on OpenAI. Spoken conversation uses OpenAI's realtime voice model (GPT-Live-1) over a direct, encrypted WebRTC connection from your phone to OpenAI; typed questions use an OpenAI text model through our server. Both are driven by the same instructions and the same fixed set of THINK data lookups, and neither has web search.
What is sent to OpenAI.
What we keep. We keep no audio and no transcript. We keep a usage log per session (Section 3.2: seconds, close reason, cache counters) to enforce the free allowance, the per-session cap and rate limits, and a short-lived cache of aggregate answers (60 seconds for a question's split and context, 10 minutes for searches, rankings, comparisons, demographics and topic answers, one hour for trends) so that many people asking the same thing does not mean many model calls. That cache holds aggregate data only; your own vote and your circle are never cached, and a cached answer is re-used only if every number in it still matches the live data.
Limits. 3 minutes of voice a day on the free tier and 15 minutes a day on THINK+, a 10 minute hard cap on any one session, 12 sessions an hour and 8 typed turns a minute. The caps are decided on our server before anything is sent to OpenAI.
Retention at OpenAI. Typed turns are sent with OpenAI's "do not store" flag. For the voice session we have not verified a retention setting in the integration, so OpenAI's handling of the audio and transcript is governed by OpenAI's API data usage policy and our agreement with them; under that policy API data is not used to train OpenAI's models. We will update this section if we obtain a zero-retention arrangement.
Lawyer note: verified against branch
voice-guideon 13 September 2026:supabase/functions/guide-session/index.ts(the two OpenAI endpoints, JWT check, caps decided server-side,store: falseon the typed Responses call,usageclose reasons),supabase/functions/_shared/guide.ts(modelsgpt-live-1andgpt-5.6-luna, the tool list with no web search, the "no medical, legal or financial advice" and "never a name" instructions, the handle and first name in the instructions),supabase/functions/_shared/guideTools.ts(forModel()strips ids, names, handles and avatars from circle results;runToolCachednever cachesmyVoteor the circle),supabase/migrations/20260912150000_guide_usage_and_cache.sql(guide_usage,guide_cache, TTL capped at 3600 s, both cascade onauth.usersdelete) andsrc/screens/voice/useGuide.ts(AppStatebackgroundcloses the session).docs/VOICE_GUIDE.mdon that branch says "retention off on the audio" as a plan and "verify the delegation shape first"; no code or account setting confirming zero data retention at OpenAI was found, so this policy does not claim it. Please confirm the OpenAI data processing addendum and whether a zero-retention option has been enabled on the account.
When you choose to fact-check a comment, we send that comment's text to Anthropic (Claude) to assess its main factual claim and return a verdict. When a question's discussion is summarized, we send a sample of its comments (with the question text and aggregate vote signals) to Anthropic (Claude) to produce a neutral both-sides summary. Both results are cached per comment / per discussion and reused, so the same content is not sent again on later views.
To enforce our zero-tolerance policy on bullying, harassment, hate, threats, and doxxing, an automated moderation agent periodically sends recent comment text and the associated author account id to Anthropic (Claude) to assess whether content violates our rules and to propose an enforcement action on our ban ladder (warning → hide → 3-day → 7-day → 30-day → permanent ban). Most actions are reviewed by a human before they take effect ("review-first"); some configurations may act automatically with after-the-fact human review/appeal.
Automated decision-making (Art. 22 GDPR): Where a ban or content removal is applied automatically with no human in the loop, this may be a decision with legal or similarly significant effects. You have the right to request human review and to appeal — see Section 13. The dashboard and appeal process are designed to provide this.
Active: the "read this question aloud" accessibility feature uses ElevenLabs (text-to-speech). What is sent is only the published question text itself — editorial content already visible to every user. No personal data is ever sent: not your name or account details, not your comments, not your voice recordings, and nothing about who pressed play. Each question's audio is generated once, stored on our own servers, and every later playback is served from our copy — pressing play never contacts ElevenLabs. If the service is unavailable, your device's built-in voice is used instead (fully on-device).
Think AI is separate from this. Think AI's speech recognition and spoken replies are handled end to end by OpenAI's voice model, as described in Section 5.1; ElevenLabs is not involved in Think AI, and OpenAI is not involved in reading questions aloud.
On the question screen you can shake your phone to open a "report a problem" sheet. Shake detection uses the device's accelerometer entirely on your device: motion readings are checked in memory to recognise the gesture and are never recorded, stored, or transmitted — to us or to anyone. If you then choose to send a report, we receive only the text you write plus which screen/question you were on.
| Sub-processor | Role | Data it may receive | Region |
|---|---|---|---|
| Supabase | Hosting, database, authentication, file storage, serverless functions | Substantially all account and content data | Australia (ap-southeast-2) — confirmed via Supabase project dashboard, 2026-07-01 |
| Anthropic (Claude) | Fact-check; discussion summaries; AI moderation | Comment text; a sample of a discussion's comments with the question text and aggregate vote signals; comment text + author id (moderation) | US |
| OpenAI | Think AI, THINK's voice guide (realtime voice over WebRTC, plus a text model for typed turns) | Your microphone audio while the Think AI screen is open, the transcript, typed questions, the app language, your first name and handle, and the aggregate THINK data the guide looks up (Section 5.1). Never other people's names, handles, ids or avatars. | US |
| Daily.co | Live video calls for the Like-Minded Quiz, and the optional cloud recording of a call | Your camera and microphone streams during a call you both accepted; your account id as the participant id; the recording, if both players agree (Section 5.8) | US |
| ElevenLabs (speech provider) | Text-to-speech for the question read-aloud accessibility feature | Published question text only (editorial content, generated once per question and cached on our servers). Never your personal data, comments, or voice recordings. | US |
| Google Translate | On-the-fly translation of the app interface, World/anonymous question text so anyone can understand it in their language. Comments are NOT auto-translated — they are sent only if you press-and-hold a specific comment to translate it. | The text being translated: interface strings, question text, and (only on explicit request) a single comment | Global |
| Stripe | Website subscription payments, tax (Stripe Tax), billing portal | Email, payment data, billing address (country, postcode), promotion code, subscription status | Global |
| Apple / Google | Optional sign-in; app distribution; iOS in-app-purchase receipt validation | Authentication tokens; basic profile from sign-in; IAP receipt | Global |
| Google AdMob | Serving ads in the free tier (THINK+ members see no ads) | Non-personalised ads only. Every ad request is sent with Google's non-personalised flag, so ads are chosen from context and coarse signals (app, device type, approximate region, language), not from a profile of you. THINK does not request App Tracking Transparency and does not use the advertising identifier to track you across other companies' apps or websites. The AdMob SDK receives ad-interaction events (which ad was shown or tapped) and device diagnostics (crash, performance and other diagnostic data) that are not linked to your identity. | Global |
| Expo / EAS | App build (production builds + OTA); push notification delivery | Build artifacts from the EAS toolchain, and device push tokens relayed to Expo's push notification service to deliver notifications | Global |
A current, complete list of sub-processors is available on request at founder@think-app.com.
The Like-Minded Quiz can be played live on two phones, and optionally over a video call.
Lawyer note: verified 13 September 2026 in
supabase/functions/quiz-video/index.ts(privacy:'private',max_participants:2, roomexptied to the session cap,eject_at_room_exp, per-user meeting tokens,recordrefused unlessrecordConsentis true for both players,quiz_video_claim_recordingdecides clip versus full viais_plus_now,downloadfetches a Daily access link),src/screens/like-minded-quiz/VideoQuizSession.tsx(media off whenAppStateis not active, screen-capture guard,updateSendSettingsfor data saver, the "Your question screen is not recorded" copy),src/lib/quizVideo.ts, and the migrations20260909010000_quiz_video_sessions.sql,20260911120000_quiz_video_recording_kind_and_events.sql(clip 30 s, full up to 600 s, THINK+ check) and the pending20260912100000_quiz_live_invite_flow.sql(video_accepted := video_requested and p_video; cap 10 minutes, 20 when either player has THINK+;quiz_match_reviews;quiz_match_reportintomoderation_queue). Today's applied cap is a flat 20 minutes from the session's creation; once the pending migration lands it becomes 10 minutes, or 20 when either player has THINK+. "Up to 20 minutes" is true under both. The recording file lives at Daily.co, not in our own storage. Since 2026-09-14 thedelete-accountfunction deletes the Daily.co recordings of every quiz match the person was in (best-effort, either participant's deletion removes it); nothing yet deletes a recording after a period, so please advise on a retention period and confirm Daily.co's own retention terms and DPA.[Recommended: maintain a public sub-processor list and notify users of changes.]
Note on translation: translation calls Google Translate from the device. By design we translate only the interface and question text (so anyone worldwide can understand a question in their language). Comments are never sent automatically — a comment is translated only when you press-and-hold it to ask for a translation, the same way Instagram works.
The voice context on a question and the voice intro in THINK Meet are short audio recordings of your voice. Think AI streams your voice to OpenAI while you talk to it (Section 5.1), and a live quiz call can be recorded when both players agree (Section 5.8). A recording of your voice can be sensitive. Some laws treat a "voiceprint" — a biometric identifier derived from voice — as biometric data with strict consent and notice requirements. In particular:
THINK's current practice: we store and play back your voice recording as audio content, and Think AI uses your voice only to understand what you are saying in that conversation. We do not currently create a voiceprint or use voice for biometric identification or recognition, and we do not ask our providers to. If this ever changes (for example, voice-based identity verification or speaker recognition), we will obtain explicit, informed consent and provide the required notices and retention schedule first.
Lawyer note (high priority): even storing/playing voice audio can attract argument under BIPA-style statutes. Decide whether to (a) add an explicit voice-recording consent screen, (b) publish a voice-data retention/destruction schedule, and (c) consider geofencing or extra notices for Illinois/Texas/Washington users. This is a cross-border litigation-risk area.
We do not sell your personal information for money. See Section 11 for how "sale"/"sharing" is defined under California law.
Direct messages are private between you and the other participant and are protected by access controls. They are not end-to-end encrypted. We may access message content where necessary to operate the Service, investigate abuse or safety reports, comply with law, or where required to enforce our Terms. Do not share information in DMs that you would not want us, in limited and justified circumstances, to be able to access.
Lawyer note: confirm whether DMs are excluded from AI moderation. As built, the moderation agent scans comments, not DMs — verify and state this accurately.
We share information:
We do not share your personal information with advertisers for cross-context behavioural advertising. (Confirmed 2026-07-01: no ad/attribution SDK is present in package.json or the build. Re-verify if one is added later — see Section 14.)
THINK relies on providers (e.g. Supabase, Anthropic, OpenAI, Daily.co, ElevenLabs, Stripe, Apple, Google) that may process data in the United States and other countries outside your own. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and, where applicable, the EU–US Data Privacy Framework, plus supplementary measures as needed. You may request a copy of the relevant safeguards at founder@think-app.com.
Lawyer note: regions confirmed above (Supabase → Australia
ap-southeast-2; Anthropic → US). OpenAI and Daily.co are US companies; their processing region for our account has not been confirmed from the code. Please ensure SCCs/DPAs are in place for each transfer (Section 3 of DATA_PROCESSING_NOTES.md).
Subject to applicable law, you may have the right to:
California (CCPA/CPRA) rights. California residents may request to know/access, delete, and correct personal information, and to limit use of sensitive personal information. You also have the right to opt out of the "sale" or "sharing" of personal information and the right not to be discriminated against for exercising your rights.
Sensitive personal information (CPRA). This may include precise account credentials, the contents of your messages, and (optionally) your voice recordings and political stance. We use sensitive information only to provide the Service and for permitted purposes, not to infer characteristics about you.
You can permanently delete your account from within the app (Settings → Delete account). This runs our delete_my_account process, which removes your profile, votes, questions, comments, follows, messages, and all uploaded files (your voice audio and avatar image/video) from our storage, and deletes your authentication record. Deleting the profile also removes your quiz matches and with them every live session row (answers, consents, the recording record, compliments and reports tied to the match), and deleting the authentication record removes your Think AI usage log and any personal cache rows.
Quiz call recordings are held by Daily.co (Section 5.8). Deleting your account removes our record of the recording and the download path, but does not by itself erase the media file at Daily.co; email founder@think-app.com and we will have it removed.
Lawyer note:
quiz_matches.host_user/guest_userreferenceprofileswithon delete cascade(20260719010000_live_quiz_matches.sql), andquiz_video_sessions,quiz_video_recordings,quiz_match_reviewscascade from there.guide_usageandguide_cachereferenceauth.userswithon delete cascade(20260912150000_guide_usage_and_cache.sql), anddelete-accountcallsauth.admin.deleteUser. Nothing calls Daily.co's delete-recording endpoint on account deletion today; that is a gap to close in code, and the sentence above is written so the policy stays true until it is.
Deletion is permanent and cannot be undone. After deletion, some information may persist for a limited time in:
[STATE BACKUP RETENTION, e.g. 30 days]).Content you sent to third parties (e.g. AI providers) is handled under their retention terms; we rely on their commitments to delete or not retain such data — see Section 5.
To request deletion or any other right, email founder@think-app.com or contact [DPO CONTACT].
Email founder@think-app.com (subject: "Privacy Request"), or use the in-app controls where available. We will verify your request (typically via your account email) and respond within the timeframes required by law (generally within 30 days under GDPR/UK GDPR and 45 days under CCPA/CPRA, extendable where permitted). You may use an authorised agent where the law allows.
To contest an automated moderation decision (e.g. a ban), reply to the enforcement notice or email us; a human will review your appeal.
THINK is primarily a mobile app and does not rely on advertising cookies. The app and any related web pages (e.g. checkout, marketing site) may use:
Strictly necessary storage (e.g. to keep you signed in / store your session).
Authentication flows that open a system browser for Google/Apple sign-in.
No third-party crash/diagnostics SDK is used at launch (no Sentry, Bugsnag, Crashlytics, or Datadog in the build — confirmed 2026-07-01). Only standard server/API operational logs are kept.
Advertising SDK. The free tier of the iOS app shows ads through Google AdMob (Section 5.7). Every ad request is made in non-personalised mode: THINK does not ask for App Tracking Transparency permission, does not share the advertising identifier for cross-app tracking, and does not build an advertising profile of you. THINK+ members see no ads at all.
We do not use cross-context tracking SDKs, and we do not sell or "share" (in the CCPA sense) your personal information for cross-context behavioural advertising. (Updated 4 October 2026 to reflect the non-personalised advertising decision of 25 September 2026. If a personalised-ads, analytics or attribution SDK is ever added, this section, the App Store labels and the CCPA disclosures change in the same release, and a consent prompt is added where required.)
We keep personal data only as long as needed for the purposes above:
We protect your data with measures including encryption in transit, access controls, row-level security on our database, server-side handling of all AI/API keys, salted-hash password storage by our auth provider, and security reviews before releases. No system is perfectly secure; we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and regulators as required by law.
THINK is a social app with user-generated content, public voice recordings, and direct messaging, and is not intended for young children.
Lawyer note: Decided — global minimum age 16+, server-enforced (see above; no minors mode is offered). Please confirm this satisfies UK Children's Code obligations for our markets and that no additional notices are needed.
If you believe a child has provided us personal data, contact founder@think-app.com and we will delete it.
If you sign in with Apple, that provider authenticates you and shares limited profile information (e.g. email, name) with us per your settings. Apple "Hide My Email" may give us a relay address instead of your real email. Google sign-in is planned but not yet offered in the app. Your use of these providers is governed by their privacy policies.
We may update this Policy. If we make material changes, we will notify you in-app and/or by email and update the "Last updated" date. Continued use after changes take effect means you accept the updated Policy (to the extent permitted by law; where consent is required, we will ask again).
[DPO CONTACT][BUSINESS ADDRESS][REPRESENTATIVE]If you are in the EEA/UK and are unsatisfied, you may complain to your local supervisory authority (EU DPA / UK ICO at ico.org.uk).