Last updated: 30 July 2026 Effective date: 4 July 2026
This Privacy Policy explains how think-app Pty Ltd ("THINK", "we", "us", "our") collects, uses, shares, and protects personal information when you use the THINK mobile application and related services (the "Service"). THINK is an anonymous yes/no sentiment social app: you vote on questions, leave short voice stories, comment, follow people, message others, and can ask THINK's AI how "the room" feels about a topic.
If you do not agree with this Policy, please do not use the Service.
The data controller responsible for your personal information is:
think-app Pty Ltd[JURISDICTION OF INCORPORATION][BUSINESS ADDRESS][DPO CONTACT] — or email founder@think-app.com[EU REPRESENTATIVE NAME & ADDRESS][UK REPRESENTATIVE NAME & ADDRESS]Lawyer note: if THINK has no EU/UK establishment but offers the app to people in the EU/UK, you likely must appoint an Art. 27 representative in each region. Confirm and fill in.
An account is required to use THINK. There is no anonymous browsing or auto-created guest session — you create an account with an email and password, or by signing in with Apple (Google sign-in is planned but not yet offered), before you can vote, comment, or use any feature.
"Anonymous" in THINK describes two specific, narrower things, not the account itself:
Signing in with Apple may give us a relay email address (via Apple's "Hide My Email") instead of your real one — see Section 18.
| Data | When / why |
|---|---|
| Username/handle, display name, initials | Created at onboarding; shown publicly with your content. |
| Email address | Only for "saved" accounts (email/password, Google, or Apple sign-in). Used for login, account recovery, and required service emails. |
| Password | For email/password accounts. Stored only as a salted hash by our authentication provider — we never see your plaintext password. |
| Profile photo OR short looping video avatar | Optional. Uploaded to our avatars storage bucket and shown publicly on your profile. |
| Voice story recordings (audio, up to ~30 seconds; up to 2 minutes for THINK+ members) | Optional. Your spoken reflections, stored and played publicly to other users. See Section 6 (Voice data) — this is a sensitive category. |
| Voice context on a question (audio, up to ~30 seconds; up to 2 minutes for THINK+ members) | Optional. When you submit a question for publishing you may record a short voice clip to give it context; it is stored and played alongside the question. Same sensitive-category treatment as voice stories (Section 6). |
| Yes/No sentiment votes | Your votes on questions. The split is shown in aggregate; votes drive your "Like-Minded" matching. |
| Questions you ask / submit for publishing | Public. Note: "anonymous questions" hide the author's identity from other users, but we still associate the question with your account internally. |
| Comments and replies; comment up/down-votes; content reports | Public (comments/replies). Your comment up/down-votes also feed Like-Minded matching — reacting the same way as another person to the same comments (both up, or both down) signals alignment; reacting oppositely signals the reverse. |
| Follows / follow requests | Who you follow / who follows you. For private accounts, a follow request is recorded until the other person approves it. |
| In-person meets (THINK Connect) | Optional. When you meet another user in person by scanning their QR code, we record that a meet happened, the other user's ID, and the timestamp. Used to award Ripples and as a strong Like-Minded signal. No Bluetooth, proximity, or location data is collected — the meet is confirmed solely by scanning a code. |
| Like-Minded Quiz | Optional. When you play the quiz with another user (passing one phone, or live on two phones by scanning a QR code or challenging a connection), we record each player's yes/no answers, the topic, and the resulting score for that pair. In live play, the two players see each other's answers as they are revealed. Your first completed quiz with a given person counts toward your Like-Minded score with them; replays are just for fun and do not change it. Challenging a connection sends that person an in-app notification. |
| Direct messages / conversations | Private 1:1 messages between you and another user. See Section 8 on how we access these. |
| Interests / topics | Chosen at onboarding to personalise your feed. |
| Optional demographics | Birth year, country, gender, political stance. Never required; not shown publicly; used for aggregate sentiment context and age-gating. Some of these (e.g. political opinion) may be special-category data under GDPR — see Section 4. |
| Bio and social links | Optional, public. |
| Reports / appeals / support messages | When you contact us or appeal a moderation action. |
| Data | Source / purpose |
|---|---|
| Account identifier (uid) | Assigned to every account on creation. |
| Approximate country, locale, timezone | Derived on-device from your system locale and timezone (no GPS involved). Stored on your profile (country, locale, timezone) for aggregate "how the world feels" context. |
| Coarse location (city, region, country, area) | Some features ask for the device's when-in-use location permission. You can decline; those features simply do not run and the rest of THINK is unaffected. When you use one, the app takes a single GPS reading and converts it to a place name on your device. The coordinates are then discarded and are never sent to us or stored. Only the resulting place text leaves your device: • THINK Meet — while you choose to be "live", we store your city, region, country and a coarse area name (a suburb or district, e.g. "Newstead"). Who can see whom is decided on the city alone; anyone signed in and browsing Meet in your city can see your line while you are live. It is deleted when you go offline and expires automatically after 4 hours. Browsing Meet without going live sends your city name with the request so we can show you who is live there; it is used for that lookup only and not stored. • THINK Lobby "near me" — used to sort nearby lobbies at the moment you search; not stored. • THINK+ Local mode — your city only, to show comments and voices from where you are. The map in THINK Meet does not show people. It draws a circle over an area, and everyone live in that area sits on the same single point at its centre. Nobody is given their own position, and an area holding fewer than two live people is not drawn separately. We never store, and therefore cannot show, anyone's street or address. Separately, a lobby you create has a meeting place you type in yourself, and its coordinates are stored — that is a venue, not a person, and it is shown only to people you accept into the lobby. |
| Last-seen timestamp / activity signals | Vote velocity, listen counts, engagement events — used for ranking and product analytics. |
| Device & technical data | Standard log/connection data needed to operate the app (e.g. IP address used to make requests, app version, error/crash diagnostics). |
| Push notification token | Not collected at v1 launch — device push (expo-notifications) is built but deferred for the first submission (no aps-environment entitlement in this build). In-app notifications still appear. When push ships in a later release, this row will describe the token being sent to Expo's push service, and the App Store Privacy label will be updated to declare Device ID as collected. |
Engineering note for the lawyer: country/locale/timezone come from
recordOrigin()via the device'sIntlsettings. Location permission IS now requested (when-in-use,NSLocationWhenInUseUsageDescription) for THINK Meet, Lobby "near me" and THINK+ Local mode. In every casegetCurrentCoords()takes one fix which is reverse-geocoded on device;detectPlace()returns only{city, area, region, country}and the latitude/longitude are dropped before anything is transmitted. There is no coordinate column onmeet_presence, and no distance between people is computed anywhere. The Meet map derives each circle's position from the stored area name via a place-name lookup, so every member of an area shares one point. Lobby venues do store coordinates (lobbies.lat/lng) because a venue is a place, not a person. THINK Connect remains QR-code only (no Bluetooth, no proximity/RSSI). The App Store privacy label must now declare Coarse Location — seelegal/APP_STORE_PRIVACY_LABELS.md.
Paid subscriptions are processed by Stripe via a web checkout (not in-app purchase). We do not receive or store your full card number — Stripe does. We store a Stripe customer identifier and your subscription/entitlement status so we can unlock paid features. Stripe's handling of your payment data is governed by Stripe's privacy policy.
Lawyer note: routing payments to web Stripe to avoid Apple's in-app-purchase fee has App Store policy implications (Apple's anti-steering and IAP rules). This is a business/compliance decision to validate with counsel and against current App Store Guidelines.
Where GDPR or UK GDPR applies, we rely on the following legal bases (Art. 6):
| Purpose | Legal basis |
|---|---|
| Creating and running your account; delivering core social features (votes, feed, follows, comments, messages) | Contract (Art. 6(1)(b)) |
| Voice stories, profile photo/video avatar, and other optional content you choose to post | Consent (Art. 6(1)(a)) — given by choosing to record/upload; withdrawable by deletion |
| AI search ("ask THINK") and AI moderation of content | Legitimate interests (Art. 6(1)(f)) — providing useful features and keeping the community safe; and/or contract for the search feature you actively use |
| Safety, anti-abuse, ban enforcement, fraud/bot prevention | Legitimate interests (Art. 6(1)(f)) and legal obligation where applicable |
| Email verification, security, account recovery | Contract and legal obligation |
| Marketing/optional analytics, optional push notifications | Consent (Art. 6(1)(a)) |
| Processing payments and managing subscriptions | Contract (Art. 6(1)(b)) |
Special-category data (Art. 9): Some optional information you may provide or generate — notably political opinions (the optional "political stance" field), and potentially voice recordings to the extent they are used to uniquely identify you — can be "special category" data. We process such data only with your explicit consent, or another Art. 9 condition, and you can delete it at any time. Do not provide special-category data you don't want processed.
Lawyer note: confirm the legal basis for AI processing and whether explicit consent (not just legitimate interests) is needed for (a) voice recordings, and (b) the political-stance field. A balancing test/LIA should be documented for any legitimate-interests basis.
THINK uses AI in several places. We want to be transparent about this because it involves sending content to a third-party AI provider. In every case we send only the minimum content needed for the feature, all calls run server-side, and results are cached and reused where possible so the same content is not repeatedly sent.
THINK's conversational "Ask THINK" AI search is held for the initial launch and is not available to users yet. For transparency, here is what it does when enabled in a later release: we send your search query (and a short snippet of recent conversation context) — together with relevant, mostly aggregated content from THINK's own corpus (e.g. question text and vote tallies) — to Anthropic (the makers of the Claude AI model) to generate a spoken/typed answer, grounded in THINK's own sentiment data with clearly-labelled general background knowledge. We will update this policy before turning it on.
When you choose to fact-check a comment, we send that comment's text to Anthropic (Claude) to assess its main factual claim and return a verdict. When a question's discussion is summarized, we send a sample of its comments (with the question text and aggregate vote signals) to Anthropic (Claude) to produce a neutral both-sides summary. Both results are cached per comment / per discussion and reused, so the same content is not sent again on later views.
To enforce our zero-tolerance policy on bullying, harassment, hate, threats, and doxxing, an automated moderation agent periodically sends recent comment text and the associated author account id to Anthropic (Claude) to assess whether content violates our rules and to propose an enforcement action on our ban ladder (warning → hide → 3-day → 7-day → 30-day → permanent ban). Most actions are reviewed by a human before they take effect ("review-first"); some configurations may act automatically with after-the-fact human review/appeal.
Automated decision-making (Art. 22 GDPR): Where a ban or content removal is applied automatically with no human in the loop, this may be a decision with legal or similarly significant effects. You have the right to request human review and to appeal — see Section 13. The dashboard and appeal process are designed to provide this.
Active: the "read this question aloud" accessibility feature uses ElevenLabs (text-to-speech). What is sent is only the published question text itself — editorial content already visible to every user. No personal data is ever sent: not your name or account details, not your comments, not your voice recordings, and nothing about who pressed play. Each question's audio is generated once, stored on our own servers, and every later playback is served from our copy — pressing play never contacts ElevenLabs. If the service is unavailable, your device's built-in voice is used instead (fully on-device).
Not active: THINK's broader conversational "AI" voice features remain held for the initial launch. For transparency, when enabled in a later release: text-to-speech would send generated answer text to a speech provider to produce spoken audio; and voice-story captions/transcription would send the voice-story audio to a speech-to-text provider to produce a transcript (cached, used for captions and safety moderation) — that would transmit your raw voice recording to a third party. We will update this policy and notify users before turning those on.
On the question screen you can shake your phone to open a "report a problem" sheet. Shake detection uses the device's accelerometer entirely on your device: motion readings are checked in memory to recognise the gesture and are never recorded, stored, or transmitted — to us or to anyone. If you then choose to send a report, we receive only the text you write plus which screen/question you were on.
| Sub-processor | Role | Data it may receive | Region |
|---|---|---|---|
| Supabase | Hosting, database, authentication, file storage, serverless functions | Substantially all account and content data | Australia (ap-southeast-2) — confirmed via Supabase project dashboard, 2026-07-01 |
| Anthropic (Claude) | Fact-check; discussion summaries; AI moderation (conversational AI search is held for a later release) | Search queries + app content snippets; comment text; comment text + author id | US |
| ElevenLabs (speech provider) | Text-to-speech for the question read-aloud accessibility feature | Published question text only (editorial content, generated once per question and cached on our servers). Never your personal data, comments, or voice recordings. Broader voice features remain inactive; enabling them would be preceded by a policy update and notice. | US |
| Google Translate | On-the-fly translation of the app interface, World/anonymous question text, and voice-story titles so anyone can understand them in their language. Comments are NOT auto-translated — they are sent only if you press-and-hold a specific comment to translate it. | The text being translated: interface strings, question text, voice-story titles, and (only on explicit request) a single comment | Global |
| Stripe | Subscription payments | Email, payment data, subscription status | Global |
| Apple / Google | Optional sign-in; app distribution; iOS in-app-purchase receipt validation | Authentication tokens; basic profile from sign-in; IAP receipt | Global |
| Google AdMob (when advertising is enabled) | Serving ads in the free tier | Device advertising identifiers and ad-interaction events. Only if/when ads are turned on — disabled / test-only at launch, and gated behind an App Tracking Transparency permission prompt on iOS | Global |
| Expo / EAS | App build (production builds + OTA) | Build artifacts and crash-free diagnostics from the Expo/EAS toolchain itself; no push tokens at v1 (push deferred, see 3.2) | Global |
A current, complete list of sub-processors is available on request at founder@think-app.com. [Recommended: maintain a public sub-processor list and notify users of changes.]
Note on translation: translation calls Google Translate from the device. By design we translate only the interface, question text, and voice-story titles (so anyone worldwide can understand a question in their language). Comments are never sent automatically — a comment is translated only when you press-and-hold it to ask for a translation, the same way Instagram works.
Voice stories are short audio recordings of your voice. A recording of your voice can be sensitive. Some laws treat a "voiceprint" — a biometric identifier derived from voice — as biometric data with strict consent and notice requirements. In particular:
THINK's current practice: we store and play back your voice recording as audio content. We do not currently create a voiceprint or use voice for biometric identification or recognition. If this ever changes (for example, voice-based identity verification or speaker recognition), we will obtain explicit, informed consent and provide the required notices and retention schedule first.
Lawyer note (high priority): even storing/playing voice audio can attract argument under BIPA-style statutes. Decide whether to (a) add an explicit voice-recording consent screen, (b) publish a voice-data retention/destruction schedule, and (c) consider geofencing or extra notices for Illinois/Texas/Washington users. This is a cross-border litigation-risk area.
We do not sell your personal information for money. See Section 11 for how "sale"/"sharing" is defined under California law.
Direct messages are private between you and the other participant and are protected by access controls. They are not end-to-end encrypted. We may access message content where necessary to operate the Service, investigate abuse or safety reports, comply with law, or where required to enforce our Terms. Do not share information in DMs that you would not want us, in limited and justified circumstances, to be able to access.
Lawyer note: confirm whether DMs are excluded from AI moderation. As built, the moderation agent scans comments, not DMs — verify and state this accurately.
We share information:
We do not share your personal information with advertisers for cross-context behavioural advertising. (Confirmed 2026-07-01: no ad/attribution SDK is present in package.json or the build. Re-verify if one is added later — see Section 14.)
THINK relies on providers (e.g. Supabase, Anthropic, Stripe, Apple, Google, and — when the held voice features launch later — a speech provider) that may process data in the United States and other countries outside your own. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and, where applicable, the EU–US Data Privacy Framework, plus supplementary measures as needed. You may request a copy of the relevant safeguards at founder@think-app.com.
Lawyer note: regions confirmed above (Supabase → Australia
ap-southeast-2; Anthropic → US). Please ensure SCCs/DPAs are in place for each transfer (Section 3 of DATA_PROCESSING_NOTES.md).
Subject to applicable law, you may have the right to:
California (CCPA/CPRA) rights. California residents may request to know/access, delete, and correct personal information, and to limit use of sensitive personal information. You also have the right to opt out of the "sale" or "sharing" of personal information and the right not to be discriminated against for exercising your rights.
Sensitive personal information (CPRA). This may include precise account credentials, the contents of your messages, and (optionally) your voice recordings and political stance. We use sensitive information only to provide the Service and for permitted purposes, not to infer characteristics about you.
You can permanently delete your account from within the app (Settings → Delete account). This runs our delete_my_account process, which removes your profile, votes, questions, comments, follows, messages, and all uploaded files (your voice audio and avatar image/video) from our storage, and deletes your authentication record.
Deletion is permanent and cannot be undone. After deletion, some information may persist for a limited time in:
[STATE BACKUP RETENTION, e.g. 30 days]).Content you sent to third parties (e.g. AI providers) is handled under their retention terms; we rely on their commitments to delete or not retain such data — see Section 5.
To request deletion or any other right, email founder@think-app.com or contact [DPO CONTACT].
Email founder@think-app.com (subject: "Privacy Request"), or use the in-app controls where available. We will verify your request (typically via your account email) and respond within the timeframes required by law (generally within 30 days under GDPR/UK GDPR and 45 days under CCPA/CPRA, extendable where permitted). You may use an authorised agent where the law allows.
To contest an automated moderation decision (e.g. a ban), reply to the enforcement notice or email us; a human will review your appeal.
THINK is primarily a mobile app and does not rely on advertising cookies. The app and any related web pages (e.g. checkout, marketing site) may use:
We do not currently use third-party advertising or cross-context tracking SDKs. (Confirmed 2026-07-01. If any analytics/attribution/ads SDK, e.g. for marketing, is added later, update this section, the App Store labels, and the CCPA "sharing" disclosures, and add a consent banner where required — ePrivacy/EU.)
We keep personal data only as long as needed for the purposes above:
purge-voice-stories) either deletes the audio file and the row (the common case), or archives it (row + audio kept, no longer shown in the live feed) if the story crossed a popularity threshold, so it can still be cited by AI search. Either way, deleting your account removes all of your voice audio regardless of archive status. (Confirmed 2026-07-01.)We protect your data with measures including encryption in transit, access controls, row-level security on our database, server-side handling of all AI/API keys, salted-hash password storage by our auth provider, and security reviews before releases. No system is perfectly secure; we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and regulators as required by law.
THINK is a social app with user-generated content, public voice recordings, and direct messaging, and is not intended for young children.
Lawyer note: Decided — global minimum age 16+, server-enforced (see above; no minors mode is offered). Please confirm this satisfies UK Children's Code obligations for our markets and that no additional notices are needed.
If you believe a child has provided us personal data, contact founder@think-app.com and we will delete it.
If you sign in with Apple, that provider authenticates you and shares limited profile information (e.g. email, name) with us per your settings. Apple "Hide My Email" may give us a relay address instead of your real email. Google sign-in is planned but not yet offered in the app. Your use of these providers is governed by their privacy policies.
We may update this Policy. If we make material changes, we will notify you in-app and/or by email and update the "Last updated" date. Continued use after changes take effect means you accept the updated Policy (to the extent permitted by law; where consent is required, we will ask again).
[DPO CONTACT][BUSINESS ADDRESS][REPRESENTATIVE]If you are in the EEA/UK and are unsatisfied, you may complain to your local supervisory authority (EU DPA / UK ICO at ico.org.uk).