Privacy

Thoughtbox · last updated August 15, 2026

Who is responsible

Thoughtbox is made by James Donovan, a sole proprietor in San Francisco, California, and is the controller of the personal data described here. One person reads the mail: write to support@thoughtbox.online about anything on this page, and that person answers.

Your photos stay on your phone

Thoughtbox indexes your photo library entirely on your device — recognition, faces, search, and quality judgments all run locally. Your photo library is never uploaded, and we hold no copy of it.

Your written record backs up to your iCloud

Once a day, after you have written something, the app saves a snapshot of your written record — captions, pairs, answers, accepted ideas, and reads — to a private container in your iCloud account. It never passes through our servers, we cannot read it, and it counts against your iCloud storage, not ours. Photographs are not included; they stay in your photo library. Backups are on by default so that losing a phone doesn’t mean losing the record; the switch lives in the app’s settings, and turning it off is respected permanently. Reinstalling the app offers the snapshot back. What happens inside iCloud is governed by your agreement with Apple, not by us.

What leaves your device, and when

The writing intelligence runs on our server. When it works for you, it receives the words you wrote (captions, notes, answers) and, once per captioned photo, a small copy of that photo to understand what it shows — processed for the duration of the request and not stored. A photo is stored by us only when you deliberately send it somewhere: publishing a public page, placing a work on your family’s shelf, or printing a book.

What we keep

Your account (name and email from sign-in), anything you published or placed for family, print orders (including the delivery address you entered), a usage ledger of the AI work done for you, and the usage events described below. Public pages are unlisted, excluded from search engines, and revocable — unpublishing takes the page and its images down.

What we measure

To understand where the product works and where it loses people, the app records usage events — that a caption was created, a question answered, a card hidden, a book previewed. Events carry categories and counts, never content: no caption text, no answers, no names, no places, no photos, and our server rejects anything shaped like prose. Alongside them ride basic diagnostics — the device model and a daily count of crashes or hangs, numbers only. Everything is tied to a random identifier, not your email, processed only by us (no third-party analytics), and deleted with your account.

Cookies and sign-in

Signing in on the web sets one cookie. It is a signed session token, it exists so the site knows you are you, and it is the only cookie we set. There are no advertising cookies, no analytics cookies, and no third-party trackers on any page. The app signs in with the same token sent as a header, and stores it in the device keychain. Signing in with Apple or Google tells us the name and email address those services release to us, and nothing else; if you use Apple’s Hide My Email, we receive the relay address and never your real one.

Why we are allowed to process it

For anyone in the UK or the European Economic Area, these are our legal bases under the GDPR. Running your account, doing the AI work you asked for, publishing what you chose to publish, and fulfilling a print order are performance of a contract with you. Keeping the service secure, preventing abuse, and measuring how the product is used are our legitimate interests, weighed against your rights and limited to the non-content events described above. Keeping transaction records is a legal obligation. Where we ever ask for consent, you can withdraw it at any time without affecting what came before.

How long we keep it

Your account and everything in it: until you delete it. Published pages and family placements: until you take them down, then removed from our systems and image storage. Usage events and diagnostics: 24 months, or sooner if you delete your account. Server logs: 30 days. Transaction records for print orders (what was ordered, when, the amount, and the address it shipped to): seven years, because tax and accounting law requires it, and no longer.

Who else touches data

Each provider below receives only what its one job requires — nothing else, and never for its own use. There are no ads, no trackers, no third-party analytics, and your data is never sold or shared for anyone else’s advertising.

Anthropic processes the text excerpts and transient photo copies that power the reading and writing (not used to train models, per our API agreement). Prodigi, our print lab, receives the book file and shipping address for orders you place. Stripe processes payment if you buy a printed book — your card details go to Stripe directly and never touch our servers. Apple and Google provide sign-in. Our servers run on Vercel, our database on Neon, and published images on Cloudflare. That is the whole list; if it ever grows, this page changes first. Stripe and Prodigi keep their own records of what they did for you, under their own policies.

Where it is processed

Our servers and database are in the United States, and the providers above process data there. If you are in the UK or the European Economic Area, that is an international transfer: it happens under the European Commission’s standard contractual clauses (and the UK addendum) in our agreements with those providers. Your photo library is not part of any of this. It never leaves your phone.

Keeping it safe

Everything travels encrypted in transit and is stored encrypted at rest by our database and storage providers. Session tokens are signed and expire. Access to production data is limited to the one person who runs this company and is used only to operate the service or answer a question you asked. No system is perfect, and we will not pretend otherwise: if a breach affects your personal data, we will tell you and the relevant regulator without undue delay, and within 72 hours of becoming aware where the law requires it.

Leaving, with everything

Your record is yours to take: the app exports everything you have written in one action, whenever you want it, in a plain readable format. And deletion is in-app: Agents → Account actions → Delete account removes your account, published pages, family placements, and usage events from our systems, and resets the app itself. On any build, writing to support@thoughtbox.online does the same. Two honest exceptions: transaction records for orders you placed are kept for the seven years described above, and Stripe and Prodigi retain their own records under their own terms. Your photo library is yours and is never touched either way.

Your rights

You can ask us for a copy of your personal data, correct it, delete it, take it elsewhere in a portable format, restrict what we do with it, or object to processing we base on legitimate interests. Most of this is already a button in the app, and no request is treated as unusual. Write to support@thoughtbox.online and we will answer within 30 days. We will never charge you for asking, and never treat you differently for having asked. If you are in the UK or the EEA and think we have got it wrong, you can complain to your national data protection authority.

If you are in California

The categories we collect are named above: identifiers (your name, email, and a random device identifier), commercial information (print orders and their delivery address), internet activity (the non-content usage events), and the content you write and choose to send. We collect them for the purposes described on this page and keep them for the periods listed. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. You have the right to know, delete, and correct, and to not be discriminated against for exercising any of it. The same address answers all of it.

Children

Thoughtbox is not made for children and is not directed to anyone under 16. We do not knowingly collect personal data from children. If you believe a child has created an account, write to us and we will delete it.

No decisions are made about you

The archive reads what you have written and proposes what it thinks. You accept it or you refuse it, and a refusal is kept as part of the record. Nothing here makes an automated decision with legal or similarly significant effects, and there is no profiling for advertising, scoring, or anything sold to anyone.

When this page changes

The date at the top changes whenever the text does. If a change is material — a new provider, a new category of data, a new purpose — we will say so in the app before it takes effect, not quietly. This policy is governed by the laws of the State of California, United States.

Questions

Write to support@thoughtbox.online and a human answers.

Thoughtbox · personal intelligence for photos and memories