Thoughtroom — Privacy Policy
Version 1.0 · Prepared 2026-07-17 · Effective: 12 August 2026
A plain-language summary (the full policy below is what governs): Your journal is yours. We use what you record only to run Thoughtroom for you — transcribing, reflecting, and powering Olivia’s memory. We show no ads, sell nothing about you, and never use your journal to train our own AI models. Voice recordings are deleted from our servers within about 24 hours of processing. Private Mode keeps everything on your phone — nothing reaches us at all. You can export or permanently delete everything, any time, in the app.
1. Who we are
Thoughtroom (“Thoughtroom”, “we”) is operated by Ezel Bayraktar, an independent developer. We are the “data controller” of your information. Contact: help@thoughtroom.app.
This policy covers the Thoughtroom iOS app and related services. Because Thoughtroom is a wellbeing journal, most of what you share with it is sensitive by nature — we treat all of Your Content with the protections that sensitive information requires.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | A sign-in identifier from Apple; the email tied to it (which may be Apple’s private relay address); a display name if you choose to give one | You / Apple Sign-In |
| Journal content | Voice recordings (temporary — see §3); transcripts; journal entries and your edits; mood and reflections | You |
| Conversations | Your chats with Olivia; voice-session conversations; the reflections Olivia writes on your entries | You / generated by AI |
| Derived content | Patterns Thoughtroom notices in your journal — topics, recurring themes, memories (short statements about your life that Olivia keeps so she does not ask you the same thing twice, each one linked to the entries it came from), and numerical representations (“embeddings”) used to find related entries | Generated from your content |
| Purchases | Whether you subscribe to Thoughtroom Pro and your subscription status. We never see your card or payment details — Apple processes all payments | Apple |
| Technical & diagnostics | Device model, OS and app version, crash reports and error diagnostics, and usage counters that enforce fair-use limits | Your device |
What we do NOT collect: your precise location, contacts, photos, browsing history, or advertising identifiers. Thoughtroom contains no advertising or marketing-analytics SDKs.
3. Voice recordings — the 24-hour rule
When you record an entry in cloud mode, the audio is uploaded to temporary storage, transcribed, and then deleted from our servers, normally within 24 hours of successful processing. What remains is the text of your entry. Voice-session audio with Olivia is processed by our voice-conversation provider (§7) to hold the conversation in real time.
4. Private Mode
When Private Mode is on, transcription, AI processing, Olivia conversations and the memories described in §2 all happen on your device. That content is never uploaded, and we have no copy, no access, and no ability to recover it. Content you created in cloud mode before switching remains on our servers until you delete it.
Two consequences worth stating plainly, because they cut both ways: memories made in Private Mode cannot appear on another device, and they cannot be recovered by us if you lose the phone — there is nothing to recover from. Deleting a memory in Private Mode deletes it from the device outright.
5. How we use your information
- To run Thoughtroom for you — transcribe recordings, generate entries and reflections, hold Olivia conversations, remember your journal across sessions, and sync your devices. (Legal bases where required: performance of our contract; your explicit consent for wellbeing-related content, given at sign-up and withdrawable at any time by deleting content, using Private Mode, or deleting your account.)
- Safety — an automated safety model screens conversations with Olivia to block harmful content and to surface crisis resources when warranted. Conversations are not monitored by humans, in real time or otherwise. (Legal bases: legitimate interest in user safety; substantial-public-interest / vital-interest grounds where applicable.)
- Reliability and security — crash reporting, abuse prevention, rate limiting, and service-account security. (Legitimate interests.)
- Legal compliance — records we must keep, such as your acceptance of the Terms (§9). (Legal obligation / legitimate interests.)
We do not: show ads, sell or rent your information, share it with data brokers, use your content for marketing, or use Your Content to train our own AI models. Our AI providers process your content only to generate responses for you, under terms that prohibit using it to train their models.
6. AI processing
Your entries and conversations are processed by AI systems to produce transcripts, refined entries, reflections, and Olivia’s responses. This includes infrastructure we operate ourselves and the third-party providers in §7. AI processing is automated; its outputs are suggestions and reflections for you, not decisions about you — Thoughtroom makes no automated decisions with legal or similarly significant effects.
7. Service providers
We share Your Content only with processors that help us run Thoughtroom, only as needed:
| Provider | What they do |
|---|---|
| Cloud hosting & database provider | Stores your account, entries, and conversations; runs our server functions |
| AI inference providers | Transcribe audio and generate AI text for entries, reflections, and Olivia |
| Our own AI servers | Infrastructure we operate for transcription and AI processing |
| Voice-conversation provider | Powers real-time voice sessions with Olivia |
| Apple | Sign-in, payments, app distribution |
| Crash-reporting provider | Receives error diagnostics (not your journal content) |
| Network-security provider | Protects traffic to our servers |
Each provider is bound by contractual terms limiting use of your data to providing their service to us. A current list of providers is available on request at help@thoughtroom.app.
8. Where your information is processed
We operate globally. Your information may be stored and processed in countries other than your own — currently including Australia (primary storage), the United States (AI and infrastructure providers), and Türkiye (where the developer is based). Locations may change or expand as the service grows; we will keep this policy updated. Wherever your data goes, it stays protected by this policy and by contractual safeguards with our providers (including standard contractual protections where required).
9. How long we keep things
| Data | Kept until |
|---|---|
| Voice recordings (cloud) | Deleted within ~24 hours of successful processing |
| Entries, conversations, derived content | Until you delete them or your account |
| Crash diagnostics | Up to 90 days |
| Fair-use counters | Rolling windows; not kept long-term |
| Records of your acceptance of the Terms and required disclosures | Up to 6 years after account deletion — kept as legal evidence of the agreement, containing only the acceptance event (who, when, which version), never journal content |
| Backups | Deleted content ages out of routine backups within 30 days |
Account deletion (Settings → Delete Account) permanently erases your account, journal, conversations, and derived content, subject only to the backup window and the acceptance records above.
10. Your rights and controls
Built into the app, for everyone, regardless of where you live: export your journal, edit anything, delete any entry or your entire account, and Private Mode.
You can also see and change everything Olivia remembers about you (Olivia → Memories): each memory shows the entries it came from, and you can confirm it, correct the wording, add one yourself, or delete it. Deleting a memory is permanent — it is removed, and Thoughtroom will not re-derive that same statement from anything you have already written. A future entry mentioning it can still teach Olivia it afresh. A memory you have confirmed or corrected is never afterwards overwritten by automated processing.
Beyond that, depending on where you live, the law gives you rights to access, correct, delete, or receive a copy of your data, to withdraw consent, to object to or restrict processing, and to complain to a regulator — including under UK GDPR (regulator: the ICO), the Australian Privacy Principles (OAIC), Canada’s PIPEDA (OPC), and U.S. state privacy and consumer-health-data laws. We honor these requests for all users, wherever you are. Write to help@thoughtroom.app and we will respond within the timelines your law requires (and in any case within 30 days). We do not “sell” or “share” personal information as those terms are defined in U.S. state privacy laws, and we do not use it for targeted advertising.
11. Security
Your data is encrypted in transit and at rest. Access is restricted by row-level security (your rows are readable only by your authenticated account), our internal service calls are cryptographically signed, and Private Mode removes the network entirely. No system is perfectly secure — if a breach ever affects your data, we will notify you and the relevant regulators as required by law (including U.S. health-breach notification rules), without undue delay.
12. Children
Thoughtroom is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has used Thoughtroom, contact us and we will delete the account and its data.
13. Changes to this policy
If we make material changes, we will notify you in the app and ask you to review them before continuing. The current version and its history are always at https://thoughtroom.app/privacy.
14. Contact
Ezel Bayraktar — Thoughtroom Email: help@thoughtroom.app
If you are unsatisfied with our response, you may contact your local privacy regulator (ICO in the UK, OAIC in Australia, OPC in Canada, your state Attorney General in the U.S.).
Version history: 1.0 — first published version.