Privacy

What we store and what we can read

Your notes, tasks, memories, agent runs (including any screenshots you paste into them), schedules and connected agents are end-to-end encrypted. They are encrypted on your device with a vault key, using AES-256-GCM, before anything is uploaded. The vault key is protected by your passphrase and a recovery key. Our servers only ever hold the encrypted copy and cannot read it.

Notes you share into an organization are encrypted with an organization key that only the members' devices hold.

Some things are not encrypted, because the service needs them to work. We can see:

• Your account email, and if you sign in with Google, the name and picture on your Google account
• Your plan and role
• Each computer you use Thinq on: a random id, whether it is a Windows PC or a Mac, and when it was last used
• Each server you pair with Thinq (see Your own servers below), with the same kind of details as a computer
• The names of organizations, who is a member of which, and the email addresses of pending invitations
• For each synced item: its type (task, note, run, schedule or agent), a random id, when it last changed, whether it is deleted, which organization it is shared with, and its approximate size

If you lose your passphrase and your recovery key and every device you are signed in on, your synced data cannot be recovered by anyone, us included.

What stays on your device

Thinq is local-first. Everything is stored on your computer, in the desktop app's own storage on your disk. Sync needs you to sign in, and nothing is uploaded until you do.

Your agent's memory files stay where your agent keeps them on your machine. Thinq only carries the projects you pick into your vault, encrypted like everything else.

Your own servers

Thinq Remote, which is not switched on yet, will let you pair a Linux server you own with Thinq, so that it keeps running your work while your computers are off. Thinq does not host that server. It is yours, and it runs the Thinq connector on your behalf. It signs in to your Thinq account with an emailed code, the way any of your computers does.

Thinq's servers see what they need to send work to it: the server's name, its processor type, its connector version, when it last checked in, and for each agent tool whether it is installed there and signed in. They also see which computer a run or schedule is aimed at, and when it was queued, started and changed.

They do not see the briefs, logs or results of those runs, your keys, the pairing secret, or your agent tools' sign-ins. The token a server uses to check in is kept only as a hash.

While a server is paired, it holds your vault key and can read your vault. Removing a server stops it from taking work, but it does not take back what the server has already read. If you lose a server, or think it has been compromised, change your passphrase.

A server only takes work that a computer you approved on that server has signed. If someone takes over your Thinq account and has no approved device, they cannot start work on a server.

Signing in

You sign in with your email and a password, with Google, or with a link or one-time code we email you. A password is stored only as a secure hash by our sign-in provider, never in a form anyone can read.

Who else is involved

A few companies run parts of Thinq for us. Each one gets only what its job needs.

• Our database and sign-in provider holds your account email, the encrypted copy of your vault and the unencrypted details listed above, and sends the sign-in emails. The database is hosted in the United States.
• Our hosting provider serves the website and counts the page views described below.
• Our payment processor (Stripe) takes payment for Pro: your email, your card and your billing address go to it, and we see only the plan you are on, whether it is paid, and when it renews. We never see your full card number.
• The app's downloads and updates are served from a public release host. When the app checks for an update, that host sees the request.
• The bridge your agent loads is published to a public package registry. When your agent installs or updates it, the registry sees the request.

The agent runs on your own computer, using the AI agent you connected. Thinq does not send your vault to any AI provider. Your agent does, when it works on it, under your own account with that provider and its terms.

Analytics

The website counts page views: which page was opened, the site that linked to it, and general details such as browser, device type and country. It does not use cookies and it never sees what is in your vault. The desktop app has no analytics.

Cookies and local storage

Thinq sets no cookies of its own. The app keeps small preferences such as the theme, panel sizes and sounds in its local storage and the vault itself in IndexedDB. Your sign-in session and vault key are sealed with your operating system's own protection, so only your user account on that computer can open them. Settings, Your data, Wipe local data removes all of it from that computer.

How long we keep data

Synced data stays on the server until you delete it. When you delete an item, its content is removed and a small marker (its id, type and when it was deleted) stays so your other devices know to remove it too.

When you delete your account, your server data is removed immediately. Our providers may keep backups for a limited time before those copies expire, and anything in them is still encrypted.

Export and delete

Export: Settings, Your data, Export gives you one file with every task, note, run and schedule on that device.

Delete: Settings, Your data, Delete account cancels anything you pay for, then removes your account and everything you synced from the server, along with any organization you created. Notes other members shared into that organization stay with them and become private to them again. That device is wiped at the same time. Other devices keep their local copy until you wipe them from the same place.

Security

• End-to-end encryption of your vault with AES-256-GCM, with keys that never leave your devices unprotected
• Encrypted connections (HTTPS) for everything sent to our servers
• Database rules that check, on every read and write, that a row belongs to you or to an organization you are in
• Passwords stored only as secure hashes, never in plain text

Children

Thinq is not directed at children under 13, and we do not knowingly collect information from them.

Changes to this policy

If this policy changes, we will update this page and the date at the top.