Privacy

Privacy and security

Cloud AI is off until you turn it on, and you can delete your cloud copy anytime.

You decide before journal text is sent for pattern analysis, and you can remove the server copy from Settings.

On-device transcription

Speech becomes text on your phone: Apple's speech recognition on iPhone, and Android's on-device recognition on Android. Sending audio for cloud transcription happens only if you turn on remote processing.

Private by default

You don't need an account to journal. If you sign in, Thoughtprint keeps your email address and a pseudonymous account id, and nothing else about you.

What stays on your device

Your archive entries, saved details, action items, surfacing choices, memory controls, packs, pins, and collections are stored locally by default.

Location and maps

Places are off until you turn them on. When they are on, a new entry keeps a rough position (about 100 metres). To name the place, that rough position is sent to Apple on iPhone or Google on Android. Maps load tiles from Thoughtprint's own map server, run on Cloudflare, which sees the area you're viewing and your IP address, not your entries.

Printed books (not in the beta)

Printed books are in development. To fulfill book orders and maintain audit records, Thoughtprint stores order metadata (order ID, status, page count, binding format, total price, and shipping details) alongside Stripe session IDs in our database. Generated manuscript and cover PDF files are stored temporarily in encrypted object storage and automatically purged 30 days post-fulfillment.

Apple Health

On iPhone, turning on Apple Health shows the State of Mind you logged that day beside the moment. Turning on saving moods writes the mood you pick to Apple Health. Deleting that mood removes the sample Thoughtprint wrote. Android does not use Apple Health.

Where your journal is kept

Your journal (entries, recordings and photos) is stored on your phone, in an encrypted database. Thoughtprint's servers hold a copy only if you turn on a feature that sends one; each is listed on this page.

AI transcription and analysis

If you turn on remote processing, Thoughtprint may send audio or transcript text to the app backend so it can transcribe and organize what you said. The result is returned to your archive. Remote processing is off until you turn it on, and you can turn it off at any time. Audio goes to OpenAI to be transcribed; text goes to Anthropic for reflections and questions, or to OpenAI when Anthropic isn't available. OpenAI also gets text if you upload notes for pattern exploration: it turns their text, and what you search or ask with, into a search index. Under their API terms, neither trains its models on this data, and each keeps it for up to 30 days, longer only if it is flagged for abuse or the law requires. Data Processor Name — Purpose / Feature — Types of Data Sent OpenAI (Whisper) — Audio transcription — Audio files OpenAI (embeddings) — Search index for pattern exploration, when you upload notes — The text of uploaded entries, and what you search or ask with Anthropic (Claude) — Entry notes, when remote processing is on — The entry's transcribed text Anthropic (Claude) — Weekly recap reflections, when you turn them on — That week's entries Anthropic (Claude) — Practice question wording, when allowed — The lines quoted in a practice's questions, and the practice's name Anthropic (Claude) — Talk it through questions, when allowed — What you say in Talk it through Anthropic (Claude) — Pattern exploration chat, evidence insights, weekly stories and then-vs-now comparisons, when you upload notes — The uploaded entries that match, and your messages Anthropic (Claude) — Archive reviews (Pro), when you ask for one — A summary of your archive, with short excerpts from entries OpenAI (GPT) — Writing and questions when Anthropic isn't available — The same text as the Anthropic rows Sentry — Crash reports — App version, device model and where in the code a crash happened, with journal text removed Apple or Google — Place names, when places are on — A position rounded to about 100 metres Cloudflare — Map tiles for the journal map — The map area being viewed Resend — Sign-in codes by email — Your email address

Practice questions

Practices can ask about things you wrote in them before. Those questions are written on your phone. If you allow it in the app, the lines quoted in a practice's questions, and the practice's name, are sent through Thoughtprint's server to Anthropic (or OpenAI when Anthropic isn't available) to word those questions. Your entries are not sent. Our server doesn't store them. Off unless you turn it on, and you can turn it off in Privacy.

Crash reports

If the app crashes, a report goes to Sentry with the app version, the device model and where in the code it failed. Anything that could hold journal text is removed on your phone before the report is sent, and reports are not linked to your account.

Usage counts

Off unless you say yes when the app asks, or turn them on in Privacy. If you do, the app sends the name of an event, such as that an entry was saved, and the server adds one to that day's total. No words, and no account or device id.

Signing in

Signing in is optional. Sign-in codes are emailed through Resend, which receives your email address to deliver them.

Optional encrypted backup

Encrypted backup seals a copy of your journal with a passphrase on your phone, then saves it to iCloud or a file you choose. Sync between devices is not in the beta. When it is, records will be encrypted on your phone before upload, so the server holds only data it cannot read.

What Thoughtprint does not do

Thoughtprint does not sell your journal. Your words are not part of usage counts. Thoughtprint does not turn every entry into personal memory by default.

Your controls

You can mark entries as Hypothetical, Not about me, Sensitive, Do not surface, Preserve original, Keep separate, or Treat as new.

Processing providers

Thoughtprint uses providers for transcription, analysis, account, or crash diagnostics, listed below; each only when the feature it serves is in use. Stripe, Inc. (billing) and Lulu Press, Inc. (printed books) are used only for paid features and printed books, which are not in the beta. Data Processor Name — Purpose / Feature — Types of Data Sent OpenAI (Whisper) — Audio transcription — Audio files OpenAI (embeddings) — Search index for pattern exploration, when you upload notes — The text of uploaded entries, and what you search or ask with Anthropic (Claude) — Entry notes, when remote processing is on — The entry's transcribed text Anthropic (Claude) — Weekly recap reflections, when you turn them on — That week's entries Anthropic (Claude) — Practice question wording, when allowed — The lines quoted in a practice's questions, and the practice's name Anthropic (Claude) — Talk it through questions, when allowed — What you say in Talk it through Anthropic (Claude) — Pattern exploration chat, evidence insights, weekly stories and then-vs-now comparisons, when you upload notes — The uploaded entries that match, and your messages Anthropic (Claude) — Archive reviews (Pro), when you ask for one — A summary of your archive, with short excerpts from entries OpenAI (GPT) — Writing and questions when Anthropic isn't available — The same text as the Anthropic rows Sentry — Crash reports — App version, device model and where in the code a crash happened, with journal text removed Apple or Google — Place names, when places are on — A position rounded to about 100 metres Cloudflare — Map tiles for the journal map — The map area being viewed Resend — Sign-in codes by email — Your email address

Export your data

You can export your data anytime from Export, Archive, or Settings: full JSON archive, readable Markdown, and (on Pro) printable reports. Exports are generated on your device from local storage.

Delete your data

Delete individual reflections from each entry page, or delete all local data from Settings. Deletion removes journal entries, audio, and preferences on this device. Deleting the account removes the encrypted cloud copy tied to that account.

Contact

Questions about privacy: hello@thoughtprint.xyz

Third-party data processors

Printed book retention is also described on the books page.

Waitlist

We collect only your email address and the time you joined. We use that to send a single launch announcement. Resend delivers the email and Neon stores the address. Every email includes a one-click unsubscribe link.