Thrupage Privacy Policy

Overview

Thrupage ("the App") is developed by Ullim. This privacy policy explains how Thrupage for iOS, Android, web, and macOS handles your information.

Using the App without signing in

If you don't sign in, your pages, tasks, and labels are stored only on your device (in the browser's storage for the web version) and are never sent anywhere.

Sign-in and sync

To sync across devices, you sign in with Apple or Google. We receive: for Sign in with Apple, your name (on first sign-in only) and email address (or an Apple private relay address if you choose to hide your email); for Google Sign-In, your name, email address, and profile photo URL. For Pro users with sync turned on, and for users who agree to use AI connection, your page content, tasks (title, note, comments, due date, status, labels, etc.), and labels are stored on our server. Free users agree to server storage the first time they connect an AI tool, and only the device they agreed on uploads (you can switch devices in the app once every 7 days). Other devices can download and view what is on the server, but changes made on them are not uploaded. To recognize your upload device, the App sends a random device identifier created for each installation with its server requests, and stores the identifier of the device you choose as your upload device with your account. Deleting the App creates a new identifier, and deleting your account deletes it. If you only sign in without using sync or AI connection, your pages, tasks and labels are not uploaded (account details and subscription status are still stored). We also store the user ID from the service you sign in with, and if you use Sign in with Apple, we store the refresh token Apple issues so we can revoke the Apple link when you delete your account. Images you add to a page are stored only on your device by default. For users whose content is uploaded (Pro users with sync, and free users who agreed to AI connection), images are also uploaded to private storage on our server (Supabase, US); only you, signed in, can download them, and a downloaded copy is stored on that device. Before upload, the app re-saves each image on your device as a JPEG (PNG for transparent images) up to 2048 pixels on the long side, so metadata such as location, camera model and capture time (EXIF) is removed. Animated GIFs are not re-saved, to keep the animation, but extra information such as comments and XMP is removed before upload. Along with the file, we store its format, size, width and height in pixels, upload time, and when it stopped being used. Images can be up to 20 MB each, up to 10 GB in total for Pro users and 1 GB for free users. Past the limit, only new uploads to our server stop; images stay on your device. Images attached to comments are stored on our server the same way, and under the same limit, as page images. So that a page can be restored to an earlier state, while you sync or use AI connection we keep page versions on our server (the page as it was, plus each of its tasks' title, status, due date, labels, priority and the date it was completed or cancelled). Data in transit is encrypted (TLS), but stored content is not end-to-end encrypted.

Crash reports (Firebase Crashlytics)

If the iOS or Android app crashes, Firebase Crashlytics collects crash information (where the error occurred, device model, OS version, app version, Firebase installation ID, and recent app logs) so we can fix the cause. This is not linked to your account and is kept for 90 days.

App usage analytics

App usage analytics runs in the iOS and Android apps and in the web and Mac apps. To improve features, we use Google Analytics (Google Analytics for Firebase in the phone apps) to collect app usage information (events such as opening the payment screen, payment and sign-in attempts and their results, and the type of sync errors, plus device model, OS and app version, country and approximate location inferred from IP address, and an identifier that tells devices apart). The content you write, such as page text or task titles, is never sent, and this information is not linked to your account. It is kept for 14 months. The web app stores a random identifier that tells devices apart in cookies (named _ga and starting with _ga_), and the Mac app stores one in the app's storage. This identifier expires 2 years after you last use the app. If you use the app in the EEA, the UK or Switzerland, or your region can't be determined, the analytics code is not loaded and no cookies or identifiers are stored until you allow it in Settings. The web and Mac apps treat you as being in this region if either your device's language region or its time zone is in it. Elsewhere, analytics is on by default, and you can turn it off at any time with 'Allow app usage analytics' in Settings. Turning it off stops collection and deletes the analytics cookies and the Mac app's identifier. You can also delete them yourself in your browser settings. The Thrupage website (thrupage.com) also uses Google Analytics to collect visits and usage information (page views, video plays, clicks on the web and Mac buttons, device and browser type, country and approximate location inferred from IP address, and an identifier that tells devices apart) for the same period, using the same cookies. In the regions above, the website has no setting, so the analytics code is not loaded there. Elsewhere, if you don't want this, block or delete cookies in your browser. Separately, for signed-in users the Operator stores one row for each day you open the app and each day you use Thrupage through an AI connection (only the date and whether it was the app or AI, linked to your account) to count return visits and active days. It contains no page content. These rows are deleted after 14 months, or immediately when you delete your account, and only weekly totals that can't identify anyone are used outside the service.

AI connection

Signed-in users can connect AI tools such as Claude or ChatGPT to Thrupage for free. Free users agree to keep their records on our server the first time they connect, and nothing is stored on our server before they agree. Once connected, the AI tool, as you ask it to, reads your pages and tasks, adds tasks, notes, text such as summaries, and boxes to today's page, edits a task's title, note, due date, labels or priority or marks it as completed or cancelled, comments on tasks, and creates new labels. It writes only to today's page; past pages are read-only. It edits paragraphs you wrote, moves your content or boxes, changes a box's name or color, or edits the title, due date or labels of a task you created when you ask it to in that request. It can change a task's note or priority without being asked, and can overwrite the note. What it changes on today's page shows when and that AI did it. AI tools have no way to delete tasks; tasks you don't need are closed as cancelled. It cannot edit or delete comments you wrote, and can delete only its own comments. A comment written by an AI tool is stored with the name of that AI app (the connection name), which is shown next to the comment. Text the AI tool wrote itself, and empty boxes it created, can be removed or rewritten by the AI tool until you edit them. What it reads is sent to the provider of the AI tool you connected, and that company's privacy policy applies. The Operator keeps the connection details (a hashed value of the token, its name and time zone) until you delete your account, and a record of the changes the AI tool made (tool name, a shortened request, the result, and an identifier of the connected AI app or connection token) for 90 days. We also store when each connection was first and last used (updated at most once a day), without request content. This usage time is deleted if the connection goes unused for 90 days, or within a day if you revoke a connection token in the app. Images in your pages are passed to the AI tool you connect only as text, such as "[Image: description]". Images attached to task comments and stored on our server are sent as images to the provider of the AI tool you connected when it reads that comment. If you ask, the AI tool can restore today's page to an earlier version; the restored result is also kept as a new version. To understand usage and improve the service, we also store, with your account, the number of tool calls on each day you use an AI tool; this record contains no request content. You can disconnect at any time in the app's settings or in the AI tool.

Web delivery and AI connection relay (Cloudflare)

The web app (app.thrupage.com) and thrupage.com are delivered through Cloudflare (Cloudflare, Inc.). When you open a page, connection information such as your IP address, browser and device details and the requested address is sent to Cloudflare and used to deliver and secure the site (blocking attacks). Requests made through AI connections (the access token, and the page and task content read or written for your request) pass through thrupage.com to our server; Cloudflare processes them only in transit and does not store them. To prevent abuse, we count requests per connection token in memory for one minute only. Cloudflare keeps its connection logs under its own policies.

Update checks

When the mobile app starts, it checks Expo's servers (EAS Update) for new updates. This sends a random identifier created for each installation, your platform, app version information, and your IP address. No account information or content is sent. The macOS app checks for updates from ull.im and GitHub, which sends request information such as your IP address.

Payments

Payments for Pro subscriptions and the Theme Pack are processed by Apple (App Store) and Google (Google Play); the Operator does not receive your card details. To check subscription status, RevenueCat processes purchase receipts, subscription status and your app user ID (the internal ID of your signed-in account). The Operator stores your subscription status (Pro end date, trial status, Theme Pack ownership) and, to manage subscriptions and improve the service, a history of billing events (event type, trial or regular, product, store, time) with your account in Supabase. We never receive card or payment method details.

Service providers

The App uses the following services: Supabase (sign-in and sync data storage, United States), Google Firebase Crashlytics (crash reports, United States), Google Analytics for Firebase (app usage analytics, United States), Expo (app update delivery, United States), Cloudflare (web app delivery and security, AI connection relay, United States), RevenueCat (subscription management, United States), and Apple and Google (sign-in and payments). Each provider's own privacy policy applies.

• Supabase
• Google (Firebase)
• Expo
• Apple
• RevenueCat

Legal basis

We process sign-in and sync data to provide the service you requested (performance of a contract). We collect crash reports based on our legitimate interest in keeping the App stable. App usage analytics is based on your consent (given in Settings) in the EEA, the UK and Switzerland, and on our legitimate interest in improving features elsewhere. You can withdraw consent at any time in Settings. Processing through AI connection is done at your request after you connect the tool yourself, as part of providing the service (performance of a contract). Daily AI call counts, records of the days you opened the app or used an AI connection, and billing event history are based on our legitimate interest in running and improving the service.

International transfers

Sync data is stored in the United States (Supabase, us-east-1 region), and crash information, app usage analytics, update-check information and subscription status are processed by services in the United States (Google, Expo, RevenueCat). Connection information for the web app and requests made through AI connections are processed through Cloudflare (United States). Data of users in the EEA and the UK is transferred under appropriate safeguards such as the Standard Contractual Clauses offered by these providers. If you use an AI connection, what it reads is sent to the provider of the AI tool you connected, which may be outside your country (for example, in the United States).

Retention

Account information and synced data are kept until you delete your account and are deleted immediately when you do. Crash reports are kept for 90 days. App usage analytics data is kept for 14 months. Access logs at our service providers (such as IP addresses) follow those providers' retention policies. Subscription status is deleted together with your account. Payment and refund records are kept by Apple and Google under their own policies and applicable law. AI connection details are kept until you delete your account; records of changes made by AI tools are deleted after 90 days. The usage time of each AI connection is deleted after 90 days without use, or within a day for a connection token you revoke in the app. Daily AI call counts and billing event history are kept until you delete your account and are deleted immediately when you do. Records of the days you opened the app or used an AI connection are deleted after 14 months, or immediately when you delete your account. When Pro ends, your content on our server stays while your account exists; only sync across devices stops. We notify you in the app 7 days before deletion. If you delete your account before then, it is deleted immediately. Page versions are deleted 30 days after they are kept, and immediately when you delete your account. Deleted comments are removed from our server 30 days after you delete them, and immediately when you delete your account. This means content you delete or change on a page may stay on our server for up to 30 days in an earlier version. An image on our server is deleted 30 days after it stops being used on any page; if it is used again within that time, it is kept. Images are deleted immediately when you delete your account.

Your rights

You can delete your account and data in either of these ways. (1) In the App: go to Settings > Account > Delete Account, and it is deleted right away. If you signed in with Apple, the connection with Apple is also revoked. (2) If you can't use the App: email [email protected] from the address you signed in with, with the subject "Delete Thrupage account". After confirming it's you, we delete your account and all of your data on our server within 10 days and reply to let you know. This deletes your account, your synced pages, tasks, comments, labels and images, and previous versions of your pages, along with your subscription status records (RevenueCat). Payment records are kept by Apple and Google under their own policies and applicable law. To access, correct, or export your data, or to object to processing based on our legitimate interest, contact us below. If you are in the EEA or the UK, you have the right to lodge a complaint with your local supervisory authority.

Children's Privacy

The App is not directed to children and does not knowingly collect personal information from children.

Changes

We may update this privacy policy from time to time. Changes will be posted on this page.

Contact

For questions or requests about this privacy policy or your data, contact us at: [email protected]