Privacy policy

ThoughtStream Lab is both the app and the business behind it. It is owned and operated by SK America LLC, and it is SK America LLC that runs the app and is the company responsible for the data described in this policy.

ThoughtStream Lab is a place to think in private. What you write is yours. We do not sell it, we do not advertise against it, and we do not use it to build a profile of you. It is held so the app can work for you and nothing else.

The text of your thoughts is scrambled before it is stored, each account is isolated from every other, and you can delete your account and everything in it from inside the app.

If you live in California, your rights under California law are set out in full further down this page.

• Your account: the email address you signed up with, your name, whether you are the app owner, and the date you confirmed you are 16 or over. The app keeps that confirmation, never a birth date.
• What you capture: every thought you write or speak, the words as first captured, and any edits you make.
• What the assistant writes from it: refined wording, summaries, tags, suggested evidence states, connections, drafted text, letters, and web research.
• What you decide: evidence states and their history, commitments, and weekly reviews.
• What you set up yourself: letterhead templates, sign-off blocks, the note you leave about how you write, and your own AI provider key if you save one.
• Your plan: which tier you are on, its status and renewal date, and the customer and subscription references your payment provider gives us. Card numbers never reach the app.
• Your calendar link, if you use it: the private feed address and its long random token.
• A sign-in token in your browser, so you are not asked for your password on every page.

If you live in California, state law gives you rights over your personal information. This is where we set out how they work here. We do not sell your personal information, and we do not share it with other companies for their advertising, so the “do not sell or share” part of those rights has nothing to switch off: there is no sale or sharing to stop.

• To know what we hold about you, and to receive a copy of it. Export gives you your entries; write to us for the account and plan records that surround them.
• To have it deleted. The danger zone in Settings deletes your account and everything in it, and you can ask us to do it for you instead.
• To have it corrected. You can edit your entries and your name yourself; write to us about anything you cannot reach.
• To say no to the sale or sharing of your personal information, and to its use for targeted advertising. We do neither, and nothing you write is handed to a data broker.
• To limit the use of sensitive personal information. What you write can be deeply personal, which is why it is scrambled before storage and used only to run the app for you.
• Not to be treated differently for asking. Exercising any of these rights never costs you access, features, or a different price.

To use any of them, write to us from the email address on your account. Privacy questions and requests go to privacy@thoughtstreamlab.com, or use the contact page, or write by post to SK America LLC, 255 N D St, Suite 200XIX, San Bernardino, CA 92401, and tell us what you would like. We answer within 45 days, and usually much sooner. We may ask you to confirm that it is really you before we hand anything over, and someone you authorise in writing can ask on your behalf. If we cannot do what you have asked, we will tell you why.

California's “Shine the Light” law also lets you ask, once a year, for a list of the companies we have given personal information to for their own marketing. We do not give anyone your personal information for their own marketing, including your email address, so that list would be empty. If that ever changes, this page will say how to ask for it.

We do not follow you around the web. The only tracking connected to ThoughtStream Lab sits on our public sign-up and pricing pages, and it counts visits and completed sign-ups there. There is no tracking inside the journal, and nothing you write is ever put into an advertising or analytics network.

Because we do not track you across other companies' websites, there is nothing for a browser's “do not track” or Global Privacy Control signal to switch off: we do not sell or share your personal information, and we treat that signal the same as we treat every other request to leave you alone. Blocking the tags on those public pages changes nothing about how the app works for you.

Voice capture is transcribed by your own browser, not by us. The app stores the words, never a recording, so there is no audio of you sitting on our servers. Speech recognition in some browsers is provided by the browser's maker, and how they handle the audio is governed by their privacy terms rather than ours.

The text fields that hold your own words, in thoughts, patterns, commitments, reviews, evidence notes, letters, letterheads, signatures and your saved provider key, are scrambled before they are written to the database. Each account has its own key material, so one account's records cannot be read with another's.

The app's own access rules only ever let an account reach its own records, and the owner's dashboard shows counts and plans, not what anyone wrote. The app's backend runs with higher access as it does the work you asked for, such as counting the month's allowance and deriving your key for a page you are reading.

Card numbers never touch the app: your payment details go straight to Base44 Payments, our payment provider, and what comes back to us is a reference to the charge, never the card.

When you ask for analysis, a proofread, a draft, a letter, pattern discovery or a weekly review, the text that action needs is sent to the AI service that produces it, and the result comes back to your account. For writing actions, a few short samples of your own recent entries are included so the writing sounds like you.

If you save your own AI provider key, those actions run on your own provider account instead, under your agreement with that provider. Web research is the exception: it always runs on the app's own search-grounded model, because that is the only way to search the web for it.

Nothing here is used for advertising, and your words are not sold or rented to anyone. In the course of running the app we use a short list of companies, and each one is given only what its job needs:

• Our hosting and database provider, which stores the app's records.
• The AI providers that produce an analysis, a proofread, a draft, a letter or a review when you ask for one. Which of them answers depends on the action and your plan.
• Base44 Payments, which handles checkout, cards, receipts and refunds.
• Our email service, which sends sign-in codes, confirmation links, reminders and receipts.
• Google, but only if you connect your own Google Calendar, and only for the events the app adds.
• Meta and X, and Google when we advertise there, and only on our public sign-up and pricing pages.

Keeping you signed in uses a token in your browser's own storage. It is not an advertising cookie, it is not shared with anyone, and it goes when you sign out or delete your account. Nothing about your thoughts is ever put in a cookie.

To bring people to ThoughtStream Lab we advertise, and the tools we use count visits to our sign-up and pricing pages and completed sign-ups. Meta (Facebook) and X each place their own tracking tag on those two pages, and Google Ads, when we run campaigns there, uses Google's own conversion tracking on the same pages. Each of those networks may set its own cookie or identifier in your browser under its own privacy policy, and each can see that you reached those pages.

Those tags are never loaded once you are signed in, so what you capture, what the assistant writes from it, and everything else in your ledger stay out of them. If you would rather not be counted, your browser's settings let you block third-party cookies and tracking, and each network offers its own advertising preferences through Meta's ad settings, X's privacy settings and Google's ad settings. Blocking any of them changes nothing about how ThoughtStream Lab works for you.

You can point an AI assistant of your own, such as Claude, ChatGPT or Cursor, at your ThoughtStream Lab account. The assistant then acts as you and can only reach your own records. Before it is connected, the app shows you the list of things it is asking to be able to do, and you approve or refuse it yourself. You can end that access at any time by disconnecting it in your AI client, or by asking us to.

Anything you choose to paste or hand to an assistant outside the app is governed by that assistant's own terms, not by ours.

If you connect your own Google Calendar, you sign in with Google and grant access for the events the app adds; the permission is yours and can be withdrawn from your Google account at any time. If you use the private feed instead, the address contains a long random token that stands in for your account: anyone who has that link can read the dated commitments in it, so treat it like a password. You can replace it in the app to cut off the old link.

Your entries stay while your account does. Deleting your account removes them, and everything the assistant derived from them, from the app straight away. Copies that sit inside a routine backup are replaced as those backups roll over, and they are never used to bring a deleted account back to life.

A few things outlive the account, because the law or the running of the app requires it: the payment provider keeps its own record of the charges it processed, we keep plan and receipt records for as long as tax and accounting rules require, and the record that mail went out from an account is kept while that account exists so the daily sending limit can be counted. None of it contains what you wrote.

Your entries stay while your account does. You can export your thoughts whenever you like, and you can delete your account in Settings, under the danger zone. Deleting your account removes your entries and everything the assistant derived from them from the app. You can also write to us and ask, and we will do it for you.

Your words are scrambled before storage, accounts are isolated from one another, and card details never reach us. We keep the app's access rules tight and review them as the app changes.

No service can promise that nothing will ever go wrong. If a breach ever did expose your personal information, we would tell you and the California Attorney General without unreasonable delay, as California law requires, and we would tell you what we know and what we are doing about it rather than waiting until we knew everything.

ThoughtStream Lab is not for children. It is meant for people aged 16 or over, and we do not knowingly hold an account for anyone younger.

If this policy changes in a way that matters, we will update the date at the top of this page and tell account holders by email. Continuing to use ThoughtStream Lab after a change means you accept the updated policy.

Write to privacy@thoughtstreamlab.com from the email address on your account and tell us what you need, or write by post to SK America LLC, 255 N D St, Suite 200XIX, San Bernardino, CA 92401. Requests about your own data are handled before anything else. You can reach us on the contact page, and the limits of each plan are set out in the usage and limits page.