Privacy Policy

thumbs.work is built to be private by default. The short version: the app works fully offline and needs no account. If you never sign in, nothing you write ever leaves your device. Signing in is optional, and the only thing it adds is syncing your documents between your own devices.

There is no analytics and no tracking, signed in or not. The free app shows one promo card for our own apps; it is not a third-party ad network and it does not follow you around. We never sell or share your data.

If you don’t sign in

Your documents live on your device and nowhere else. Nothing you write is sent anywhere. The one request the app makes without an account is to ask our own ad server which promo card to show (see Promos below); it carries no document data. If you export or share a document, that happens through your own device’s share sheet, entirely under your control.

If you do sign in

An account exists for one reason: so your documents and settings follow you between your devices. Sign-in is passwordless — you give us an email address and we send you a one-time link. We store:

• Your email address, to send sign-in links and, rarely, service notices. We don’t send marketing email.
• Your documents, so they can sync. They are stored on our servers in the United States (New York), hosted on DigitalOcean.
• Your devices and sessions, so you can see what’s connected and sign any of it out.
• Your subscription status, if you buy Pro — see below.

How your synced documents are protected

On your device, documents belonging to a signed-in account are encrypted at rest with a key held in your device’s secure keychain. In transit, everything travels over HTTPS.

To be straight with you about the limit of that: sync is not end-to-end encrypted. Documents are stored on our server in a form we could in principle read. We don’t read them, and nothing in the product does anything with their contents — but we’d rather state that plainly than let “encrypted” imply more than it does. If you want a document to stay only on your device, don’t sign in.

Subscriptions

thumbs.work Pro is purchased through Apple. We never see your card details or your Apple ID — Apple handles payment and tells us only whether a subscription is active and when it expires. We store that, so the app knows you’re on Pro.

Promos

The free app shows a single dismissible card promoting our own apps. The copy for it is served by the same ad server that runs podcasts.so, which we host ourselves, so we can change the wording without shipping an app update and can see whether the card is ever tapped.

To count a card being shown or tapped without counting the same phone twice, the app sends a random per-install id. It is generated on your device, it is not Apple's advertising identifier (IDFA) or device identifier (IDFV), it is not derived from anything about you or your hardware, and it is destroyed when you delete the app or clear its storage. Each app generates its own, so the id here cannot be matched to the one in any other app of ours — showing you a promo never tells us what you do elsewhere.

No third-party ad networks, no cross-app tracking, and no data sold or shared for advertising. The promo does not read your documents and is not targeted by anything you write. A thumbs.work Pro subscription removes it.

Crash reports

When the app or the website hits an error, it sends a crash report to error tracking we host ourselves — not a third-party service. Those reports carry a stack trace, your app and OS version, and the build number. They deliberately exclude your document contents, your keystrokes, screenshots, and request bodies. Older reports are discarded automatically once a fixed storage cap is reached.

Who else touches your data

Only the infrastructure needed to run the service: DigitalOcean (servers and database), Postmark (delivering sign-in emails), Fastmail (receiving mail you send us), Apple (payments, if you subscribe), and our own podcasts.so server (which promo card to show). No advertising networks, no data brokers, no analytics vendors.

Data you control

You can export everything as JSON, Markdown, CSV, or plain text at any time, and delete documents from within the app. You can sign out any connected device from the account page. To delete your account and everything stored with it, email support@thumbs.work and we’ll erase it. Deleting the app removes the copies on that device.

Children

thumbs.work isn’t directed at children under 13, and we don’t knowingly collect their information.

Changes

If we change what we collect or why, we’ll update this page and say so in the app before the change takes effect.

Contact

Questions about privacy? Email support@thumbs.work.

See also our Terms of Use.