ThinkForge Privacy Policy

1. Your app content

Your projects, files, notes, conversations, and other app content remain on your device. Desktop content is stored locally, and browser-extension content is stored in your browser. ThinkForge does not receive, view, use, or store that content on our servers.

We do not collect app usage analytics, crash telemetry, or your AI prompts and responses. We do not use your app content for advertising or AI training.

You control your local files and browser content, including copying, backing up, exporting, and deleting them.

2. Account authentication and licensing

We process your account email, sign-in credentials or authentication-provider records, account status, and information needed to authenticate your account, administer trials and licenses, verify entitlement, and manage activations. Supabase provides account authentication and stores the account and licensing records. We do not see your plaintext password.

If you choose Google or GitHub sign-in, that provider handles your sign-in under its own policy and supplies the information needed to authenticate your account.

The browser extensions may check your signed-in account status to unlock account features. This does not send your conversations or other app content to ThinkForge.

3. Purchases and payments

Lemon Squeezy acts as merchant of record for direct website purchases and processes payments and applicable taxes. ThinkForge receives the purchase and license records needed to link the transaction to your account, confirm entitlement, and handle purchase questions or disputes.

ThinkForge does not store payment-card or bank-account details. Payment information submitted at checkout is handled by Lemon Squeezy under its own terms and Privacy Policy. An authorized marketplace handles purchases made through that marketplace under its own policies.

4. Website, support, and previous launch notifications

The website uses cookies for sign-in, security, form protection, display preferences, and traffic reporting. Traffic reporting records pages visited, browser information, referring pages, response status, a hashed network identifier, and random browser and session identifiers (kept up to 180 days and 30 minutes). Signed-in visits can be linked to an account. Traffic records are stored in Supabase and used to understand and improve the website. The Desktop app and browser extensions do not send usage analytics.

We also use Google Analytics, which uses cookies to measure website traffic and download clicks. See how Google uses this information or opt out.

Website traffic information is used only internally to operate and improve the website. We do not sell it or share it with third parties, other than the service providers named in this policy that process it on our behalf.

Our website hosting and security providers process request information, such as network and browser information, to deliver the site, prevent abuse, and diagnose service errors. When enabled, Google reCAPTCHA helps protect signup forms and is governed by Google's Privacy Policy and Terms of Service.

If you email support, we receive your email address and the information you include, and use it to respond and resolve your request. Avoid sending private app content unless you choose to share it for support.

Launch notification signups are now closed. If you previously submitted an email address for launch or availability notices, you can ask support to remove it or opt out of those notices.

5. How we use information

We use account, authentication, licensing, and purchase information to provide account access, verify trials and paid licenses, manage activations, link purchases to the correct account, respond to requests, and prevent fraud or abuse.

We use voluntarily submitted support and previously submitted launch notification information only for the related communication and administration. Website request information supports traffic reporting, delivery, security, and troubleshooting.

We do not sell personal data, collect usage analytics from inside the Desktop app or browser extensions, or use your information for advertising profiles or AI training.

6. AI clients and connected services

You choose which external AI clients, providers, and other services to connect. An external MCP client such as Codex or Claude Code can request local project context and perform supported operations through ThinkForge's local MCP server. That client and its provider handle model traffic under their own policies and terms.

If you configure a direct AI provider connection with your own API key, the key is stored locally and prompts and responses travel between your device and the provider you choose. ThinkForge servers do not receive, store, or proxy that prompt content.

Content you deliberately send to an external client or service is handled by that third party. Review its terms and privacy policy before connecting or sharing content.

7. Service providers and disclosures

Supabase provides account authentication and account and licensing record storage. See its Privacy Policy.

Lemon Squeezy processes direct purchases as merchant of record. See its Privacy Policy.

Google Analytics measures website traffic. See its Privacy Policy.

Website hosting, delivery, security, and communication providers process the limited information necessary to provide those services. Google or GitHub may process information when you choose their sign-in service; Google may process information for reCAPTCHA when enabled.

We disclose information as required by law or valid legal process, or as necessary to prevent fraud or abuse, protect safety, or establish or defend legal claims. Contact support for information about the providers relevant to your request.

8. Security

We use standard safeguards for the limited information held by our services, including encrypted connections, authentication-provider password protection, and access controls. No system can guarantee complete security.

You are responsible for protecting your account credentials, device, local files, and backups.

9. Retention and full account deletion

We retain account, authentication, licensing, and linked purchase records while needed to provide and service your account and license. Support and previously submitted launch notification information is retained only while needed for the related communication and administration. Necessary service and security records are retained only while needed for their operational or legal purpose.

Full account deletion is permanent and removes the account and associated licensing records together. Once those records are deleted, ThinkForge cannot service the account or verify its license, and access under that license ends. We explain this consequence before processing full account deletion.

To request deletion, email [email protected]. We may take reasonable, proportionate steps to verify the request. Associated personal data is deleted within 30 days, and backup copies are purged within 90 days, except for limited records that must be retained for legal obligations, payment disputes, or the establishment or defense of legal claims. Those records are retained only for as long as the purpose and applicable law permit. We explain an applicable exception when a legally required record cannot be deleted.

Lemon Squeezy and other independent providers may retain their own records for tax, accounting, or other legal obligations under their policies.

Account deletion does not remove your local files, browser-local content, or information already sent to an external service. You control deletion on your device; uninstalling the app does not automatically delete your ordinary local project files.

10. Privacy requests and controls

Depending on applicable law, you may have rights to access, correct, receive a copy of, or request deletion of personal information, or to object to or restrict particular processing. Full account deletion is our standard account-removal process; other requests required by applicable law are handled as that law requires.

Email [email protected] to make a request or stop launch notification communications. We may verify the request and explain any applicable legal limitation. We do not penalize you for exercising an applicable privacy right; full deletion of the records needed to service your license has the account-access consequence described above.

Your local app content is already under your control. You can access, copy, back up, move, or delete it on your device without making a request to ThinkForge.

11. Children

ThinkForge is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact [email protected] so we can address it.

12. Changes to this policy

We may update this policy and its Last Updated date. Material changes will be communicated to account holders by email. New information collection or processing will be described before it takes effect.

13. Contact

ThinkForge, Wisconsin, United States

Privacy questions, account deletion, and other requests: [email protected]