Last updated: 9 October 2026
thinkr is designed as a private daily philosophy practice. We do not sell personal data. The app never reads your advertising identifier (IDFA) and does not show a tracking permission prompt.
AI chat is a Pro feature. When you use AI chat or debate features, your prompt, selected thinker names, and recent conversation context are sent to our Cloudflare Worker so the app can return a response. The Worker sends that content to Anthropic to generate the requested answer. Anthropic's Commercial Terms say it "may not train models on Customer Content" sent through its API (Anthropic Commercial Terms, section B), and Anthropic says it deletes API inputs and outputs from its backend within 30 days, with exceptions such as legal requirements and usage-policy enforcement (Anthropic retention page). We do not link your messages to your identity beyond a hashed install identifier used only for quota. Sample conversations in the app are scripted and send nothing.
If you speak instead of typing, your voice is transcribed by Apple's speech recognition, on your device where supported, and only the resulting text is sent. We do not receive or store audio recordings.
If you use Pro features, the same applies to them: a council question goes to Anthropic; the reflections you choose to include in a mentor letter go to Anthropic to write that letter; with thinker memory on, recent conversation turns go to Anthropic to produce a short note the app keeps on your device and sends back with later chats. The Worker does not keep your prompts or reflections.
The app stores an opaque install identifier in Keychain. It is used for quota and abuse prevention and is not your name, email address, or Apple ID.
Your saved thoughts, favorites, reminder preferences, appearance settings, and reflection history are designed to stay on your device unless the app explicitly says otherwise.
Version 1.5 and later has an optional feedback form; version 1.4.2 does not. If you send feedback, the Worker stores: the option you chose, any text you write (up to 1,000 characters), an email address only if you switch on "You may contact me" (up to 120 characters), the app version, build and screen, a random feedback ID made on your device, and a hash of your install identifier (used to limit repeat submissions). Records expire automatically after 400 days. We read them, and may copy them into our own private tools to answer you or fix a problem; urgent bug reports may be forwarded to us immediately. The text is never put into analytics. Please do not include anything confidential. To have a report deleted, email us the text of the report or the email address you gave and we will delete it; we cannot look reports up by your name or Apple ID.
thinkr sends small analytics events to our Cloudflare Worker so we can understand whether the app is working and what to improve next. These events include coarse actions such as app opens, paywall views, chat success or failure, debate success or failure, and which app tab was viewed. They do not include your prompts, AI transcripts, reflection text, saved notes, feedback text, email address, Apple ID, or your advertising identifier.
The Worker hashes the install identifier before storing analytics and folds events into aggregate daily counters.
Purchases and subscriptions are made through Apple's App Store. We do not receive or store your card details. RevenueCat receives your purchase receipts and an anonymous app user ID so it can confirm your subscription and unlock Pro.
The app uses Firebase Analytics and Crashlytics, both from Google, to count usage (screens, lessons, paywall views) and to collect crash and diagnostic reports. They use an app-instance identifier, not your name or email.
The app includes the Meta and TikTok SDKs, which we use to measure whether our ads lead to installs and subscriptions. Events such as onboarding steps, subscription starts and purchases are sent to them, each with its own anonymous device identifier. These events never contain your chats, reflections or notes. The app never reads your advertising identifier (IDFA) and does not show a tracking permission prompt, so those SDKs do not receive it.
We use Cloudflare to host the Worker, Anthropic to provide AI responses, Apple for purchases and speech recognition, RevenueCat for subscriptions, Google (Firebase Analytics and Crashlytics) for analytics and crash reports, and Meta and TikTok for ad attribution. AI prompts are used only to provide app functionality, never for advertising.
We do not collect your name, location, contacts, health data, photos, browsing history or audio recordings, and we do not read your advertising identifier. The only contact detail we receive is an email address you choose to type into the feedback form (see above).
The Worker does not keep your prompts or reflections. Analytics are kept as aggregate counters. Feedback records are kept for up to 400 days (see above). To ask us to delete data associated with your install identifier, email us below. Deleting the app removes everything stored on your device.
Questions? Email get.thinkr.app@gmail.com.