Thoughts App Privacy Policy

Effective Date: June 1, 2025
Last Updated: June 1, 2026

Your privacy is important to us. This Privacy Policy explains how Augmntd Thoughts ("we," "our," or "us") collects, uses, processes, and protects your information when you use our mobile application and services.

1. INFORMATION WE COLLECT

Account Information:

• Email address (for account creation and communication)
• Name or display name you provide
• Subscription status and payment information (processed by Apple)
• User preferences and settings

Journal Content (Premium Subscribers Only):

• Text entries and written journal content
• Images and photos you add to entries
• Voice recordings and audio content
• Location data (when you choose to add location to entries)
• Timestamps and metadata associated with entries

Technical Information:

• Device information (model, operating system, unique identifiers)
• App usage analytics and interaction data
• Crash reports and diagnostic information
• IP address and general geographic location
• Network connection information

Location Information:

• Precise location data only when you explicitly add location to journal entries
• General location derived from IP address for service optimization
• Location data is never collected automatically without your explicit action

2. HOW WE USE YOUR INFORMATION

We use your information to:

• Provide and maintain our subscription-based journaling services
• Process and analyze your journal content to generate insights (Premium only)
• Create personalized weekly summaries and podcast content (Premium only)
• Generate writing prompts and suggestions tailored to your content
• Enable voice-to-text functionality and audio processing
• Process images you add to enhance your journaling experience
• Provide location context when you choose to add it to entries
• Manage your subscription and billing (through Apple App Store)
• Provide customer support and respond to inquiries
• Improve our app and develop new AI-powered features
• Send important service-related communications
• Analyze usage patterns to optimize performance
• Ensure security and prevent fraud

3. LEGAL BASIS FOR PROCESSING (GDPR)

We process your personal data based on:

• Consent: When you explicitly agree to data processing for specific purposes
• Contract: To provide the subscription services you've purchased
• Legitimate Interest: To improve our services, ensure security, and provide customer support
• Legal Obligation: When required by applicable laws and regulations

You have the right to withdraw consent at any time where processing is based on consent.

4. THIRD-PARTY SERVICE PROVIDERS

We work with trusted third-party service providers to deliver our services:

Infrastructure and Storage:

• Cloud infrastructure and database providers for secure data storage
• Content delivery networks for app performance optimization

AI and Processing Services:

• Artificial intelligence and machine learning providers for content analysis
• Natural language processing services for text analysis and insights
• Voice processing services for audio-to-text conversion
• Image processing services for photo enhancement and analysis

Authentication and Analytics:

• User authentication and account management services
• Analytics providers for app usage and performance monitoring
• Crash reporting and diagnostic services

Payment Processing:

• Apple App Store for subscription billing and payment processing

Data Protection: All third-party providers are contractually required to:

• Implement appropriate security measures
• Use your data only for providing services to us
• Comply with applicable data protection laws
• Delete or return data upon contract termination

We do not sell, rent, or trade your personal information to third parties.

5. DATA PROCESSING AND AI

Subscription Required: Core journaling features and AI processing are only available to paid subscribers.

Your premium content may be processed using AI services to:

• Analyze text patterns and emotional themes in your writing
• Generate personalized insights and growth tracking
• Create weekly reflection summaries
• Produce personalized podcast content from your entries
• Suggest relevant writing prompts based on your content
• Process voice recordings for transcription and analysis
• Analyze images for context and memory enhancement

AI Processing Safeguards:

• Data is encrypted during transmission and processing
• AI providers cannot access your data for their own purposes
• Processing occurs in secure, monitored environments
• No human review of your content except for technical support when requested

6. DATA STORAGE AND SECURITY

Security Measures:

• End-to-end encryption for data transmission
• AES-256 encryption for data at rest
• Secure cloud infrastructure with SOC 2 compliance
• Multi-factor authentication for administrative access
• Regular security audits and penetration testing
• Automated backup systems with encryption
• Access logging and monitoring for all data access

Data Storage Locations:

• Primary data centers in secure, compliant facilities
• Backup systems in geographically distributed locations
• All locations meet or exceed applicable data protection standards

7. DATA RETENTION

We retain your data as follows:

• Account information: Until account deletion or 7 years after account closure
• Journal content: Until you delete it or request account deletion
• Voice recordings: Processed immediately and deleted unless saved to journal
• Images: Stored as long as associated journal entries exist
• Location data: Stored only with specific journal entries you've tagged
• Technical data: Up to 2 years for analytics, immediately for crash reports after resolution
• Support communications: Up to 3 years for service improvement

You can request deletion of specific content or your entire account at any time.

8. YOUR PRIVACY RIGHTS

Universal Rights:

• Access: Request information about what personal data we have
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Request a copy of your data in portable format
• Restriction: Limit how we process your data
• Objection: Object to certain types of processing

How to Exercise Rights:

• Email us at contact@augmntd.com with "Privacy Request" in subject
• Use in-app account settings for basic data management
• Contact our support team for assistance
• Response time: Within 30 days (GDPR) or 45 days (CCPA)

9. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

California residents have specific rights under the California Consumer Privacy Act:

Categories of Information We Collect:

• Identifiers (email, name, device IDs)
• Personal records (journal content, voice recordings, images)
• Characteristics (usage patterns, preferences)
• Geolocation data (when explicitly added to entries)
• Audio/visual information (voice recordings, images)
• Professional information (if included in journal content)
• Inferences (AI-generated insights and patterns)

Your California Rights:

• Right to Know: What personal information we collect and how it's used
• Right to Delete: Request deletion of personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out: We don't sell data, but you can opt-out of targeted advertising
• Right to Limit: Limit use of sensitive personal information
• Right to Non-Discrimination: Equal service regardless of privacy choices

Sensitive Personal Information:

We may collect sensitive information including precise geolocation and personal content. You can limit our use of sensitive information by contacting us.

10. EUROPEAN PRIVACY RIGHTS (GDPR)

If you are in the European Economic Area, UK, or Switzerland:

Legal Basis Summary:

• Consent: Voice processing, location tagging, AI analysis
• Contract: Providing subscription services, account management
• Legitimate Interest: Service improvement, security, customer support

Enhanced Rights:

• Right to withdraw consent for any consent-based processing
• Right to lodge complaints with your local data protection authority
• Right to restriction of processing in certain circumstances
• Right to object to processing based on legitimate interests

Data Protection Officer: Contact privacy@augmntd.com for data protection inquiries.

11. INTERNATIONAL DATA TRANSFERS

Your data may be transferred outside your country of residence. We ensure adequate protection through:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs) for GDPR compliance
• Additional safeguards as required by applicable laws
• Regular compliance monitoring and audits

12. CHILDREN'S PRIVACY

• Thoughts is intended for users 16 years and older
• We do not knowingly collect data from children under 16
• If we discover data from a child under 16, we will delete it immediately
• Parents can contact us to request deletion of their child's data

13. COOKIES AND TRACKING

We use minimal tracking technologies:

• Essential cookies for app functionality and authentication
• Analytics cookies to understand app usage (anonymized)
• Preference cookies to remember your settings

You can control cookies through your device settings. Disabling cookies may affect app functionality.

14. BREACH NOTIFICATION

In case of a data breach:

• We will assess the risk and impact within 72 hours
• Relevant authorities will be notified as required by law
• Affected users will be notified without undue delay
• We will provide clear information about the breach and our response

15. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect:

• Changes in our services or business practices
• New legal requirements or regulations
• Enhanced privacy protection measures

Notification Methods:

• Email notification to registered users
• Prominent notice in the app
• Posted update on our website
• For material changes: 30 days advance notice

16. CONTACT INFORMATION

Data Controller: Augmntd
Email: contact@augmntd.com
Privacy Inquiries: privacy@augmntd.com

For Privacy Requests:

• Include "Privacy Request" in email subject
• Specify the type of request (access, deletion, correction, etc.)
• Provide sufficient information to verify your identity
• Include your account email address

We respond to privacy requests within 30 days (GDPR) or 45 days (CCPA).