This is the boundary between your browser, thinkpool cloud, the computer running the bridge and repository, and your AI provider.
The four stops
Your browser renders the room, sends room content, and seals custom Claude provider keys.
thinkpool cloud stores account, room, readable transcript, and private room-attachment data. It relays sealed credential envelopes and operates the narrow managed features listed below.
Local bridge and repository run on the host computer. The agent reads and changes the repository there.
Your AI provider is contacted by the local agent. Prompts may include code context chosen by that agent.
What thinkpool stores
thinkpool stores account and plan data, room membership and metadata, room chat, cleaned terminal output, terminal and room events, attachments, notification subscriptions, and operational request metadata. thinkpool does not upload the repository as a file tree.
Narrow managed features
Voice dictation: when you actively record, the audio travels through thinkpool’s transcription endpoint to Groq. thinkpool does not intentionally retain the clip.
Managed terminal naming: off by default. When explicitly enabled, the bridge sends a whitespace-normalized first-task excerpt of at most 2 KB through thinkpool to Groq. Known secret patterns and oversized inputs are rejected. The full transcript, repository, room code, terminal ID, account email, and partner identity are not sent. Filtering reduces exposure but cannot guarantee that an excerpt contains no sensitive information.
Notifications, measurement, and edge metadata
After you allow notifications, the browser’s per-device push endpoint, encryption keys, and user-agent metadata are stored in Supabase. Pushes are dispatched from Vercel to the browser push service. Turn notifications off in Settings or revoke them in the browser; endpoints returning 404 or 410 are removed.
Vercel processes technical route and performance metadata. Cloudflare processes sign-up bot signals. Google Ads receives identifiers and a terminal-ready event only after you allow optional measurement; page and referrer query strings and hashes are removed first. Provider records follow the provider’s retention rules.
Attachment retention
User-uploaded room attachments are kept for up to 60 days by default; orphaned direct-upload files are removed by a nightly sweep.
Agent screenshots are normally removed when the terminal closes and swept after 21 days if cleanup did not run.
Temporary Design image drafts are removed on cancel or successful Apply and swept after 30 minutes if that cleanup did not run.
Published Design/mockup artifacts are not covered by an automatic Storage sweep today. Deleting an owned room or its owner account removes their database references, but nested Storage objects may remain until operator cleanup. You may ask privacy@thinkpool.io to remove them.
Controls
Room owners can delete a room, keep it until manual deletion, or set it to expire after 24 hours, 7 days, or 30 days. Account deletion is available in Settings.
Public technical records
The security architecture, bridge protocol and outbound domains, subprocessor inventory, vulnerability-disclosure contact, and security.txt are public technical records. They document current boundaries; they are not independent assurance.