What we collect, why we collect it, who we share it with, your rights, and how we keep it all secure. This policy covers your rights under the EU General Data Protection Regulation (GDPR). Questions: email privacy@thinkpool.io.
Who we are
thinkpool is built and operated by Thinkpool, UAB, a private limited company registered in the Republic of Lithuania. Thinkpool, UAB is the Data Controller for personal data processed through this service. Contact: privacy@thinkpool.io.
What we collect
Account data: your email address (required), the display name you choose, and, if you sign up via Google, your Google account name and profile picture.
Session and terminal data: session names, IDs, and join codes; the record of what happened in each agent terminal; deliberately uploaded room attachments and agent-published images or previews; presence signal (whether you are currently connected).
Notification preferences: if you opt in, the push-notification endpoint your browser provides (a per-device URL, not your contact details).
Rooms are shared with the partner you invite. When you share a room link, your partner can read and steer every terminal in that room for as long as it exists. You can close a room, remove a partner, or delete the room at any time.
What we do NOT collect
Your custom Claude provider key, in any readable form. It is encrypted in your browser to your bridge’s own public key and decrypted only by the bridge running on your own machine. The encrypted envelope does travel over our transport; the private key that opens it never leaves your machine. We never receive the key in the clear and cannot decrypt it.
A repository copy. thinkpool does not crawl or upload your repository as a file tree. The local runtime may send relevant code context to its provider. Files deliberately attached to a room are stored separately in private Supabase Storage.
No third-party tracking or advertising cookies. No Google Analytics, Facebook Pixel, or session-recording tools.
No data sold to third parties, and no advertising profiles.
No training our own or third-party models on customer room content.
No accounts knowingly created by anyone under 16.
Important: the record of what an agent terminal does, including file edits, commands, and messages, is stored so the room can be reopened and reviewed. Don’t put sensitive personal data, passwords, or confidential business information somewhere a room partner shouldn’t see it.
Who we share your data with
We route data through a small set of sub-processors:
Stripe (USA): subscription billing for the Plus plan. Your card is entered on Stripe’s own checkout; thinkpool never receives or stores it.
Vercel (global edge): hosting, serverless functions, push-notification dispatch, web analytics, and performance measurement.
Browser push services (global): delivery of notifications you opt into through the service selected by your browser, such as Google FCM, Mozilla Autopush, or Microsoft WNS. They receive the per-device push endpoint and encrypted notification payload.
Google Ads (global): optional conversion measurement only after you allow it. Google receives advertising click identifiers, consent signals, technical browser metadata, a redacted page URL and referrer, and the fact that a coding terminal became ready.
Cloudflare (global edge): bot protection on sign-up (Turnstile).
Groq (USA): voice-dictation transcription and, only when explicitly enabled, managed terminal auto-naming. Voice uses audio you actively record. Naming uses a whitespace-normalized first-task excerpt of at most 2 KB after known secret patterns and oversized inputs are rejected. thinkpool does not intentionally retain the audio clip or naming request.
Your runtime’s AI provider is not a sub-processor of ours: the local coding agent calls that provider directly. Claude Code uses the host’s Anthropic login or a registered Anthropic-compatible provider. Codex uses the host’s Codex/OpenAI login. Hermes Agent uses an isolated thinkpool ACP profile. A custom Claude provider key is encrypted in your browser to your bridge’s public key before it is transmitted; we never receive it in readable form and cannot decrypt it. Two narrow managed features use Groq on thinkpool’s key: voice dictation that you actively record, and terminal auto-naming when that server feature is explicitly enabled. Managed naming is off by default. When enabled, it sends the minimized first-task excerpt described above, not the full transcript, repository, room code, terminal ID, account email, or partner identity. Filtering reduces exposure but cannot guarantee that an excerpt contains no sensitive information.
We announce material sub-processor changes before they take effect, except when an emergency security replacement makes advance notice impractical.
Your rights under GDPR
If you are in the EU or EEA, you have the rights of access, correction, erasure (right to be forgotten), portability, objection, and withdrawal of consent. To exercise any right, email privacy@thinkpool.io: we respond within 30 days. You can also delete your account directly from Settings → Danger zone. You may lodge a complaint with your national data protection authority; thinkpool’s lead supervisory authority is Lithuania’s State Data Protection Inspectorate (VDAI).
Data retention
Account data: kept until you delete your account.
Session and terminal records: kept until you delete the session or your account by default. A room owner can instead choose automatic deletion after 24 hours, 7 days, or 30 days.
User-uploaded room attachments: kept for up to 60 days by default while a room exists; orphaned direct-upload files are removed by a nightly sweep.
Agent-published screenshots: normally removed when the terminal closes and swept after 21 days if cleanup did not run.
Temporary Design image drafts: removed on cancel or successful Apply and swept after 30 minutes if that cleanup did not run.
Published Design/mockup artifacts: not covered by an automatic Storage sweep today. Deleting an owned room or its owner account removes their database references, but nested Storage objects may remain until operator cleanup. You may ask privacy@thinkpool.io to remove them.
Except for published Design and mockup Storage objects covered by the preceding exception, deleted account data is permanently removed within 30 days of the deletion request.
Security at thinkpool
These are the specific controls currently configured to protect your data and your machine. They are not a claim that the system is finished.
Repository-local runtime: the coding agent runs on your own computer and thinkpool does not upload the repository as a file tree. The runtime may send selected code context to its provider, and files deliberately attached to the room are stored privately in Supabase. Permission prompts depend on the mode shown in each terminal; bypass permissions does not prompt for every action.
We can never read a custom Claude provider key. It is sealed in your browser to the bridge’s own public key (RSA-OAEP wrapping an AES-256-GCM session key) and unsealed only by the bridge process on your machine, where it stays on disk with owner-only permissions. The sealed envelope crosses our transport; the private key that would open it is generated on your machine and never broadcast, written to our database, or announced.
Transport: production pages and APIs are served over TLS. The site sends a two-year HSTS policy with includeSubDomains, blocks cross-origin framing, blocks MIME-type sniffing, and limits cross-origin referrers to the origin. Same-origin requests may still carry the full URL.
Access control: Supabase row-level security scopes Code room data to the account-backed owner and invited partner. The retired anonymous guest-token path is not available for Code participation.
July 2026 security pass: repository file operations are constrained to the workspace root. Internal cron endpoints compare their shared secret in constant time.
Security is not a certificate. It is a set of controls that must stay specific and reviewable. Found something? Email security@thinkpool.io.
thinkpool does not provide a routine employee feature for reading room transcripts. The two operators retain technical production access for support, security, and incident response. thinkpool is not a zero-knowledge system today because room transcripts are stored in readable form.
Cookies and children
thinkpool does not use third-party tracking or advertising cookies; Supabase Auth uses browser localStorage (not cookies) to keep you signed in. thinkpool is not intended for anyone under 16: if you believe a child has created an account, email privacy@thinkpool.io and we will delete it promptly.
Changes to this policy
For material changes that affect what we collect, who we share it with, or what you can do about it, we will notify you by email at least 30 days before the change takes effect.