Karishma Mhatre ("we", "our", or "us") operates the Thoughts mobile application (the "App"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the App.
This policy applies to all users worldwide. Depending on your location, additional rights and protections may apply to you — see Section 8 for region-specific details.
By using the App, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.
When you sign in using Google OAuth, we receive the following from your Google profile:
We do not collect or store your Google account password.
When you use the voice note feature, we collect:
Your voice recordings are automatically transcribed. We store:
When you create or edit text notes, we store:
When you use the "Ask AI" feature, we collect and store:
To enable semantic search across your notes and recordings, we generate and store:
We may automatically collect:
We process your personal data on the following legal grounds:
| Legal Basis | Applies To |
|---|---|
| Contractual necessity | Account creation, note storage, transcription, AI chat — required to provide the App's core features |
| Consent | Voice recording (microphone permission), Google sign-in |
| Legitimate interest | App improvement, bug fixing, security monitoring |
You may withdraw consent at any time (see Section 8). Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.
| Purpose | Data Used |
|---|---|
| Authentication and account management | Google profile (name, email, photo) |
| Voice-to-text transcription | Audio recordings |
| Note creation and management | Text notes, transcripts |
| AI-powered search and Q&A | Notes, transcripts, embeddings, chat history |
| Semantic search across your content | Text embeddings |
| App improvement and bug fixing | Technical/device information |
We do not use your data for:
Your audio recordings are transcribed using OpenAI Whisper, an open-source speech recognition model that runs on our own servers. Your audio files are not sent to any external transcription service.
When you use the Ask AI feature or semantic search:
Your notes and transcript segments are converted into mathematical vector representations (embeddings) using an embedding service (currently AWS Bedrock with Amazon Titan). Only the text content is sent; no personal metadata is included.
Our servers and cloud services are located in the United States (AWS us-east-1 region).
If you are located outside the United States, your data will be transferred to and processed in the United States. We ensure appropriate safeguards are in place:
In the event of a data breach that poses a risk to your rights and freedoms, we will:
| Service | Provider | Purpose | Data Shared |
|---|---|---|---|
| Google OAuth | Google LLC | Authentication | Name, email, profile photo |
| AWS S3 | Amazon Web Services | Audio storage | Audio recordings |
| AWS SQS | Amazon Web Services | Background jobs | Recording metadata (IDs only) |
| AWS Bedrock (Claude) | AWS / Anthropic | AI chat responses | Questions, note excerpts, conversation history |
| AWS Bedrock (Titan) | AWS | Text embeddings | Note and transcript text chunks |
Third-party privacy policies:
We do not sell, rent, or trade your personal information to any third party.
| Permission | Purpose | When Requested |
|---|---|---|
| Microphone | To record voice notes | When you first attempt to record |
| Internet | To sync data and access AI features | Always required |
The App does not request access to your camera, contacts, location, or phone storage.
Regardless of your location, you have the right to:
If you are located in the EU, EEA, Switzerland, or the UK, you additionally have the right to:
Data Controller: Karishma Mhatre (contact details in Section 11).
We will respond to any request within 30 days. If we need additional time, we will inform you (up to 60 additional days).
If you are a California resident, you have the following rights:
| Category of Personal Information | Collected | Sold | Shared for Behavioral Advertising |
|---|---|---|---|
| Identifiers (name, email) | Yes | No | No |
| Audio/electronic information | Yes | No | No |
| Internet activity (app usage) | Yes | No | No |
We do not sell your personal information. We do not share it for cross-context behavioral advertising. To exercise your rights, contact us via Section 11. We will respond within 45 days.
If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD) including:
You may file a complaint with the ANPD.
If you are located in India, you have rights under the Digital Personal Data Protection Act, 2023:
See Section 12 for grievance officer details.
If you are located in another jurisdiction with applicable data protection laws (e.g., Canada's PIPEDA, Australia's Privacy Act, South Africa's POPIA, South Korea's PIPA, Japan's APPI), you may have similar rights. Please contact us to exercise these rights.
The App is not intended for use by children under the age of 16 (or the minimum age required by applicable law in your jurisdiction). We do not knowingly collect personal data from children. If we discover that a child under the applicable age has provided us with personal data, we will delete it promptly.
We may update this Privacy Policy from time to time. The "Last Updated" date at the top will be revised. For significant changes, we will notify you through the App or via email. Continued use constitutes acceptance of the updated policy. Where required by law, we will obtain your consent before applying material changes.
If you have any questions or requests regarding this Privacy Policy or your personal data:
We will respond to your inquiry within the timeframe required by applicable law (typically 30–45 days).
In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the Grievance Officer is:
If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.