ThoughtSpasm
Privacy policy

Your messages are evidence, not training data.

Last updated May 12, 2026Plain-English summary at the top of each section.
ThoughtSpasm exists so you can send yourself a half-formed thought and have it become something useful. To do that we ingest the messages you send to yourself through the messaging app you paired. This policy explains exactly what we collect, why we collect it, where it lives, and the controls you have over it. If anything below is unclear, write to us — we'll rewrite it.

What we collect

In short
Only the messages you send to yourself in the messaging app you paired, the items we derive from them, and the minimum account metadata needed to keep the system running for you.

When you pair your messaging account with ThoughtSpasm, we ingest messages you send to yourself — text, links, and timestamps. We do not ingest messages from other chats, group conversations, contacts, media galleries, or anything outside the self-chat scope you paired.

We also collect the operational data needed to run the product on your behalf: an account identifier, your timezone (so reminders fire at sensible local hours), device push tokens, and a paired-session token that proves your phone authorised the connection.

How we use it

In short
To turn messages into items, to rank them, to notify you at appropriate moments, and to keep the service running. Nothing else.

We use the messages you've sent yourself to derive the items shown in the app — reminders, tasks, notes, links, and questions. We use your item history to determine priority, to schedule push notifications, and to power the search and rescheduling tools.

We use operational telemetry (errors, response times, processor attempts) to keep the service reliable. This telemetry never includes the contents of your messages.

AI processing

In short
We send the minimum context to a third-party language model to reconcile your items. We don't use your data to train any model, ours or theirs.

ThoughtSpasm uses Google's Gemini family of language models to read new messages and decide whether to create, update, resolve, or cancel an item. For each new message we send: that message, your recent messages in the same chat (a short window), and a slim description of your currently active items. We do not send your full history or anything from other accounts.

We have configured our usage of the Gemini API so that your prompts and completions are not used to train Google's models or those of any third party. We do not use your data to train any model of our own.

Who we share it with

In short
Service providers we need to run the app — never advertisers, never data brokers.

We share data with a small set of vendors strictly necessary to operate ThoughtSpasm: a cloud database provider for storage, the Gemini API for reconciliation, Expo's push delivery infrastructure for notifications, and an analytics provider that receives aggregate, non-content event counts (e.g. "screen viewed", "notification opened").

We do not sell your data. We do not share it with advertisers. We do not share it with other ThoughtSpasm accounts under any circumstances.

Storage and retention

In short
Stored in encrypted databases hosted in the EU. Kept for as long as you have an account. Hard-deleted within 30 days of account closure.

Your data is stored in encrypted databases hosted in the European Union. Backups are encrypted, geographically separated, and rotated on a 30-day cycle.

You can delete any individual message or item at any time. When you delete an item, every history entry derived from it is removed; when you delete a message, every derivation traceable to it is also purged. Closing your account triggers a hard delete of all personal data within 30 days, including from rolling backups.

Security

In short
Encrypted in transit and at rest. Pairing tokens are revocable from your phone. Two-person review on any production data access.

All traffic between your devices and our servers uses TLS 1.3. Data at rest is encrypted with AES-256. Access to production data requires the requestor and a second engineer to approve the operation in an audit log.

You can revoke the pairing at any time from inside your messaging app's linked devices screen. Once revoked, ThoughtSpasm immediately stops receiving new messages from that account.

Your rights

In short
Access, export, correction, deletion, and the right to object — for everyone, not only EU residents.

You have the right to know what we hold about you, to export a copy of it, to correct anything inaccurate, to delete it, and to object to the processing described above. These rights apply to all ThoughtSpasm users regardless of where you live.

To exercise any of these rights, email hello@echoeyecodes.com from the address linked to your account. We respond within 14 days and never charge a fee.

Children

In short
ThoughtSpasm is for adults. We don't knowingly collect data from people under 16.

ThoughtSpasm is not directed to children under 16. If you believe a child has paired a messaging account with ThoughtSpasm, write to us and we will delete the account and all associated data.

Changes to this policy

In short
We'll tell you in-app before any material change takes effect. Old versions stay archived and linkable.

We will update this policy as the product evolves. Material changes — anything that expands what we collect, what we share, or how long we keep it — will be announced in the app at least 14 days before they take effect. We keep an archive of every prior version linked from this page.

Contact us

Questions about this policy, or about how we handle a specific piece of data, go to hello@echoeyecodes.com. A real person reads everything that comes in.