Thought is a note-taking app made by Maquette Labs, Inc., a Delaware (USA) company. You talk or type; the app turns that into living notes. Because your notes can be personal, this policy is written to be read, not skimmed past. It describes what the product actually does. If anything here is unclear, email matt@maquettelabs.com and a human will answer.
We don't sell your data, and we don't share it for advertising. These providers process it on our behalf to make the product work:
| Provider | What they get | Why |
|---|---|---|
| Supabase (on AWS, US West) | Everything synced to your account | Database, storage, and sign-in hosting |
| Anthropic (US) | Note text you synthesize, chat with, or use in interviews | The AI features |
| OpenAI (US) | Mediator session audio; image prompts | Meeting transcription; image generation |
| Twilio (US) | Your phone number | Sending sign-in codes by SMS |
| PostHog (US) | Usage events from the iOS app (no note content) | Understanding what to build |
| RevenueCat (US) | Subscription status tied to your account ID | Managing subscriptions |
| Vercel (US) | Standard web server logs | Hosting this site and the web app |
| Apple | Coordinates, for reverse geocoding into a place name (if location is on) | The place-name stamp |
| Open-Meteo | Approximate coordinates (if location is on) | The weather stamp |
| Notion | Notes you choose to send, only if you connect Notion | The Notion integration |
Under our providers' API terms, Anthropic and OpenAI do not use your content to train their models. If you paste a link from a social platform, the app fetches that link's public content from third-party services — those services see the URL you pasted, nothing else about you.
Your data is stored in the United States. If you use Thought from the EEA, the UK, or Switzerland, your data is transferred to the US. Those transfers rely on our providers' data processing agreements, which incorporate Standard Contractual Clauses (and the UK and Swiss addenda) as the transfer safeguard. If you use Thought from a country whose law requires your data to be stored locally, we cannot meet that requirement — Thought runs on US infrastructure only.
If you are in the EEA, UK, Switzerland, Brazil, or another jurisdiction with a data protection law, these mechanisms are how we honor your access, portability, rectification, erasure, and objection rights. Our legal bases are performance of our contract with you (running the product you asked for), your consent (location stamps, session recording, connecting Notion), and legitimate interests (keeping the service secure). You can also lodge a complaint with your local data protection authority.
Two features touch people who never signed up. If you try the demo on our homepage and ask us to text you the result, we store the thought you typed and the phone number you entered so you can claim that thought if you later create an account. If a Thought user invites you to a thought by phone number, we store that number so the invite can reach you. In both cases, email matt@maquettelabs.com and we will delete what we hold about you.
Mediator sessions record everyone in the room. The room displays a recording notice before the session starts. If you run a session, it is your responsibility to make sure everyone present has agreed to be recorded — many places require the consent of every participant.
Thought is for adults. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it.
Data is encrypted in transit and at rest by our hosting provider, access is controlled per-account by row-level security, and we collect as little as the product needs. No system is perfect: if a breach affects your data, we will notify you and the relevant authorities as the law requires.
If this policy changes in a way that matters, we'll say so in the app or by SMS/email before the change takes effect. The effective date at the top always tells you when it last changed.
Maquette Labs, Inc. · matt@maquettelabs.com