Privacy Policy
Thoughts is a personal digital journal. Your entries belong to you. In addition to local storage, the features you use may trigger data transfers. This statement describes what data is processed in this process, which Apple services are used, and what rights you have.
Data Controller
Luca Ring
Im Heidekämpchen 20
45665 Recklinghausen
North Rhine-Westphalia
Germany
Phone: 0156 796 881 80
Email: Luca.ring2004@icloud.com
1. Data Controller
The person listed above is responsible for the processing of personal data in connection with the provision of Thoughts.
The app is offered purely for private use and without any commercial intent. There are no purchases, no subscriptions, and no advertising.
A data protection officer has not been appointed, as the legal requirements for doing so have not been met.
2. Overview of Data Processing
Thoughts generally stores diary entries on your device. The provider does not operate a server for these entries and does not receive a copy of your content through normal diary use.
Network connections occur in particular during iCloud syncing, link previews, loading the developer map, and opening external pages. If you send the provider an email, they will receive the information you provide.
The app contains no advertising SDKs and no proprietary tracking or analytics services for evaluating your usage behavior. Local technical diagnostics are described in Section 13.
3. Content and Local Features
Your chats, entries, attachments, drawings, tasks, reminders, and journal content are processed, as well as settings such as language, display, and app lock.
This processing is necessary to provide the storage, display, search, and editing features you use. To the extent that the provider is the data controller under data protection law, the legal basis is the provision of the agreed-upon features (Art. 6(1)(b) GDPR). The provider does not read your local entries.
Disabling app synchronization does not prevent the other connections described in this statement. Operating system backups and device features you have set up may also transfer data to other devices or to a storage location of your choice.
4. iCloud Synchronization
The app uses Apple’s iCloud Keychain to sync chats, entries, and supported settings, as well as an iCloud file container for attachments. No CloudKit database is used.
Synchronization uses only the iCloud account set up in the device’s System Settings. Thoughts does not have its own login or user account. Synchronization will not occur until you explicitly confirm it under Data Management. Your selection is saved on this device and can be revoked there.
Very large attachments over 200 MB and chat background images are not transferred via this synchronization. The provider does not have administrative access to your personal iCloud content.
The legal basis for voluntary synchronization is your explicit consent (Art. 6(1)(a) GDPR; insofar as special categories of data you have entered yourself are involved, Art. 9(2)(a) GDPR). Local use is possible without this consent. Withdrawal of consent does not affect the lawfulness of prior processing. Turning off this feature stops further app syncing but does not delete cloud data that has already been stored.
Apple processes data to provide iCloud in accordance with its own privacy policy: https://www.apple.com/legal/privacy/de-ww/.
5. No App Accounts
Thoughts does not offer registration or a user account within the app. The app therefore does not collect any app-specific user ID, name, or email address for a profile.
The optional iCloud sync uses the Apple ID exclusively at the system level via Apple’s iCloud services. Thoughts does not receive your Apple password or its own login profile.
Support emails do not contain any automatically included user IDs. You decide what information to include before sending; details are provided in Section 15.
6. Permissions and Voice Input
The camera and photo selection features are used to add the images you select. The microphone and speech recognition are used for voice input that you initiate. Notifications are used for local reminders.
For voice input, an audio file is temporarily created on the device. It is scheduled to be deleted upon completion or cancellation. In the event of an unexpected termination, temporary files may remain until they are later cleared. The text that was captured is saved as the entry, not the recording.
The app’s built-in voice input processes audio exclusively on the device. If local recognition is unavailable or fails, there is no automatic switch to online recognition; in this case, the transcription cannot be completed. As a result, the provider receives neither the recording nor the transcript. Any independently used dictation feature of the system keyboard is governed by your Apple settings.
Face ID, Touch ID, or the device passcode are verified by the operating system. The app receives the authentication result, not any biometric data.
Processing to perform the requested function is based, to the extent the provider is responsible, on Article 6(1)(b) of the GDPR. You can revoke required system permissions in your device settings; the relevant function will then be restricted. Granting system access does not automatically constitute consent under data protection law for all further processing.
7. Link Previews
Only when you enable link previews under Data Management can Thoughts automatically retrieve the linked page and its icons when displaying entries with internet links, even before you tap the link. The servers of the page, its redirects, and, if applicable, external icon providers receive, in particular, your IP address, the requested URL, and technical request data.
The preview retrieval does not use any stored browser cookies or login credentials. Titles and icons are cached locally. After 14 days, a stored preview is considered outdated and may be replaced the next time it is retrieved; this is not a guaranteed deletion period for the cache file.
Previews are initially disabled. The legal basis is your voluntary consent by enabling them after viewing the displayed notice (Art. 6(1)(a) GDPR). You can disable them at any time under “Data Management” with future effect. This will cancel any ongoing requests and clear the local preview cache. Requests that have already been transmitted cannot be undone as a result. Normal links remain usable without a preview.
When you open a website, that site’s privacy policy also applies. These network accesses may occur even if iCloud syncing is disabled.
8. Backup, Restore, and Sharing
You can export content, share it using the system’s Share feature, and create or restore a backup in Data Management. In doing so, the content required for the selected function and any available attachments are processed (Art. 6(1)(b) GDPR).
A backup file contains personal content. Thoughts does not encrypt these files with its own password. Anyone who can access the file can, in principle, also read its contents. Choose the storage location and recipient accordingly.
During restoration, existing chat and journal data will be replaced by the data from the backup. If iCloud sync is enabled, restored data can then be synchronized.
Exports and backups created outside the app are not automatically deleted when you delete entries or reset the app’s data. The privacy policy of the storage or delivery service you choose applies.
9. Recipients and International Processing
The app does not sell any personal data and does not use your content for advertising. No automated decision-making with legal or similarly significant effects takes place.
Depending on the features you use, recipients may include, in particular, Apple, operators of linked websites and their resources, as well as the email, export, and storage services you have selected. For support requests, the provider is also a recipient.
These services may also process data outside the European Economic Area. For information on Apple’s processing and the safeguards described there, see https://www.apple.com/legal/privacy/de-ww/. For freely selected websites and services, recipients, processing locations, and safeguards depend on the respective service; processing exclusively within the EU is not guaranteed.
10. Storage and Deletion
Entries remain stored until you delete them. Deleted chats remain in “Recently Deleted” according to your retention setting: 30 days by default, or alternatively 7 or 90 days, or without automatic deletion. Once the retention period expires, the data is permanently removed through automatic cleanup. Independent backup copies may still exist.
You can use “Reset App Data” to remove local content and settings. Copies already stored in iCloud or exported will not be automatically deleted as a result.
Turning off syncing does not delete journal entries or existing cloud copies. Uninstalling the app does not reliably delete iCloud copies or backups that have already been exported.
For cache files, diagnostics, and support messages, the relevant information in this statement applies. The provider cannot restore local or private iCloud content for you.
11. Your Rights
You have the following rights in particular: right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object to processing (Art. 21 GDPR), provided that the legal requirements are met.
If processing is based on your consent, you may withdraw it at any time with future effect.
You can edit, export, and delete local entries yourself. For processing activities under the provider’s responsibility—such as support messages—you can exercise your rights with the provider. The self-management features do not replace these rights.
If you still have a question about data protection, you can contact the data controller at Luca.ring2004@icloud.com.
If you believe that the processing of your data violates data protection law, you may file a complaint with a supervisory authority. The authority responsible for the provider is: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf.
12. Children and Adolescents
The app does not have its own registration process. For Apple services such as iCloud, Apple’s age and account requirements also apply.
To the extent that data processing in an online service directed specifically at children is based on consent, the consent of a legal guardian is required for users below the legal age limit; in Germany, this limit is generally 16 years of age (Art. 8 GDPR). This is to be distinguished from legal capacity and an App Store age rating.
The network features described may transmit data when activated. The absence of advertising therefore does not mean that all data remains exclusively on the device.
13. Additional Apple and Device Features
When you open the Developer section, a map is loaded via Apple Maps. This establishes connections to Apple, which involve technical connection data. The map displays a specific location in Recklinghausen; it does not require your current location to do so. This processing serves to clearly illustrate the developer’s location and is based on our legitimate interest in providing an informative design for this section (Art. 6(1)(f) GDPR). You can prevent this data transfer by not opening the Developer Area.
The app receives MetricKit diagnostic reports provided by iOS and stores the most recently received report locally; the app does not automatically send reports to the provider. A new report replaces the previous one. This serves the purposes of error analysis and stability (Art. 6(1)(f) GDPR).
When using widgets, Apple Watch features, or the optional Spotlight search, the content required for these features may be transferred to associated app components, your paired Watch, or the local search index. This is done to provide the features you use (Art. 6(1)(b) GDPR).
Accessing linked services such as Instagram, Threads, or the developer’s website results in processing by their respective operators. This policy describes the app; for the website, its own hosting, font, and other services must be considered separately.
14. Changes to This Policy
This Privacy Policy will be updated if the app, its features, the services used, or legal requirements change.
15. Support and Contact
If you send a support request or a feature suggestion via email, the provider receives your sender address, the message text, and any attached content, as well as standard email metadata. The app does not automatically add a user ID and does not automatically send the email.
The data is used to process and respond to your request. The legal basis is Article 6(1)(b) of the GDPR for requests related to the user relationship; otherwise, it is Article 6(1)(f) of the GDPR based on the interest in responding to incoming messages. The provider uses its iCloud Mail account for this purpose; the involved email services process the message.
Support correspondence is deleted as soon as the inquiry has been fully processed and no further questions, specific legal claims, or statutory retention obligations require continued storage. If retention is required, use is limited to this purpose. Please send only information and attachments that are necessary for your inquiry.