Privacy Policy

This policy explains what data Thinkr handles when you visit thinkr.sh, use the chat app at chat.thinkr.sh, or call the API at api.thinkr.sh. It also explains why we handle that data, and what rights you have. In this policy, "Thinkr", "we", and "us" mean the team that runs Thinkr. "You" means anyone who visits the site or uses the app or the API.

In short

• You need no account. We do not ask for your name, your email address, or your phone number to chat.
• In the private lane, your device encrypts each message to a trusted execution environment (TEE), after it verifies the enclave's remote attestation. Thinkr cannot read those chats.
• In the open lane, the provider of the model you pick reads your messages to answer them. Under zero data retention (ZDR), the provider of a model marked ZDR promises to keep nothing. The provider of a model marked Open may keep your request for a while. With web search on, Exa runs the searches and keeps the queries under its own policy.
• Your saved chats, images, and videos stay in your browser, on your device. If you turn on backup, your device encrypts a copy of the text of your chats first, and we keep only that encrypted copy, which we cannot decrypt.
• We do not sell your personal data, we show no ads, and we do not train models on your chats.
• The site and the app set no cookies and run no analytics scripts or trackers.

Who is responsible

Thinkr decides why and how we handle the personal data that this policy describes. Under the General Data Protection Regulation (GDPR), that makes Thinkr its controller. To reach us about your data, email [email protected].

What Thinkr can and cannot see

This table shows who can read the content of a chat in each lane.

When you visit the site

The site at thinkr.sh is a set of static pages. It sets no cookies, stores nothing in your browser, and loads nothing from another company.

Cloudflare delivers and protects the site. To do that, Cloudflare handles your IP address and the details of each request, such as the page, the time, and your browser. Cloudflare shows us statistics of all traffic together, such as the number of visitors and the countries they come from. Our own server keeps no log of the requests to the site.

When you chat in the private lane

The private lane runs open-weight models inside enclaves. Before the app sends a message, your device verifies the remote attestation of the enclave that receives it. The app then encrypts the message with HPKE to a key that exists only inside that enclave. If the verification fails, the app sends nothing.

Cloudflare carries the traffic between your device and our proxy. It sees your IP address and the encrypted message, but not its content.

Our proxy carries the encrypted message to the enclave and the encrypted answer back to you. It cannot read either one. For each request, the proxy sees:

• your IP address;
• the time and the size of the request;
• the model you picked;
• after the answer, the number of tokens and their cost.

The proxy does not store your IP address. It writes one log line for each request, with the time, the method, the path, the status, and the duration. It also logs errors, and the moments when a lane of the free trial pauses. The log holds no IP address and no content.

A provider of confidential computing runs the enclaves, on servers that it rents from GPU cloud providers. It receives each request from our proxy, not from you, so it does not see your IP address. It sees the time and the size of each request, the model, and the number of tokens. It keeps operational logs of these for up to 90 days.

A TEE lowers the risk that anyone reads your data, but it does not remove every risk. Verification in the docs explains the private lane and its limits.

When you chat in the open lane

The open lane serves models that do not run in an enclave. These are closed models, such as Claude, GPT, Gemini, and Grok, open-weight models that other providers run, and the models that make images and videos. TLS encrypts your messages and their answers on the network, but four parties can read them while they pass:

• Cloudflare, where the TLS connection from your device ends;
• our proxy, which carries them on and keeps no copy, but for the source file of a video edit, an upscale, or a talking photo, described below;
• OpenRouter, the service that routes each request to a provider;
• the provider that runs the model, which must read your messages to answer them.

The same holds for the prompt and the photos of an image or a video that you make, and for the image or the video that comes back.

When you edit or upscale a video, or make a photo talk, OpenRouter takes the video or the voice only as a link. Our proxy holds that file in its memory, never on disk, at a random link that only OpenRouter and the provider receive, and deletes it once the video is made, or after 10 minutes at most.

The app marks each model of the open lane ZDR or Open:

• A request to a model marked ZDR requires zero data retention (ZDR) and forbids data collection. OpenRouter then sends it only to providers that promise by contract to keep no prompts and no answers.
• A model marked Open has no provider that offers zero data retention through OpenRouter. Its provider may keep your request and its answer for a while, under its own policy. The request still forbids data collection, so OpenRouter does not send it to providers that may train on it.
• Every model that makes videos is marked Open. A video takes time to make, so the provider, and sometimes OpenRouter, keeps the finished video for a while, so that the app can fetch it.

When you turn on web search for a model of the open lane, the model writes search queries from your chat. OpenRouter sends them to Exa, a search engine, and the model answers from the pages that Exa finds. Exa receives the queries from OpenRouter, not from you, so it does not see your IP address. Zero data retention covers the model, not the search: Exa keeps the queries under its own data policy, even for a model marked ZDR.

We send no user ID and no app name with a request. OpenRouter keeps data about each request, such as its time, its model, and its number of tokens, under its own policy. The log of our proxy is the same as in the private lane.

If you switch a chat to a model of the open lane, the app sends that model the earlier messages of the chat too. To keep a private conversation out of the open lane, start a new chat.

When you call the API

The API at api.thinkr.sh lets your own code call the models of the private lane and the models of text of the open lane.

For a model of the private lane, the API takes only chats that were encrypted before they left your machine, and it refuses any other chat with those models. The SDK of Thinkr, or its local bridge, verifies the remote attestation of the enclave on your machine and encrypts each request to it, as the app does. Cloudflare, our proxy, and the provider of the enclaves then see what they see of a chat in the private lane, as described above.

For a model of the open lane, the API takes each chat as plain JSON, so nothing encrypts it for an enclave. Cloudflare, our proxy, OpenRouter, and the provider of the model can read it while it passes, and the marks ZDR and Open mean the same, as "When you chat in the open lane" describes. The id of such a model starts with zdr/ or open/. Our proxy keeps no copy of the chat. These chats take no web search and no files.

For either lane:

• An API key is a secret that holds its own credit. Your browser makes it and keeps it, as "Data in your browser" describes. We store only a hash of the key with the credit on it, and a hash of the ID of each move of credit, so that a move counts once.
• Each call carries the key, so Cloudflare and our proxy see the key while the call passes. Our proxy uses it only to find the credit and take the cost of the call, and it does not log the key.
• When you create a key, add credit to it, or close it, the app sends the key and the key to your balance in one request, so our proxy sees them together while it moves the credit. It stores nothing that joins them.
• Closing a key deletes its hash and its credit from our records.
• The local bridge runs on your machine and keeps your key in its memory. It sends us only the calls that you make through it.
• The keyed hash of your IP address that the free trial uses also limits how many calls you can send each minute.

Your saved chats, images, and videos

The app saves your chats in the storage of your browser (IndexedDB), on your device. It does not save a temporary chat. The images and videos that you make on the Image and Video pages of the app stay there too, with their prompts.

• Unless you turn on backup, we never receive a copy of your saved chats. We cannot read, restore, or delete them.
• We keep no copy of your images and videos, and a backup does not hold them. When you edit or upscale a video, or make a photo talk, OpenRouter takes the video or the voice only as a link. Our proxy holds that file in its memory, never on disk, at a random link that only OpenRouter and the provider receive, and deletes it once the video is made, or after 10 minutes at most.
• The app does not encrypt your saved chats, images, and videos on your device. Anyone who can open your browser profile can see them.
• In the app, you can export your chats, delete one chat, or delete all of them. You can delete each image and each video on its page.
• To delete everything that the app stored, clear the site data of chat.thinkr.sh in your browser.

Backup

Backup is off until you turn it on in the settings of the app. It keeps a copy of the text of your saved chats, of your credit, and of your API keys, so that you can open them on another device or after you clear your browser. Photos and files that you attach, and the images and videos that models make, stay in the browser that holds them.

• Your device encrypts the backup with AES-256-GCM before it sends it, under a key that derives from your recovery code. The app shows that code once, and only you keep it. A passkey can unlock the key too, through the PRF extension of WebAuthn. We never receive your recovery code, the key, or your passkey.
• Our server keeps the encrypted backup, its size, and a hash of the token that lets your devices replace or delete it. We cannot decrypt the backup, and we do not know whose it is.
• The log of our proxy records each request to the backups without naming the backup.
• Your passkey stays with your passkey manager, such as iCloud Keychain or Google Password Manager, together with the random ID that lets a new device find your backup.
• If two of your devices each hold a balance, the app moves what is left on one onto the other. Our proxy then learns that the two balances belong together.
• If you lose your recovery code and every passkey, nobody can open the backup, and we cannot recover it.
• When you turn off backup, the app deletes the backup from our server at once. Your chats and your credit stay in your browser.

The free trial and its limits

You can try Thinkr with no account, for a set number of chats each day. To count your chats, the proxy computes a keyed hash of your IP address. The key is a random secret that the proxy holds in memory and replaces each time it restarts. The proxy holds the counts in memory too, and drops them at 00:00 UTC each day and at each restart. The same hash also limits how many requests you can send each minute, to protect the service.

Data in your browser

The site and the app set no cookies. Cloudflare may set a security cookie, but only when it must verify that a visitor is human.

The app keeps these items in the storage of your browser, on your device:

• your saved chats;
• the images and videos that you make on the Image and Video pages, with their prompts;
• while a model makes a video, a ticket from our proxy that lets the app fetch the video when it is ready;
• your settings, such as the model you picked;
• a random secret that the app adds, encrypted, to each private chat, so that the enclave keeps a prompt cache that is yours alone;
• public data about the trusted releases of the enclave software, which the verification may keep to run faster;
• once you buy credit, your notes, the key to your balance, and each top-up on its way, until its notes arrive;
• a random secret for your top-ups, which only your browser holds, for 30 days after the app last used it for a top-up;
• your API keys, with the name and the limit of each, which anyone who can open your browser profile can read;
• once you prove a wallet for free chats in Private mode, the address of that wallet, a random secret that only your browser holds, and the passes that your browser took;
• once you turn on backup, the key of the backup and what changed since the last backup.

We cannot see or recover these items. Clearing the site data of chat.thinkr.sh deletes all of them. With a backup, you can bring back the text of your chats, your credit, your API keys, and the proof of your wallet for free chats yourself.

When you buy credit

You buy credit with USDG or THKR on Robinhood Chain, or with Monero or Zcash. A payment on Robinhood Chain is public: anyone can see the wallet that paid, the amount, and the time.

When you open the pages Overview, Wallet, or Payments of the dashboard with a wallet connected, the page reads that wallet's balances of USDG and ETH and its past payments to Thinkr from the chain itself, through the public RPC of Robinhood Chain. Whoever runs that RPC sees your IP address and the address of your wallet. Our servers take no part in these reads. The page then matches those payments, in your browser, against two lists that we publish for every payment: how many vouchers it paid for, and what a payment in THKR was worth. To show the holder vouchers of the wallet, the pages Overview and Holder vouchers send us the address of the wallet. We do not log it.

You can connect a wallet in your browser, or a wallet on your phone through WalletConnect, a service that Reown runs. If you use WalletConnect:

• Reown's servers carry the messages between the dashboard and your wallet, list the wallets that you can pick, and tell your wallet that the dashboard is really ours. Reown sees your IP address and the address of your wallet. The messages themselves are end-to-end encrypted.
• Reown's code also tries to send usage data, with the address of the page, to Reown. The dashboard blocks it.
• The dashboard keeps the WalletConnect session in your browser until you disconnect your wallet.

When you pay:

• The app opens the dashboard with a hash of the random secret for your top-ups. The link also tells the dashboard that it came from the app, by the address chat.thinkr.sh and nothing more. The dashboard takes the hash only from such a link, so that a link made by someone else cannot have you pay for their credit.
• We check each payment on the chain. We store its transaction hash, how many notes it paid for, and the hash that ties it to your notes: the hash of the secret for your top-ups, or for an older top-up, a hash of its blinded requests. We do not store the address of your wallet, but anyone can find it on the chain from the transaction hash. We publish the transaction hash of each payment with how many notes it paid for.
• For that hash, we also store how many notes its payments bought and how many your browser fetched, with a hash of the blinded requests of each fetch, so that a fetch whose answer was lost can ask again.
• For a payment in THKR, we also store its amount, what it was worth in dollars, and the time of its block, which the chain shows too. The quote that set its price, with the hash that ties it to your notes, stays for 30 days.
• When you ask for the price of a top-up, the dashboard sends the address of the wallet that pays, so that a holder of THKR gets its discount. We check how much THKR that wallet holds from the public transfers of THKR on the chain. A price at a discount stays for 30 days under a hash of the wallet together with the hash that ties it to your notes. We do not store the address itself.
• While we check a payment, the dashboard keeps its details in your browser. It deletes them once we have counted the payment.
• When you claim your holder vouchers, our proxy sees the address of your wallet, a signature from your wallet, and your IP address together. It verifies the signature in memory and stores none of them.
• To turn on free chats in Private mode, you send THKR from your wallet to a contract address made for that transfer, which is public on the chain. We store the address of that wallet with a hash of a secret that only your browser holds. A claim of holder vouchers by transfer stores the same.
• With that secret, your browser takes passes for free chats. We count how many passes the wallet took today, and we drop the count on a later day. We sign each pass without seeing it, so a spent pass does not show which wallet took it. The time of a fetch and of a chat, or your IP address, can still link the two in some cases.
• For each free chat, your browser sends one pass, and our proxy stores a hash of it so that it is spent once. The proxy drops those hashes after the month of the pass. For each month, it stores how many free chats ran and what they cost, with no wallet and no chat.
• Your credit comes as blind notes. Your browser makes them after the payment and fetches them from us with the secret for your top-ups, so the dashboard never sees them. We sign each note without seeing it, so a spent note does not show which payment bought it. The time of a purchase and of a spend, or your IP address, can still link the two in some cases.
• Your notes and the key to your balance stay in your browser, and in your encrypted backup if you turn it on. The app sends that key with each chat, image, or video that you pay for. We store only a hash of the key with the amount of the balance, a hash of each spent note, and a hash of the job of each video that a balance paid for, so that we settle its cost only once. We keep no record of each chat.
• If you clear the site data of chat.thinkr.sh without a backup, you lose your notes and your balance, and we cannot restore them.

When you pay with Monero or Zcash

You pay from any wallet of that coin to an address that we make for that one top-up.

• Our wallets hold viewing keys only. They show us what comes in to our addresses, and they cannot spend it.
• For each top-up, we store the coin, the address, the credit, the amount and its price, the time, and the hash of the secret for your top-ups. For each payment to that address, we store its transaction ID, its amount, when we saw it, and what it was worth. We do not store the wallet that paid.
• A payment from a transparent address of Zcash shows that address and the amount on the chain. An exchange that you pay from keeps its own records.
• To set a price, our server reads the price of the coin from Kraken and Bitfinex. To follow Zcash, it reads the chain from zec.rocks. To follow Monero, it reads the chain from the public node xmr-node.cakewallet.com. It checks each payment against whole blocks from Blockchair. These services receive nothing about you.
• Your credit then comes as blind notes, of $1, $0.10, and $0.01, and your browser fetches them with the secret for your top-ups.

When you pay with USDG in the app

You pay from any wallet on Robinhood Chain to a contract address that we make for that one top-up. You connect no wallet, and you sign nothing for us.

• The contract can send what reaches that address only to our wallet for top-ups. Our server moves it there, and pays the gas.
• For each top-up, we store the coin, the address, the credit, the amount, the time, and the hash of the secret for your top-ups. For each payment to that address, we store its transaction hash, its amount, when we saw it, and what it was worth. We do not store the address of the wallet that paid, but anyone can find it on the chain from the transaction hash. We do not publish these payments in our list of payments.
• To follow these payments, our server reads the chain through the public RPC of Robinhood Chain. Whoever runs that RPC sees which addresses our server asks about, and nothing about you.
• Your credit then comes as blind notes, of $1, $0.10, and $0.01, and your browser fetches them with the secret for your top-ups.

When you email us

When you write to [email protected], we receive your email address, your message, and anything you attach. Our email provider stores them. We use them only to answer you.

What we do not do

• We do not sell your personal data, and we do not share it for advertising across other sites and apps.
• We show no ads and use no ad pixels, tracking cookies, or analytics scripts.
• We do not use your chats to train models. In the open lane, every request forbids data collection, so OpenRouter does not send it to providers that may train on it.
• We do not build a profile of you, and we make no automated decision about you that has a legal or similarly significant effect.
• We do not track you across sites, so a Do Not Track signal from your browser changes nothing.

Why we handle your data

For people in the European Economic Area (EEA) and the United Kingdom (UK), we name a legal basis for each use of data:

• to give you the service (performance of a contract): we carry your messages, count the chats of the free trial, run your credit, and keep your backup if you turn it on;
• for our legitimate interests: we keep the site and the app secure and working, look at traffic in total, and answer your email;
• to meet a legal duty: we keep the records of payments that the law requires.

You do not have to give us any personal data. Without your messages, though, the app cannot answer you.

Who receives your data

We share data only as this policy describes:

• Cloudflare, which delivers and protects the site and the app;
• Amazon Web Services (AWS), which hosts our server in the United States;
• the provider of confidential computing that runs the enclaves of the private lane;
• OpenRouter and the providers of the open lane, which route and answer your requests there;
• Exa, which runs the searches of web search in the open lane;
• our email provider, which stores the email you send us;
• Robinhood Chain, where your payment is public;
• the networks of Monero and Zcash, where your payment is recorded;
• Reown, which runs WalletConnect, if you pay from a wallet on your phone;
• whoever runs the public RPC of Robinhood Chain, which the dashboard asks about the wallet you connect;
• an authority, when the law requires it;
• a company that takes over Thinkr, which must then keep the promises of this policy.

Requests from authorities

If an authority asks us for data, we give only what the law requires. We hold little to give: no chats that we can read, no accounts, and no IP addresses. The only wallet addresses of yours that we hold are those of a claim by transfer or a proof for free chats, which link to no chat. A backup that we keep is encrypted, and we cannot decrypt it.

Where your data goes

Our server runs in the United States. Cloudflare works worldwide, and the providers of the models run in the United States and in other countries. Your data can therefore leave the country where you live, including the EEA and the UK, for countries whose laws protect it less.

How long we keep data

• Your saved chats: on your device, until you delete them. We hold their text only inside an encrypted backup, if you turn backup on.
• Your images and videos: on your device, until you delete them. We keep no copy.
• A video or a voice that you send to edit or upscale a video, or to make a photo talk: in the memory of our proxy, never on disk, until the video is made, or 10 minutes at most.
• Your backup: until you turn backup off, which deletes it at once.
• Your IP address: we do not store it. The keyed hash and the counts of the free trial stay in memory until 00:00 UTC or the next restart.
• The hash of an API key and the credit on it: until you close the key.
• The address of a wallet proved for free chats, with the hash of its secret: as long as that secret can take passes.
• The log of our proxy: as long as we need it to keep the proxy working and secure. It holds no IP address and no content.
• The logs of the provider of the enclaves: up to 90 days, under its own policy.
• What the providers of models marked Open keep, and the videos that OpenRouter holds: for a while, under their own policies.
• The search queries of web search in the open lane: under the data policy of Exa.
• What Reown and whoever runs the public RPC of Robinhood Chain keep: under their own policies.
• The records of credit: while the credit can be spent, and for as long as the law requires records of payments.
• Your email: as long as we need it to deal with your message.

How we protect your data

Every connection uses TLS. In the private lane, your device verifies the enclave and encrypts each message to it, so neither Cloudflare nor our proxy can read it. Our server accepts web traffic only from Cloudflare. Security shows the public checks of the site. No system is perfectly secure. If you find a weakness, write to [email protected].

Your rights

Depending on where you live, the law gives you rights over your personal data. These include the rights of the GDPR and the UK GDPR. They also include the rights of the California Consumer Privacy Act (CCPA) and of the laws of other US states. You may have the right to:

• know what personal data we hold about you, and get a copy of it;
• correct it;
• delete it;
• receive it in a portable form;
• object to a use of it, or ask us to limit that use;
• withdraw your consent, where a use depends on it;
• ask us to review our answer to your request;
• complain to the data protection authority where you live.

We will not treat you differently because you use a right. We have no accounts and keep no chats that we can read, so we usually hold no personal data that we can link to you. To ask about a payment, send us its transaction hash.

To use a right, email [email protected]. We answer within one month and explain any limit that applies. We may ask for details to verify that a request comes from you, but never for the content of your chats. An agent that you authorize may make a request for you. We do not sell or share personal data, so there is nothing to opt out of.

Children

Thinkr is for adults. You must be 18 or older to use it. We do not knowingly collect personal data from anyone younger. If you believe that a child sent us personal data, write to us, and we will delete it.

Changes to this policy

We post every change on this page, with a new date. Before a material change takes effect, we give notice on the site. If we add accounts or another new kind of data, we will update this policy first.

Contact us

Email [email protected], or see Contact.