ThinkGO privacy policy
ThinkGO is a self-help app with exercises based on cognitive behavioural therapy (CBT) techniques. It is built so that what you write stays with you. This policy explains what stays on your devices, the little that reaches us, mostly only if you allow it, and how to change your mind.
In short
- Everything you write, rate or record in ThinkGO stays on your iPhone, iPad and Apple Watch and, if you use iCloud, in your own iCloud account. We can't see it.
- ThinkGO has no account and no ads. What you write never reaches us.
- Anonymous app analytics and crash reports are off until you turn them on. You can turn them off again at any time.
- We never sell your data or use it for advertising.
1. Who we are
ThinkGO is made by an independent developer ("we", "us"); the developer's name is shown as the seller on ThinkGO's App Store page. We are the controller for the limited data described in section 3.
Contact for anything about privacy: info@thinkgo.app
2. What stays on your devices
These never reach us, under any setting:
- your answers in exercises, thoughts, beliefs, ratings, worries, coping cards, plans and journal entries
- your mood logs and the feelings you pick
- your onboarding answers, the areas you chose and your answer to the safety question
- your check-in answers and scores (PHQ-4, GAD-7, PHQ-9)
- anything ThinkGO reads from or writes to Apple Health
- whether and when you open Get help, and the country you choose there
Where it is stored. On your device, protected by iOS Data Protection: the files can't be read while your iPhone is locked. If iCloud is on for ThinkGO, the same data syncs through your own iCloud private database so it reaches your other devices. Your answers, free text and ratings are end-to-end encrypted there, so Apple can't read them either. We have no access to your iCloud.
Apple Watch. The Watch keeps what you log there until your iPhone confirms it has it. The two devices talk to each other directly.
Apple Health (optional). If you connect Apple Health, ThinkGO can save your mood check-ins, mindful minutes from breathing exercises and, if you choose, your GAD-7 and PHQ-9 results to Health. It can read sleep, steps, exercise minutes and mindful minutes to show next to your mood in Progress. What it reads is shown on the device and never stored with your entries, synced or sent anywhere. Health data is never used for advertising.
App lock. Face ID or your passcode is checked by iOS. ThinkGO never sees your face data or passcode.
Exports. When you export a backup, a CSV file or a PDF, the file goes wherever you save or send it. That is your choice and outside our control.
Notifications. Reminders are scheduled on your device. Private notifications are on by default, so no exercise names or feelings appear on the Lock Screen.
3. What reaches us, and only if you allow it
On the privacy screen during setup, and later in Settings › Privacy & security, you choose three things separately. All three are off until you turn them on.
| Choice | What is sent | What is never sent |
|---|---|---|
| Crash reports | When the app crashes: the technical crash log, device model, iOS version, app version, and which screen was open | Anything you wrote or rated |
| Product analytics | Which screens and buttons are used, for example that onboarding was completed, the paywall was shown, a trial started, a widget was added or notifications were allowed; purchases (product, price, currency) | Your answers, moods, ratings, feelings, check-in scores, Health data |
| Exercise usage (needs product analytics) | Which exercise was opened or finished, how long it took (rounded), how many steps were skipped (rounded), which reminders you set | Your answers, ratings, how you felt before or after, any text |
These events carry a random app-instance identifier, not your name, e-mail or Apple ID. They are not linked to your identity and not used to track you across other companies' apps or websites. ThinkGO does not use Apple's advertising identifier (IDFA) and does not ask for tracking permission.
Why: to find and fix crashes, and to understand which parts of the app help people get started and which confuse them.
Legal basis (GDPR / UK GDPR): your consent (Art. 6(1)(a)). Because the exercises you use could hint at your mental-health interests, exercise usage is asked for separately as explicit consent (Art. 9(2)(a)).
Apple Search Ads. If product analytics is on and you installed ThinkGO from an Apple Search Ads advertisement, the app asks Apple once for the campaign, ad group and keyword of that ad and records them with the analytics events. This tells us which ads work. It contains no personal data.
Other ads (Apple's private ad measurement). If product analytics is on and you installed ThinkGO after seeing one of our ads, for example on Instagram or TikTok, the app tells Apple's ad measurement (AdAttributionKit and SKAdNetwork) how far you got: opened the app, finished onboarding, saw the paywall, started a trial, subscribed, stayed subscribed after the trial. It never reports your answers, focus areas, moods or which exercises you use. Apple, not ThinkGO, sends these reports to the ad network after a random delay of a day or more, and limits how much detail a report contains when few people installed from the same ad. The reports carry no identifier of you or your device, so neither the ad network nor we can tell who they are about. ThinkGO contains no advertising or tracking software from Meta, TikTok or any other ad network.
Who processes it for us:
- Google (Google Ireland Ltd and Google LLC): Firebase Analytics and Firebase Crashlytics, under Google's data processing terms.
- PostHog (PostHog Inc.): product analytics, stored in PostHog's EU cloud in Frankfurt, under PostHog's data processing agreement.
They process the data only on our instructions.
4. What reaches us without a choice
- Remote configuration. When it starts, ThinkGO fetches small updates from Google Firebase Remote Config: corrections to emergency numbers shown in Get help, fixes to exercise texts, and paywall wording. The request carries a random installation identifier, the app version and the device language, and nothing about you or your entries. Legal basis: our legitimate interest in keeping emergency numbers and content correct (Art. 6(1)(f)).
- Ad install reports. If you installed ThinkGO after seeing one of our ads, Apple's ad measurement (AdAttributionKit and SKAdNetwork) may report that install to the ad network, and Apple may send us a copy of that report. ThinkGO sends nothing for it. The report carries no identifier of you or your device, and Apple limits how much detail it contains when few people installed from the same ad. It contains no personal data. Legal basis: our legitimate interest in knowing which ads work (Art. 6(1)(f)).
- Purchases. Subscriptions are sold and billed by Apple. Apple tells the app whether you have an active trial or subscription. Apple also sends our website server (hosted by Hostinger) a signed notice whenever a trial or subscription starts, renews, changes, ends or is refunded, whatever your settings in the app. The notice holds the product, price, currency, App Store country, the dates and Apple's number for that subscription. It holds no name, e-mail address or Apple ID, so we can't tell who it is about. We keep these notices as sales records, get an e-mail about each one, and send the product, price, currency and country to PostHog, without Apple's number or any other identifier, to count revenue. Legal basis: our legitimate interest in knowing our sales (Art. 6(1)(f)). Apple's own privacy policy applies to your payment and Apple ID.
- E-mails you send us. If you write to info@thinkgo.app, we use your message and address to answer you. Legal basis: our legitimate interest in answering (Art. 6(1)(f)).
5. How long we keep it
- Product analytics and exercise usage: 2 months in Firebase Analytics, up to 12 months in PostHog, then deleted.
- Crash reports: 90 days.
- Remote configuration requests: not stored by us.
- Purchase notices from Apple and copies of ad install reports: 24 months on our website server, then deleted.
- Support e-mails: deleted 12 months after the conversation ends, unless the law requires longer.
6. International transfers
Google may process data in the United States. Transfers are covered by the EU-US Data Privacy Framework (Google is certified) and the European Commission's Standard Contractual Clauses. PostHog stores ThinkGO's data in the EU; access by its US parent company is covered by Standard Contractual Clauses.
7. Your choices and rights
- Change your consent at any time in Settings › Privacy & security. Turning a choice off stops sending at once.
- Export your data in Settings › Data › Export my data: a full backup, a CSV file or a PDF.
- Delete everything in Settings › Data › Delete all data. It deletes your entries on this device and in your iCloud, removes ThinkGO's items from the iOS Keychain, and resets the analytics identifiers so nothing sent later can be joined to anything sent before.
- Your rights under GDPR and UK GDPR: access, rectification, erasure, restriction, objection, data portability, and withdrawing consent without affecting what was done before. Because analytics data carries no name, we may need the app-instance identifier to find it; write to info@thinkgo.app and we'll explain how to send it. We answer within one month.
- Complaints: you can complain to the data protection authority in the country where you live or work.
- US residents: see also our Consumer Health Data Privacy Policy at https://thinkgo.app/health-data. We do not sell personal information or share it for cross-context behavioural advertising. You can use the rights above in any US state.
8. Children
ThinkGO is for adults aged 18 and over. The app asks for confirmation of age at the start and doesn't continue below 18. We don't knowingly collect data from children.
9. Security
Your entries are protected by iOS Data Protection on the device and, in iCloud, by end-to-end encryption of your answers, text and ratings. App lock can add Face ID or your passcode. Data sent to our processors travels over encrypted connections.
10. Changes
If we change this policy, we update the date at the top and, for changes that affect what is sent, ask again in the app before anything new is sent.
11. Contact
Change log
- 1 November 2026First version.
- 3 November 2026Added Apple's private ad measurement, the copies of ad install reports and the purchase notices Apple sends our website server, with how long we keep them.