Privacy notice

Updated September 11, 2026

Public contact details are being finalized before launch.

Viktor Nordlund
Finnsta 637, 841 73 Fränsta, Sweden

This notice explains what information Thinklay uses, why it is needed, and the choices available to you.

Information we use

Email accounts store your name, email address, verification status, a password hash, and account timestamps. Sign-in sessions may record an IP address and browser information. External sign-in provides a trusted account identifier and display name. Guest sessions use a chosen name and a private access credential.

We store session ideas, discussions, votes, decisions, room membership, saved ideas and personal templates to provide the features you use. Presence records support collaboration. Hashed network identifiers and request counters help prevent abuse. Unsent writing and room credentials are stored in your own browser.

If you choose Google sign-in, Google shares your account identifier, name, email address, verification status and profile image with Thinklay to create and authenticate your account. We do not request access to your Gmail, Drive or Calendar. Google also processes the sign-in under its own privacy policy.

Hosting allowances use monthly room-creation counts and plan access records linked to a hashed account identifier. We also record which hosting identity created a room, separately from who currently facilitates it. These records enforce hosting limits and contain no idea text. Room setup may be held in your browser for up to 24 hours while you register or sign in. The authentication return URL contains a random draft ID, not your question or settings. See our Cookies & storage notice.

Purpose and sharing

We use this information to provide sessions, manage account access, save your work, communicate about account security and protect the service. Teammates can see content according to the room phase; drafts stay private until revealed. A shared viewing link gives its holder access to the published room view. People who receive content can keep their own copies.

Hosting and storage run through Sites and Cloudflare. If transactional email is configured, account emails are delivered through Resend. These service providers process information needed to operate their services and may process it in other countries. We do not sell personal information or use advertising trackers in the application.

Retention and deletion

Room email updates are optional and require a verified email account. Invitations are sent only when a host requests them. Delivery uses Resend when configured. Each message offers a room-specific unsubscribe link. Queued addresses and messages are removed after delivery or within seven days of their due date; future follow-ups remain until due or cancelled. Shared templates belong to a room and are available to its members.

When automatic retention is enabled, unstarted rooms expire after 30 days without content changes (hosts may choose 90 days). Currently connected rooms are skipped. Finished rooms are archived after 365 days (hosts may choose 180 days), retaining their history. Existing rooms receive a grace period when first enrolled. Active, started rooms are not automatically deleted. Room settings show whether this policy is active.

We keep anonymous daily totals for landing visits, created and started rooms, copied invitations, first ideas, first team reveals, first closed ballots, first decisions and finished sessions for up to 400 days. Counts contain no names, emails, idea text or visitor identifiers. Temporary room-linked markers prevent double-counting and disappear with the room. Client reports respect Do Not Track and Global Privacy Control. Failures are counted by action, session stage and error category; raw messages, stack traces, URLs and session contents are not included. The analytics view is restricted to configured administrators.

Account content is stored until you delete it or the account, or it is removed during service administration. Session cookies expire; expiration alone does not promise deletion of every historical database record. Browser drafts expire after 30 days. Browser room credentials and preferences remain until cleared.

Monthly hosting counts, including any historical browser-based counts, currently remain until removed during service administration. Former guest hosting cookies are ignored and expire within one year; expiration does not erase those server records. Deleting your account removes its hosting counts, plan access records and room-sponsorship links. Deleting a room removes its sponsorship link but does not refund the creation allowance for that month.

Deleting your Thinklay account removes email credentials and sessions, saved ideas, templates, rooms with no other members, and your room access. In shared rooms, unrevealed drafts are removed and displayed identity is anonymized; shared ideas, discussions and decisions remain available to teammates. A minimal deletion marker prevents in-flight requests from restoring account links. Free text may still contain personal information, so contact support about anything that needs additional removal. Provider backups and independently exported copies are outside the live account deletion operation.

Your choices

Deleting a room normally keeps independent saved ideas in participants’ libraries. The host can also remove all saved idea copies originating from that room. Downloaded files and copies outside Thinklay remain unaffected. A minimal room identifier is retained after that purge to prevent delayed saves from restoring copies.

Use Dashboard → Account options → Account data & privacy to download your data or request deletion. You can also contact support to request access, correction, erasure, restriction, or portability, or to raise a concern about processing. Rights and applicable exceptions depend on your location. Where applicable, you may complain to your local data protection authority.

You can use guest rooms without creating an account. Avoid adding sensitive information that you do not want to share with your room.