Privacy policy

1. Who we are

ThoughtCheck is run by Lunar Web Studio, LLC, doing business as ThoughtCheck. In this policy, "we", "us" and "our" mean Lunar Web Studio, LLC. "You" means the person using ThoughtCheck.

This policy covers the website at thoughtcheck.app, the ThoughtCheck web app at thoughtcheck.app/app/, the ThoughtCheck apps for iPhone and Android, and any emails you send us.

Questions about privacy? Email hello@thoughtcheck.app.

2. What you write in the app

When you check a thought, the app saves what you enter on your device: in the web app, in your browser's storage, and in the iPhone and Android apps, inside the app (see below). This includes:

• the thought you wrote and the fairer thought you rewrote it as,
• the feelings you picked and how strong they were,
• the situation, the thinking patterns you chose, the evidence you listed, and any plan you wrote,
• the date and time of each check,
• a check you started but didn't finish, so you can carry on later,
• for a check made ahead of time, the date and time of the event,
• your cards (a thought and the words to remember), and which card is shown first,
• your check-ins: the color you tapped, any mood, anxiety and energy ratings, and any note,
• your settings, such as light or dark mode, how much to show (Simple, Standard or Detailed), the country whose help lines you see (the app first guesses it from your device's time zone, on your device, and you can change it), and whether Bible verses are on.

ThoughtCheck doesn't send this information to us or to anyone else. We have no copy of it. Because of this, we can't read it, share it, or get it back for you if it is lost.

Some browsers have spell check or translation features that send text to the browser's maker. ThoughtCheck can't control those. You can turn them off in your browser's settings.

If your browser can turn speech into text on your device, the app shows a Speak instead button. The app asks your browser to do this only on your device, so what you say isn't sent to us or to anyone else, and the app doesn't record or keep any sound. The first time, your browser may download a speech file for your language from the browser's maker. If your browser can only do this by sending your voice to its maker, the app doesn't show the button. The microphone key on your phone's keyboard is part of your phone, not ThoughtCheck. Your phone's or keyboard's maker runs it under their own privacy policy, and it may send your voice to them.

You can save a backup file in the app's Settings. It's saved where your browser saves downloads. On iPhone and iPad this is often iCloud Drive, so it may be copied to your cloud storage. It holds your checks, cards and check-ins as plain text, unless Lock my checks is on, so keep it somewhere private. We never see it. If you're signed in to ThoughtCheck Plus, it also holds your email address, so you know which email to sign in with. It doesn't hold your Plus sign-in, so loading it doesn't turn on Plus.

When you share a card, the app gives only that card's words (and the verse, if you choose to include it) to your device's share menu, or copies them. The app or person you share them with then has those words.

When you share a saved check, the app gives a plain-text copy of that one check (and the verse, if you choose to include it) to your device's share menu, or copies it. The copy can include health details, such as your feelings, how strong they were and your thoughts. The app or person you share it with then has those words, and keeps them under their own rules.

With ThoughtCheck Plus, you can export your checks and make a summary to bring to therapy. The app makes these on your device. Share as text and Send to my therapist give a plain-text copy to your device's share menu, or copy it. A spreadsheet file is saved where your browser saves downloads (in the iPhone and Android apps, your phone asks where to keep it). Print or save as PDF uses your browser's print window. You choose where these copies go, and nothing goes through ThoughtCheck. They can include health details, so keep them somewhere private.

With ThoughtCheck Plus, you can also show a check or a summary as a QR code. The words travel inside the code. Scanning it opens a ThoughtCheck page that shows the words, and ThoughtCheck never receives them. Anyone who scans the code can read the words, and their browser may keep the link in its history.

If you add a calendar reminder for a check made ahead of time, the app makes a calendar file (.ics) and saves it where your browser saves downloads. It contains the title "Look at your check in ThoughtCheck", a time before your event (30 minutes, or the time you pick with ThoughtCheck Plus), and a link that opens that check in the app. With ThoughtCheck Plus, you can also make a calendar file for a regular check-in reminder. It contains the title "Time for a check-in", the days and time you picked, and a link to the check-in. These files contain nothing you wrote. After you add one to your calendar, your calendar's provider (for example Apple, Google or Microsoft) keeps it under their own privacy policy, and anyone who can see your calendar can see it.

To delete your checks, cards and check-ins, use Settings > Delete everything in the app. It also turns off the check-in reminder and Bible verses. Your other settings stay, such as light or dark mode, how much to show and your country. If you're signed in to ThoughtCheck Plus, you stay signed in, and the app says so before you delete. To remove that, tap Sign out in Settings. Plus you bought in the iPhone or Android app stays too. This doesn't delete backup files you saved. Delete those yourself. Clearing your browser's data for thoughtcheck.app deletes everything the app saved, including your settings. Removing the app's icon from your home screen may not delete it.

Your browser may also delete it on its own. For example, on iPhone and iPad, the browser can delete a website's saved data if you don't visit the website for about a week. Checks in the app on your Home Screen are safe from this. Checks saved in your browser don't move to the Home Screen app: save a backup file in the browser, then tap Load a backup in the Home Screen app. Save a backup file in Settings so you can bring your checks back.

Anyone who can open your device and browser can open the app and see your checks, unless you turn on Lock my checks in Settings. Use a screen lock to protect them.

If you turn on Lock my checks, the app encrypts your saved checks on your device and opens them only with a code you choose. The code itself isn't saved anywhere. We can't reset it or open your checks for you: if you forget it, your locked checks can't be opened. You can still use the app: Remove the lock and the locked checks in Settings deletes only the locked checks and keeps everything else. While the lock is on, a backup file you save is locked too, with the same code (or, if your phone opens the lock, a code you choose for the file). Nobody can open a locked backup without that code, including us. Your cards, check-ins, a check you haven't finished, your settings, and the dates and times your checks were saved aren't encrypted on your device. Someone who can look at the app's saved data could also tell roughly how long each locked check is.

The app also saves a copy of itself on your device so it works without internet. This copy contains the app's code, not your information.

In the iPhone and Android apps

The apps save the same things as the web app, inside the app on your phone. They also keep a copy of it in a file inside the app, so your checks are still there if the phone clears the app's other storage. The apps don't send any of it to us or to anyone else.

If your phone's own backup is on (iCloud on iPhone, Google on Android), the backup can include what the app saves: your checks, cards, check-ins, a check you haven't finished and your settings. If you're signed in to ThoughtCheck Plus, it can also include your email address. On Android, it leaves out your Plus sign-in. On iPhone, it can also include your Plus sign-in, so restoring the backup to a phone can turn on Plus there. Apple or Google keeps it under their own privacy policy. On Android, ThoughtCheck lets the Google backup include it only when the backup is end-to-end encrypted. Google says it does this on Android 9 and later when the phone has a screen lock, so Google can't read it. On older Android phones, and on phones with no screen lock, the Google backup doesn't include it. Moving to a new Android phone by cable, or straight from one phone to the other, can also bring it over. That doesn't go through Google. Deleting the app erases your checks from this phone. If your phone's backup is on, the backup can keep a copy, and on Android installing the app again can bring them back.

In the apps, Lock my checks can use your phone's Face ID, fingerprint or passcode instead of a code. Anyone whose face or fingerprint is set up on the phone, or who knows its passcode, can then open your checks, so on a shared phone you can choose your own code instead. The key that opens your checks is kept in your phone's secure storage (the Keychain on iPhone, the Keystore on Android). The app never gets your face, fingerprint or passcode: your phone checks them and only tells the app whether it's you. The key is kept on that phone only. A backup of your phone doesn't bring it to a new phone, so locked checks can't be opened on a new phone, or after the app is installed again. Turn off the lock or save a backup file before you change phones or delete the app.

Reminders in the apps are notifications set on your phone, not sent through us. They show only a short title, such as "Look at your check in ThoughtCheck" or "Time for a check-in", and never what you wrote. Like other notifications, they can show on your lock screen.

When you save a backup file in the apps, your phone's share menu opens and you choose where the file goes, for example your phone's files, a cloud drive or an email. Wherever you put it keeps it under their own rules.

If the app has a problem, it shows an error screen with technical details about the error. If you tap Send the details, your email app opens a message to us with those details in it (or, if your phone has no email app, your phone's share menu opens). On Android, if the app closed because of a problem, the details also include the app's version, the Android version, and your phone's make and model. Your email app may also add details about your phone. Nothing is sent unless you do. If you email them to us, section 3 applies.

The apps don't use your phone's microphone, and they don't show the Speak instead button. Links to other websites, such as crisis help lines, open in your phone's browser.

3. Information you send us

We only get personal information when you choose to send it.

Some of what you send us, like signing up for updates or for ThoughtCheck Plus, could say something about your health. Before you send it, we ask you to agree. Our Consumer Health Data Privacy Policy explains this, as some US states (such as Washington) require.

Email updates

If you sign up for updates, we get your email address. We use it to send you updates about ThoughtCheck. You can unsubscribe at any time.

Form for clinicians

If you fill in the form on our page for clinicians, we get what you enter: your name, work email, role, practice or organization, how many clients might use ThoughtCheck, your location, and your message. We use it to reply to you and to talk about using ThoughtCheck with your clients.

Buying Plus codes

Therapists, clinics and other organizations can buy codes for ThoughtCheck Plus on our codes page. Card payments are handled by Stripe, our payment provider. Stripe collects your card details. We can see the card's type and last four digits, but we never see or store your full card number. From Stripe, we get your name, email address and billing address (used to work out sales tax), how many codes you bought, what you paid, and whether the payment went through. We use this to send you your codes, to keep records for tax and accounting, and to answer questions about your order.

Codes order form

If you order codes with the order form, we get your name, work email, practice or organization, how many codes you want, and your message, such as a purchase order number. We use it to send you an invoice and your codes, and to keep records for tax and accounting.

Free code for clinicians

If you ask for a free code to try ThoughtCheck Plus yourself, we get your name, work email, role, and practice or organization (if you give it). We use it to send you your code, to keep to one free code per person, and to talk about using ThoughtCheck with your clients.

Please don't send us client names or details about anyone's health in these forms or in emails. We don't need them.

Redeeming a ThoughtCheck Plus code

If a therapist or clinic gives you a code, you can redeem it in the ThoughtCheck web app's Settings. You type the code and your email address. We email you a 6-digit number, and you type it in the app. On another device, you sign in the same way, with your email and a new number. In the iPhone and Android apps, you can't type a code, but you can sign in the same way in Settings. You can be signed in on up to 3 devices at a time with the same email.

We use your email address only to send you these numbers. We don't send you anything else unless you ask, and we don't use it for marketing. Our email provider, Resend, sends the emails and keeps its own records of them under its privacy policy.

We don't keep your email address itself. Our server keeps a scrambled form of it (made with a secret key, so it can't be turned back into the address). With it, we keep when your Plus sign-in was made, when your Plus ends, which codes you used (in a scrambled form too), and a random number for each device you're signed in on, with when it last checked in. We keep this until you delete your email from ThoughtCheck (see below). It isn't removed when your Plus ends, so you can add a new code later. Nothing you write in the app is sent. Your checks stay on each device: signing in brings Plus to a device, not your checks.

When you ask for a number, our server also keeps a sign-in record under the scrambled form of your email: a scrambled form of each number we sent and when it runs out, the code you typed (in a scrambled form), when numbers were sent, and when wrong numbers were typed. We keep one even for an email that has no Plus, so the server answers the same way for every email. We remove it about an hour after the last number runs out. If wrong numbers were typed, we keep it until a day after the last one, so the limit on wrong numbers works. If you type a code that hasn't been used yet, we keep a short tag with the code. The tag is made from the scrambled form of your email. One unused code can start a sign-in for up to 3 emails a week, and the tags let us count them, so one code can't be tried with many emails. The tag doesn't cancel the code or use it up. Each tag is kept with the code for up to 7 days from the first time that email typed the code, then our server removes it. All the tags go when the code is used.

The app keeps a pass on your device that says when your Plus ends, and your email address, so Settings can show it. A backup file you save holds only your email address, not the pass, so loading the backup doesn't turn on Plus on another device. You sign in there with the same email. On Android, your phone's backup leaves out the pass too. On iPhone, your phone's backup can include the pass (see section 2).

We don't learn who you are from a code, and we don't tell the practice or organization that gave you a code whether or when you used it.

Deleting your ThoughtCheck Plus sign-in

This is how to delete the email sign-in for ThoughtCheck Plus, in the ThoughtCheck web app and the ThoughtCheck apps for iPhone and Android, from Lunar Web Studio, LLC, dba ThoughtCheck.

1. Open ThoughtCheck on a device where you're signed in to Plus.
2. Go to Settings, then ThoughtCheck Plus.
3. Tap Delete my email from ThoughtCheck, then Delete my email.

If you can't sign in, email hello@thoughtcheck.app from the email address you used, and we'll delete it for you.

What is deleted straight away: the scrambled form of your email, when your Plus ends, the list of codes you used, your devices' random numbers and your sign-in record. Your Plus from a code ends on every device. This can't be undone.

What is kept:

• Each code you used stays marked as used, so nobody can use it again. Nothing on it links back to you or your email.
• If you typed a code that hasn't been used, we don't cancel that code. It stays unused, and anyone who has it can still use it, within the limit of 3 emails a week described above. Only the short tag kept with it (see above) stays. The tag is there so one code can't be tried with many emails, and it goes within 7 days of the first time you typed the code.
• Resend, our email provider, keeps its own records of the emails it sent you, under its privacy policy.
• Netlify's server logs (section 4) are kept for a short time set by Netlify.
• Plus you bought in the iPhone or Android app isn't part of this sign-in. Deleting your email doesn't cancel a plan or remove a purchase. Apple, Google and RevenueCat keep purchase records under their own rules (see below).

Your checks aren't affected, because they were never sent to us. To delete them, use Settings > Delete everything on each device.

Buying ThoughtCheck Plus in the iPhone and Android apps

You can buy ThoughtCheck Plus in the iPhone app through Apple's App Store, and in the Android app through Google Play. Apple or Google handles the payment. We never see your card details, and we don't get your name or email address from a purchase.

We use RevenueCat, a service that keeps track of purchases in apps, to know whether you have Plus. The app gives RevenueCat a random ID made for ThoughtCheck. It isn't your name, your email address or your phone's advertising ID. RevenueCat gets from the app and from Apple or Google what you bought, when, the price and currency, and when your plan renews or ends, with basic details such as your phone's system version, the app's version and your country. We use this only to turn on Plus, to restore a purchase on another phone, and to keep records for tax and accounting. Nothing you write in the app is sent. RevenueCat keeps purchase records under its own privacy policy, and Apple and Google use purchase information under theirs.

Email

If you email us, we get your email address and whatever you write. We use it to reply.

Every email we send about ThoughtCheck will tell you how to stop getting them. You can also email us and ask.

4. Information collected when you visit

Like almost every website, some basic technical information is recorded when your browser loads our pages. Our web host, Netlify, keeps standard server logs. These include your IP address, your browser type, the page you asked for, and the time. They are used to run the website and keep it secure.

Our pages load their font from our own website, not from Google Fonts or any other font service.

We don't use analytics tools, advertising tools, or tracking cookies. The website saves one small setting on your device: whether you picked light or dark mode. If you open a ThoughtCheck QR code that comes in several parts, the page that shows it also keeps those parts on your device so it can put them together. They stay until you tap Remove. If you don't, they are removed an hour after the last part was scanned: while that page is open, or else the next time you open a ThoughtCheck link.

5. Who we share information with

We don't sell your personal information. We don't share it for advertising.

We share it only:

• with companies that help us run ThoughtCheck, such as our web host (Netlify, which also receives our website forms), our email provider, Resend (which sends sign-in emails for ThoughtCheck Plus), Stripe (for card payments for Plus codes), and RevenueCat (for purchases of ThoughtCheck Plus in the iPhone and Android apps). They may use it only to provide their service to us. Stripe also uses payment information under its own privacy policy, for example to prevent fraud;
• if the law requires it, such as a valid court order;
• to protect someone's safety or to stop fraud or abuse;
• if Lunar Web Studio, LLC or ThoughtCheck is sold or merged. The new owner would have to follow this policy for information we already have.

If a therapist or counselor told you about ThoughtCheck, or gave you a code, they can't see your checks through us. We don't send your checks to anyone.

6. How long we keep it

We keep update sign-ups and form information until ThoughtCheck no longer needs it for the reason you gave it, or until you ask us to delete it. We keep emails as long as we need them to help you. We keep records of code purchases and orders as long as we need them for tax and accounting, and as long as the law requires. We keep your ThoughtCheck Plus sign-in until you delete your email from ThoughtCheck, and a sign-in record until about an hour after its last number runs out (or a day after the last wrong number), as section 3 explains. Netlify's server logs are kept for a short time set by Netlify.

7. Your choices and rights

You can ask us to:

• tell you what personal information we have about you,
• correct it,
• delete it,
• stop emailing you.

Email hello@thoughtcheck.app with your request. We may need to check that the request comes from you. We'll answer within the time the law requires. We won't treat you differently for asking.

Depending on where you live, such as California, Colorado, Virginia, the European Union or the United Kingdom, you may have more rights under local law. We'll honor them. If you are in the EU or UK, you may also complain to your local data protection authority.

We don't hold the checks you write in the app, so we can't show or delete them for you. You can delete them yourself in the app's Settings.

8. People under 18

ThoughtCheck is for people 18 and older. It is not meant for anyone under 18, and we don't knowingly collect personal information from anyone under 18. If you think someone under 18 has sent us information, email us and we'll delete it. The app asks you to tap I'm 18 or older before you start.

9. Security

Our website and app use HTTPS, so information moving between your browser and our site is encrypted. We limit who can see form submissions and emails. No system is perfectly secure, but we work to protect the information we have.

10. Links to other websites

ThoughtCheck links to other websites, such as crisis help lines and, if you turn on Bible verses, Meinate. Meinate is from the makers of ThoughtCheck, but it's a separate website and app with its own privacy policy. The link to it doesn't tell Meinate which page you came from, and ThoughtCheck sends Meinate nothing you wrote. The other sites have their own privacy policies. We aren't responsible for how they handle your information.

11. Where information is stored

We are based in the United States. Information you send us is stored and processed in the United States and in other countries where our service providers work.

12. Features we plan to add

We plan to add more paid features. We will update this policy before each one is available. Here is how we expect them to work:

• Buying ThoughtCheck Plus for yourself on our website. A payment company, such as Stripe, will handle your card details. We will get the plan you bought, whether it is active, and your name and email. We won't see or store your full card number.
• An AI helper. An AI helper that suggests fairer thoughts may come later. We will update this policy before it does.

13. Changes to this policy

If we change this policy, we'll update the date at the top. If a change is important, we'll also tell you on the website or in the app before it takes effect.

14. Contact

Lunar Web Studio, LLC, dba ThoughtCheck
Email: hello@thoughtcheck.app

See also our terms of use.