What we keep, and why.

Thayln is built to keep your things on your own PC. This notice explains the little we do collect, why, where it's kept, who helps us, and how to see, fix or delete it. It covers the Thayln app, your account, Thayln Plus, the AI Store, the developer site, our emails and our websites. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles. "We" and "us" means Thayln, of Sydney, New South Wales, Australia.

The short version

• Your chats, memories, files, photos, vault and settings stay on your PC. We can't see them.
• Your account holds only what's needed to sign you in, run your plan and show your connected PCs.
• We don't sell your information, we don't show ads, and the website has no analytics or trackers.
• You can ask for a copy of your information, or have it corrected or deleted, at any time.

What stays on your PC

• Thayln and its own AI run on your Windows PC. Your chats, memories, files, photos, vault and settings are kept there, not with us.
• Chats between people are end-to-end encrypted. Only the people in the chat can read them.
• AI Store apps run in a locked-down sandbox on your PC, with only the permissions you approve.

Your account

Your account at thayln.com/account holds:

• your email address;
• your plan;
• your sign-in history: the time, the browser and your approximate country;
• the PCs you've connected: each one's name, its app version, some counts and yes/no status, and whether it's online. Never the content of anything on it.

You sign in with a 6-digit code we email you. There are no passwords to store. Thayln accounts are for people aged 18 and over, and the app asks you to confirm that.

Plans and payments

• Payments for Plus and the AI Store are handled by Stripe. Stripe holds your card details; we never see them.
• We keep a record of your plan, your purchases and subscriptions, and their status, so the right features work and so we can handle refunds and keep the records the law requires.

The AI you choose

• Thayln's own AI on your PC: everything stays on your PC.
• A cloud AI with your own API key: your key and your requests go straight to that AI provider, never to us. That provider's privacy policy applies.
• Your own AI server: requests go to the server you set up.
• Thayln's own AI on Plus: your requests go through our servers to an AI provider (Anthropic's Claude) on our key, to get your answer. We don't keep the content.

The AI Store

• We keep which apps you've bought or subscribed to, so they work on your PCs, and any reports you send us about an app.
• An app can only reach your information through the permissions you approve, and can only connect to internet hosts it has declared or that you allow.
• If an app sends information to its developer, that developer's privacy policy applies. Every paid app's developer must link one from their profile. Our App Privacy Rules say what developers may and may not do.

If you're a developer

• Your developer account is your normal Thayln account with developer access. We also keep your Developer ID and your apps.
• Your public profile (name, bio, logo, website, support contact and privacy policy link) is shown to everyone. It's checked by an AI review before it's public.
• Your apps are reviewed by an AI review and by people. The AI review uses our access to Anthropic's Claude.
• If you sell apps, Stripe (through Stripe Connect) checks your identity and bank details, and holds them. Your profile shows "Verified" once Stripe has checked you.
• If you connect GitHub, we get read-only access to the repositories you pick, and nothing else.

The waitlist and the developer list

• We keep your email address, the date and your local time when you joined, and anything you pick (what you'd use Thayln for, which device), so we can send your invite, or tell you when something you signed up for opens.
• We also note your country, worked out from the time zone and language your device reports. We don't look up your location from your network address.

Messages and email

• If you send us a message through the website, we keep your name, email, company, message, the date and your country (from your device's time zone) so we can reply.
• Emails to any @thayln.com address are read and answered by Thayln's AI email assistant, which uses Anthropic's Claude. It tells you it's an AI. Reply "human" to reach a person. Anything about money or security always goes to a person.
• Feature requests you post at thayln.com/ideas are used to decide what to build.
• Our emails are sent by Zoho ZeptoMail, whose servers are in India. Emails to us arrive through Forward Email. Our emails have no tracking pixels or tracked links.

Our websites

• No analytics and no advertising trackers.
• No cookies, except one sign-in cookie (__session) on the account and developer sites, which keeps you signed in.
• Fonts load from Google Fonts, so Google sees your network address when your browser fetches them.
• To stop abuse, we briefly record a scrambled (hashed) form of your network address to limit repeated requests. It's never stored as-is.

Why we use it

• To sign you in, keep your account safe and show you your sign-ins and PCs.
• To run your plan, take payments, give refunds and keep the records the law requires.
• To run the AI Store, review apps and developers, and pay developers.
• To answer you, and to stop fraud and abuse.

We don't sell your information. We don't use it for advertising. We don't use your chats or anything on your PC to train AI.

Emails we send

• We send emails you need: sign-in codes, invites, receipts, and notices about your account, your plan, your apps or these policies.
• We only send marketing emails if you've said yes, as the Spam Act 2003 requires. Every one has an easy way to stop them.

Who helps us, and where

We use a few trusted providers. Some are outside Australia, so your information may be sent overseas (Australian Privacy Principle 8). Each gets only what it needs for its job:

• Google Cloud (Firebase), in Sydney, Australia: hosts our servers, your account, the waitlist and messages.
• Stripe, in the USA and other countries: payments, and identity and bank checks for developers.
• Anthropic, in the USA: the AI for our email assistant, the AI review of apps and developer profiles, and Thayln's own cloud AI on Plus.
• Zoho ZeptoMail, in India: sends our emails.
• Forward Email: receives email sent to us.
• GitHub, in the USA: only if you're a developer and connect it.
• Google Fonts: the website's fonts, as above.

We choose providers with strong privacy and security commitments, and we take reasonable steps so they handle your information in line with the Australian Privacy Principles. We may also share information if the law requires it, or to protect someone from serious harm.

How long we keep it

• Your account information stays while you have an account.
• When you delete something, it's gone from our live systems, and backups clear within 7 days.
• When you ask us to delete your account, we switch it off first and delete it 14 days later, so you can change your mind until then.
• Records of payments and tax are kept for as long as the law requires (5 years), even after your account is deleted.
• Reports about chats you were part of are kept by our safety team, as they are for everyone involved.
• After your account is deleted we keep a scrambled form of your email address (it can't be turned back into the address) with the date, whether you've had the free trial, and, only if we closed the account for seriously breaking our terms, that the address can't make a new account.

Keeping it safe

• Your things stay on your PC, so there's very little on our servers to protect.
• Sign-in uses one-time codes, data travels encrypted, and access to our systems is limited to those who need it.
• If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Seeing, fixing or deleting your information

• You can ask for a copy of your information, ask us to correct it, or ask us to delete it. Email hello@thayln.com or use the account site.
• We check it's really you first, then do it within 30 days. Backups clear within 7 days after that.
• You can ask us things without giving your name. To have an account, though, we need an email address.

Questions or complaints

Email hello@thayln.com. Privacy complaints go to a person, and we'll reply within 30 days. If you're not happy with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this notice

If we change how we handle your information in a way that matters, we'll update this page and email you first. Our Terms of Use and Refunds and cancellations page are separate.

Last updated 21 October 2026. Draft for legal review.