Thalor App Privacy Policy

Effective date: October 14, 2026

Thalor is operated by Thalor Technologies Inc. ("Thalor," "we," "us"). This policy covers the app at app.thalorworks.com, its invite and answer pages, and support for the app. It explains how we handle information about account holders, invite applicants, and people named or shown in app content.

This policy does not cover the separate forms and services on thalorworks.com or renting Ode, the floating workspace. Posting this policy on that website does not extend its scope to those activities.

Contact: hello@thalorworks.com. You can also use Help → Message Thalor or Leave a note (when signed in) in the app. Our mailing address is Thalor Technologies Inc., PO Box 761, Metlakatla, AK 99926.

1. The essentials

• Thalor stores account details and the words, photos, messages, lists, and invoices people add to coordinate a piece of work or project, called a Work.
• People on a Work can see its shared records, including earlier conversations. The Thalor team can access Work and account information for support and operating the app, including private drafts, but does not read time you record (section 4).
• Some features send text and photos to Anthropic or OpenAI to prepare AI drafts and suggestions. The app does not automatically send Work conversations or invoices to those AI features. Separate development uses are explained in section 5.
• The app has no advertising or third-party analytics integration. It uses sign-in cookies and local draft storage.
• You can request access, correction, or deletion. Requests are handled manually, and deleting an account does not automatically erase every shared record, invoice, historical version, or provider copy.

2. Information we collect and use

Account, sign-in, and invitations

We collect your email address, display name, username, account identifiers, access status, and how you joined, including who invited you. We use them to provide access, send sign-in codes and service communications, and connect you with the Work you join. Sign-in uses an emailed code rather than a password. If you turn on texts, we also collect your mobile number (section 9).

If you request an invite, we collect your name, email address, where the work is, and any organization or work details you provide. We use this information to review and respond to your request. An email entered on a sign-up screen or invite link creates an authentication record before the code is confirmed, even if the person never finishes. An entry alone does not prove that the owner of the email address submitted it.

You pick a username. You can change it whenever you like. After you change it, we hold your old one for 30 days so no one else can take it right away. We keep a record of your past usernames, and only you can see it in the app.

If you invite someone by email, we keep the email address you typed and when you sent the invite. We keep the address only until the person joins or the invite runs out after 14 days. Then we delete the address and keep only a hash of it. A hash is a scrambled copy that is hard to turn back into the address, but it does not necessarily make it anonymous. We use the hash for three things: to honor "Don't email me again," to send the same address at most one invite to the same Work in 7 days, and to check that the person who signs up is the one invited. We also limit how many invite emails one person can send each day and each week.

If you invite someone by phone number, Thalor sends nothing. The app opens your own phone's texting app with the message already written, and the text goes from your phone. Thalor does not receive or keep the number. Your phone and carrier handle the text.

Our authentication and hosting providers process technical information such as IP addresses, browser information, request times, and security logs. The app also keeps hashed email addresses, mobile numbers, account identifiers and IP addresses to count attempts and limit abuse. Hashing does not necessarily make information anonymous.

Optional profile information

You may tell us where you are based, what work you can or prefer to do or would rather avoid, where you are willing to work, and what equipment you can use. You may also save a note about how you approach work. You can skip these questions and change or clear your answers on Profile.

These profile answers and the saved note are visible to you and the Thalor team. Your saved note is used to tailor AI suggestions only if you turn on the relevant Profile setting, which is off by default. Turning it off stops future use for that purpose; it does not remove copies already included in past AI requests.

Work, photos, and messages

We collect Work descriptions, locations and dates you type, photos, questions, answers, updates, conversations, materials and equipment lists, participants and their roles, funding information entered in "Paid by," and the history of changes and actions. We use this information to provide shared records and collaboration features. Editing a record can leave an earlier version in the system.

The app does not request your device's location. A location may nevertheless appear in what you type, in a photo, or in a photo's metadata. The app normally resizes photos and removes embedded metadata before upload. Files that cannot be resized, including some HEIC files, may be uploaded with their original metadata. File names may also be retained.

If you use talking with Thalor (beta), we also collect your conversations with Thalor and the photos you pick for them. We keep a lesson from each conversation with no personal details, and a personal memory for you only if you tap Remember this. Section 5 says how each is used and kept.

Time you record

If you use the time tracker, we store when you start and stop a timer, hours you add, any note you add to them, and your breaks, both the ones we assume and the ones you confirm or change, along with your break settings. Time and breaks are tied to you and to the Work they were for. If you change a time, we keep what the clock measured and the version before your change.

Invoices

We store invoice drafts, issued and voided invoices, payment-status entries, notes, and the issuer, customer, address, contact, price, tax, and payment-instruction details entered. Saved issuer details can be reused on later invoices. Thalor does not process payments or hold money.

If you email an invoice through Thalor, we store the email address you type with that invoice. We send that person a plain email from "<your business name> via Thalor" with the invoice as a PDF and a link to view it, and send you a copy if you choose. If you include them, the updates and photos you posted on that Work go with it as a second PDF. Replies go to the email address you sign in with, which we show you before you send. We record each invoice email we send (when, which invoice, and whether our email provider accepted it); these records hold a fingerprint of each address, not the address itself.

Payment instructions become part of the invoice. Use only information you intend invoice viewers to receive. Do not enter card security codes, banking passwords, account access codes, Social Security numbers, or identity-document numbers. Share sensitive bank details separately through an appropriate secure channel.

Work Reports

When you send a Work Report, we keep an exact copy of what you sent: the days and hours, whether each came from the timer or was typed in, the updates and photos of yours that you chose, a short summary if you wrote one, the name of the person you sent it to, and a PDF. It never holds start or end times, time notes, breaks, rates, or anything a coworker added. A report can be hours only. Before you send a report, we keep its PDF and copies of its photos privately so you can review it. If you do not send it, we delete them after about a day.

You and the person you sent it to can read it and download the PDF. Nobody else on the Work can, the owner included. The Thalor team cannot read it either, unless a team member is on that Work and you named them as the person to send it to. The team can see that a report exists and its status, not what is in it. Like everything in the app, a report is stored where those who run the database can reach it. We note when you first open a report sent to you, to show you which are unread. The sender never sees it.

We keep a report the way we keep an invoice you sent. Changing your time, updates, or photos later does not change it. Sending a report never bills your hours or changes an invoice.

You can withdraw a report. It stays, marked withdrawn, and you and the person you sent it to can still read it. To fix a mistake, you send a correction. That is a new version; the old one stays and is marked replaced.

If you ask us to delete your information, we blank the words in the reports you sent and remove their photos and PDFs. We keep each report's ID, dates, and the days and hours. If you are the person a report was sent to, we blank your name on the copy. Your name may still be in the PDF the sender kept.

Support, feedback, and operation

We collect support notes, correspondence, feedback, and basic first-party usage and error events to help users, troubleshoot problems, protect the service, and understand how features work. App error events are designed to record the error type and screen, rather than the words you typed. Hosting and other providers maintain their own technical logs.

Message Thalor is a private text conversation between you and the Thalor team. The team may write first. The team sees who wrote and when; opening a conversation from support is logged each time. Our Slack notice contains no name or message text. These messages are not sent to AI features.

Text Thalor and Call Thalor open your device's phone or messaging app. A prefilled text may include your display name, the Work title, and the screen you were using; review it before sending. Your phone number, message, and call details are handled outside the app by the relevant communications providers and our support devices or accounts. The app records the tap and originating screen and, when signed in, your account and the Work you were viewing. Information you give support may be added to a Work when needed to provide the help you request.

We may send sign-in codes, access or invitation notices, support replies, and important service or policy notices and, if you turn them on, texts (section 9). If a person on Thalor invites you by email, we send you that one invite for them. Every invite email has a "Don't email me again" link, and after you tap it we do not send invite emails to that address again, from anyone. It does not remove invitations already waiting for you in the app. Emails Thalor sends through the app turn off open and click tracking. There is no marketing email program in the current app.

3. Cookies and information on your device

The app uses session cookies that last up to 400 days after your last use and a short-lived sign-in cookie that lasts about 15 minutes. These cookies are needed for sign-in and are not readable by page scripts. Browser settings can block or clear them, but doing so may prevent sign-in.

The app keeps some unsent text and photos locally, and, if you use the time tracker, a running timer and any start or stop not yet sent, so you can continue with a weak connection. Drafts are cleared after successful submission or sign-out as the relevant feature permits; unsent message drafts are discarded once older than seven days. Browser storage can also be lost or cleared. Sign out on shared devices, and do not rely on local drafts as a backup.

The app does not use advertising cookies or track your activity across unrelated websites for advertising. Ordinary app operation is the same whether or not a browser sends a Do Not Track signal. Service providers still process the technical information described in this policy.

4. Who can see your information

Other participants and link recipients

People on a Work can see its shared words, photos, questions, answers, lists, activity, participants, and conversations. Someone who joins later can see earlier shared history. Invoice drafts are visible to their issuer and the Thalor team. An issued invoice is visible to the person who sent it, the person it is billed to, and the Thalor team, not to everyone on the Work. The updates and photos the sender posted on that Work can go with it; other people's never do.

An invoice link in an email lets anyone who has it see that one invoice, without signing in, for up to 60 days after its due date and no more than a year after the invoice was issued. It shows the invoice as it prints and how to pay, nothing about the Work or the people on it.

The app does not display your account email address to other participants as a profile field. An email or other identifying detail that you type into a message, document, invoice, or photo can still be visible there.

People who have shared a Work with you can find you by your name to invite you to a Work; they see only your name. This is on by default. If you turn it off with "Let people I've worked with find me by name" on Profile, they will not find you by typing your name or see you in their list of people they've worked with. Other Thalor users can invite you by your username, email address or phone number, whatever that setting says. The Thalor team can find anyone by name. Anyone can still invite you with a link.

People can also find you by your username. Someone who types your exact username finds you and sees only your name. There is no list to browse and no search for usernames. If they invite you, you get an invite in the app, and you are not added to the Work until you tap Join.

A Work invite link normally requires approval before its recipient can see the Work. An invitation shown inside the app can reveal the inviter, Work title, and proposed role before the person joins. An invite email says who invited you and, if it is for a Work, the Work's title. It shows nothing else about the Work, and the title is not in the link. The email goes to the address the sender typed, so a sender should check it first. An invite email is also different from an invite link: a person on Thalor sent it, so it needs no approval. Only the person it was sent to can use it: they sign up or sign in with that email address, and an invite for a Work puts them on that Work. The sender can see whether you joined or said Not now. An answer link is different: whoever opens it first and signs in can see who asked (first name), the Work's title, and the selected questions and photos. Share these links only with intended recipients. They can be forwarded, and a name entered by a recipient is not verified identity.

Removing someone from a Work ends their in-app access but cannot erase copies they already saved. Participants may retain or share records outside the app under their own responsibilities. A public agency or tribal entity may have recordkeeping or disclosure duties that affect its copies.

The Thalor team

During the pilot, support is handled by the founder. The team has access to account and profile information, invite requests, Work, conversations, messages to Thalor, photos, invoice settings, and invoice drafts. Support access does not require the team to appear as a participant on a Work.

Time you record is the exception. In the app, only you can see your time entries, breaks and break settings. Other people on the Work, the owner included, cannot, and our support screens do not show them. The team does not read them, though like everything in the app they are stored where those who run the database can reach them. Hours you put on an invoice become part of that invoice and are seen as other invoices are, including by the team while it is a draft.

Talking with Thalor (beta) is another exception. The team cannot read your conversations with Thalor or your personal memory (section 5).

Opening a Work from the support view is logged, with repeated opens within ten minutes grouped together. Those logs are not currently visible to users, and not every administrative view has a separate access log. If the team joins a Work to participate, that is shown to its participants. Removing the team as a participant does not remove its administrative support access.

The team can manage access and invitations and help update Work records. It must join a Work before posting in its conversation. The app's Slack alerts contain generic event notices rather than names, contact details, Work titles, or user-written content.

Service providers and other disclosures

We use providers for the following functions:

Providers process information under the agreements and settings applicable to their services. Some also retain technical or security records for their own legal, security, and service-administration purposes.

We may disclose information when reasonably necessary to comply with law or valid legal process, address fraud or security threats, protect people or legal rights, or resolve disputes. A merger, financing, reorganization, or sale may involve limited disclosure to advisers or a successor, subject to applicable law and the privacy commitments governing the information. We may also disclose information at your direction or with your permission.

We do not sell personal information or share it for cross-context behavioral or targeted advertising.

5. AI features and development

The app's AI features

• Add Work: your description, location and timing text, whether the Work is already underway, up to six photos, and the current date are sent to Anthropic to draft a title, details, and questions.
• Materials and equipment: relevant text you enter and the Work title and description are sent to Anthropic to prepare a list.
• Next-step suggestions: available only to the person doing a Work, after you turn on the Profile setting and save a note. When you ask, your note, the Work title, description, location and timing, and the status and wording of Thalor's own questions are sent to Anthropic. Answers and people's own words are not.

These automated features do not send conversation messages, people's answer text, invoices, invoice settings, or ordinary About you answers as separate inputs. They do not add your account email address. However, anything copied into an AI input, or visible in a submitted photo, can be sent, including names, contact details, or information copied from another part of the app. Filters cannot guarantee removal of personal information.

Thalor stores records of AI requests, outputs, and corrections, including references to photos. These records are not currently editable or deletable through the app. A request may be retried, and one the main model declines may be re-run by Anthropic on another of its models.

Talking with Thalor (beta)

If talking with Thalor is turned on for your account (we are turning it on for active accounts during the beta), you can talk with Thalor about a Work, or about nothing yet. This is a beta. When you send a message, we send it to OpenAI, along with the earlier messages in that conversation. If you started from a Work, we also send that Work's title, description, place, timing and open items. We send a photo only if you pick it. Before anything is sent, Thalor removes other people's names and contact details from your words and from the Work's details. That can miss one, and it cannot remove a name that shows in a photo you pick. We do not send messages from the Work, invoices or hours.

OpenAI is the main provider for this. If it is not working, Thalor sends the same message to Anthropic instead. We switch off OpenAI's option to store the conversation, and we have not agreed to let either provider train on it. Both say they do not train on data sent through their business API unless a company opts in. OpenAI may keep records to check for abuse for up to 30 days. Anthropic's practices are in the next part.

Only you can see your conversation. Other people on the Work cannot, and the Thalor team cannot. Like everything in the app, it is stored where those who run the database can reach it. Nothing goes into a Work until you confirm it. When you confirm something, it is added to the Work with where it came from, and the people on that Work can see it. Our records of these AI requests keep no conversation text.

We keep a conversation for 90 days after your last message. A clean-up runs every day, and it deletes any conversation whose 90 days have ended. You can delete a conversation yourself at any time. Deleting a conversation, or its 90 days ending, does not remove what you already confirmed into a Work, or the messages behind it. Those stay with the Work.

Before a conversation is deleted, we keep a short lesson from it, with no personal details: no names, contact details, places smaller than a region, or Work text. A lesson says things like what kind of question it was, which suggestions you confirmed, changed or turned down, how you corrected Thalor, whether it helped move the Work forward, whether it was about one of the safety topics listed in our Terms of Use, and what it cost. We keep these lessons for good, to make Thalor better for everyone. We use them to test and improve Thalor's instructions. We do not turn one person's private words or wishes into a rule for everyone.

Thalor can also keep a personal memory for you, but only when you tap Remember this on something you wrote: your equipment, the suppliers you like, or how you like answers. It is saved in your own words, used only for you, and only you can read it. The Thalor team cannot. You can see it and delete it in Profile. We keep it while your account exists.

Provider use and retention

Anthropic states that commercial API inputs and outputs are not used to train its models by default. It may use content submitted as feedback or otherwise opted into training. Its standard API retention is up to 30 days, with exceptions for particular services or agreements, legal requirements, and safety or abuse enforcement. Some flagged content and related records can be retained longer. These are Anthropic's stated practices, not a promise that all copies disappear after 30 days. See its commercial training policy and retention policy.

Improving Thalor and separate development tools

We use feedback and corrections to understand errors and improve Thalor's drafting instructions and features. Thalor does not itself train AI models using this content. You can ask us to exclude your content from future optional product evaluation.

Time you record: we learn from totals, such as how many break questions are answered with one tap, not from your name, pay, notes or places. The records we keep of what happens in the app show when a timer was started or stopped under your account, so they show how long it ran. They do not show the Work, any hours you typed in or your notes.

We use tools such as OpenAI's ChatGPT and Codex and Anthropic's Claude Code to develop and review the app. The product notes and records these tools read include real Work examples and pilot feedback. We leave out names, email addresses, phone numbers and street addresses and refer to people by role, but in a small community a role, place or Work detail can still let someone recognize a person. Screenshots used in development can show Work content and names. You can ask us to remove an example about you.

During pilot development, product notes could include real Work examples with names and contact details removed, and live support screenshots were shared in AI-assisted development conversations. Information visible in a screenshot or included in a note could therefore have reached the relevant tool provider. Those submissions are separate from the app's automated AI features and were subject to the development tool's applicable terms and account settings. The commercial API practices described above do not establish how every development submission was handled.

You can contact us about an earlier example or screenshot that may contain your information. We will investigate and take action required by applicable law and the commitments under which the information was collected. This policy does not retroactively authorize an earlier disclosure that was inconsistent with those commitments.

6. Storage and retention

The app's database and photo storage are configured in Oregon, United States. App hosting is configured in Oregon, but delivery networks, provider support, AI processing, logs, and other services may operate elsewhere. We do not promise that all processing stays in Oregon or the United States. If you access the app from another country, your information may be processed in countries with different privacy laws.

During the pilot, account and Work records, photos, earlier versions, activity history, and AI records are generally retained unless addressed through a deletion request or another removal process. Closing a Work does not by itself delete its records.

Conversations with Thalor (beta, section 5) are kept for 90 days after your last message and then deleted. Things you confirmed into a Work stay with the Work. Lessons without personal details are kept for good. Your personal memory is kept while your account exists, and you can delete it in Profile.

There is currently no automatic expiration for invite requests, unfinished sign-in records, hashed attempt records, or abandoned uploads. These records can remain until manually removed. The exception is the email address typed to invite someone, which we delete as section 2 says. We assess retention against operational need, shared-record requirements, security, legal duties, and valid privacy requests; describing current storage is not a claim that indefinite retention is always necessary or lawful.

Database backups are made daily. Deleted information may remain in backups until the applicable backup cycle ends. Providers' email, security, and other logs, and earlier development submissions, follow the applicable service settings and retention rules. Local draft retention is described in section 3. Contact us if you need retention details for a particular record.

7. Requests, choices, and deletion

Contact hello@thalorworks.com or use Help → Message Thalor or Leave a note (when signed in) to request access to or a copy of your information, correction, deletion, account closure, or exclusion from optional product evaluation. People without an account can also contact us about information concerning them. Explain the request and, where possible, identify the relevant Work or item without sending unnecessary sensitive information.

We may ask for information reasonably needed to verify your identity or authority and locate the records. We handle requests manually; the app does not yet provide an account-deletion button or a data-download tool. Account closure and deletion are separate actions. We will explain what action we can take, what remains, and why.

Current deletion limits: stored AI inputs and outputs, historical answers and notes, invitation labels, conversation-related records, issued invoices, and time entries are not supported by the ordinary deletion tools. Removing a time entry only marks it removed, and we can take the words out of a time note on request. Deleting an account replaces the words of every Message Thalor message, including the team's replies, with "[removed]"; the message records stay. Removing a display name does not remove names or identifying details embedded in text, photos, or invoices. We cannot promise immediate or complete erasure of every copy.

Shared contributions can remain where needed for other participants' records and where legally permitted. Issued invoices may be retained for accounting, tax, or dispute purposes; we review requests to change identifying details rather than promising that every invoice can be erased or anonymized. Copies already saved by other participants are outside our direct control.

Technical limitations do not override legal rights. Where applicable law requires deletion or another action, we must meet that requirement, including working with providers where required. We will respond within the time required by the law that applies to your request and explain any lawful exception or extension.

Depending on your location and whether a law applies to Thalor, you may have rights to access, correct, delete, receive a portable copy, object to or restrict processing, withdraw consent, or appeal a denied request. You may use an authorized agent where the law permits and complain to the relevant privacy regulator or attorney general. To ask for reconsideration, reply to our response explaining why. We will not retaliate for exercising a protected privacy right.

8. Security and information about other people

Thalor uses HTTPS, access controls, expiring email sign-in codes, attempt limits, and private photo storage with expiring access links. No system is completely secure. Protect your email account and device, and tell us promptly if you suspect unauthorized access. If a security incident triggers a legal notification requirement, we will notify affected people and authorities as required.

Provide information about another person only when you have the necessary authority or permission and a lawful reason to share it. Include only what the Work needs, and explain the intended sharing to people where required. Do not assume that another person agreed to AI processing just because you have their photo or contact details. A person named or photographed in a Work can contact us even if they do not use Thalor.

9. Features available only when enabled

Bot check: when enabled, Cloudflare Turnstile runs on sign-up pages, including invite links, and on Request an invite. It processes IP and browser or device signals to distinguish people from automated requests.

Free invoice maker: when enabled, the free invoice maker at /invoice works on your phone or computer. What you type stays in your browser on that device, unless you save or send the invoice yourself, until you tap "Forget my details on this device" or clear your browser's data (signing out doesn't clear it). The invoice maker itself only tells Thalor that an invoice was made or that its join button was tapped, with nothing that identifies you. If you then request an invite through that button, your request is recorded as coming from the invoice maker.

Texts from Thalor (when enabled): you can choose on Profile to get texts. If you turn them on, we collect the mobile number you enter, confirm it with a code we text to it, and record your agreement: the words you agreed to, when, and on which screen. We use your number only to text you when someone asks you to join a Work or a Work is waiting on you, to send those codes, and to act on replies such as STOP and HELP. Texts include no names, Work titles or places, and their links don't name the Work. Other people on a Work don't see your number or whether you get texts. Twilio delivers our texts and processes your number, the messages and delivery details; mobile carriers also handle them.

We record each text we send (when, which request or Work it was about, and whether it was delivered) and the type of each reply, such as STOP, but not what a reply says. These records don't include your number.

We do not share your mobile number or your agreement to receive texts with third parties or affiliates for marketing or promotional purposes. The disclosures described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, other than the providers that deliver our texts.

To stop texts, reply STOP to any Thalor text (a reply such as "stop texting me" or "wrong number" works too), or turn texts off on Profile, which also removes your number. If you remove your number or close your account, we delete it from our records; backups follow section 6. We keep the record that you agreed and stopped, and of the texts we sent, for four years, without your number, so we can show we followed your choices. We delete each message from our Twilio account once it has been delivered or has failed; Twilio and carriers keep their own records.

We will provide any additional notice or choice required before introducing these features or materially changing how they use information.

10. Age and policy changes

Thalor is intended for adults aged 18 or older. It is not directed to children. If we learn that we collected personal information from a child under 13 in circumstances covered by children's privacy law without required permission, we will take the required steps to delete it or otherwise comply with that law. Contact us if you believe a child is using the app.

We will update the effective date when this policy changes. For material changes, we will provide a notice through Message Thalor or email before the change takes effect, except where a shorter period is required by law or an urgent security need. Where consent is required, we will obtain it. Posting an updated policy does not by itself authorize a materially incompatible new use of information collected under earlier commitments.

Our App Terms of Use explain the rules for using the Service.

Contact: hello@thalorworks.com · Help → Message Thalor or Leave a note (when signed in) · Thalor Technologies Inc., PO Box 761, Metlakatla, AK 99926