Trust and security: how thinkhard.si protects your data

At a glance

The short version

third-party scripts, trackers or ads on any page but checkout: 0
API keys or prompts on our server: 0
to see or delete everything we hold for your email: 1 minute
the longest we keep a message or waitlist entry: 24 months

Where your data goes

Two kinds of data, two different paths. Your work stays with you. Your email reaches us only if you give it, and you can take it back.

Your work stays in your browser; your email is yours to give and take back

In your browser. Your prompts, keys and saved workKept in this browser. Never sent to thinkhard.si.
In your browser. Sent straight to the AI you choseYour browser calls OpenAI, Anthropic, Google or another provider directly, with your key.
Only if you give us your email. Your email, if you chooseFor the prompt repository, the Tuesday email, the waitlist or a message.
Only if you give us your email. Deleted when you saySee it, download it or delete it yourself, any time.

What we hold

Everything thinkhard.si keeps about people, and for how long. The privacy policy says the same in more words; your data shows exactly what we hold for your address.

What	Why	How long
Usage counts	To learn which tools to build next. Only a page path and one of four events, added to a daily total.	Daily totals only. No IP address, device or cookie is kept. Turned off entirely when your browser sends Global Privacy Control.
Your email, for the prompt repository	To open the repository for you, and the Tuesday email if you asked for it and confirmed.	Until you delete it, unsubscribe, or the repository closes.
Waitlist entries and messages	To reply, and to tell you when a plan you asked for opens.	24 months, then deleted automatically.
Accounts (by invitation)	Sign-in, sync between your devices and requests.	Until you delete the account. Sign-in links last 20 minutes; a device stays signed in 90 days after you last use it.
Abuse limits	To stop one network flooding a form.	2 hours, under a name scrambled with a server secret.
Proof of an erasure	To show we deleted what you asked.	12 months. A date and a scrambled form of the address that cannot be read back.

We do not sell personal data, share it for advertising, or use anything you give us to train AI models. Nothing here makes automated decisions about people.

How it is protected

Protection	How
Only our own code runs	Every page sends a Content Security Policy that lets the browser run scripts from thinkhard.si and nowhere else, with no inline scripts. Our build fails if a page breaks the rule. The one exception is the checkout page, which loads Paddle’s payment script once payments open.
API keys never reach us	They stay in your browser, which sends each one only to the provider it belongs to.
Encrypted in transit	HTTPS only, with HTTP Strict Transport Security for a year.
Sign-ins that leak nothing	No cookies unless you sign in. The session cookie is HttpOnly, Secure and SameSite. Sign-in links, sessions and data-request links are stored only as one-way hashes, so a copy of our database would not let anyone sign in as you.
Data outside the web root	What we store sits in a folder the web server cannot serve, readable only by the site’s own account.
No forged requests	Anything that changes data must come from our own pages, with a header other sites cannot set.
No surprise code	No package manager runs on the server and nothing loads from other servers. The few libraries we use are copied in at a fixed version and checked before they are added.
Less to lose	No form of your IP address is kept with signups. Abuse limits use a name scrambled with a server secret and deleted within two hours.
Card details never touch us	When payments open, Paddle takes them in its own checkout frame.

The policy every page is served with, word for word:

default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https: http://localhost:* http://127.0.0.1:*; worker-src 'self' blob:; manifest-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'

connect-src allows any HTTPS address because you can point the tools at your own AI endpoint. It controls where the page may send requests you start, not which code may run.

Laws and standards

What applies to a small site run from India, and where we stand. “We follow it” means we have built for it and checked; it is not a certificate. Where a standard needs an outside audit, we say whether we have one, and we never use a seal or mark we have not earned.

Law or standard	Status	What that means here
India: IT Act, 2000 and the SPDI Rules, 2011	We follow it	The privacy law in force in India today. A published privacy policy, reasonable security practices, and a named Grievance Officer who resolves complaints within one month. Ours is named on the privacy page.
India: CERT-In Directions, 2022	We follow it	Cyber incidents are reported to CERT-In within six hours of our noticing them.
India: Digital Personal Data Protection Act, 2023	Ready early	Its duties for businesses start on May 13, 2027. We already do what it will ask: a plain notice of what we collect and why, consent you can withdraw as easily as you gave it, a named contact, erasure on request, grievances answered within a month, and breach notice to you and the Data Protection Board.
EU and UK: GDPR	Held to its standard	We do not market to the EU or UK, so the law may not formally apply to us, and we have not appointed a representative there. We hold ourselves to its rules anyway: a lawful reason for each use, the rights to access, correct, delete, object and take your data with you, data kept only as long as needed, records of what we process, and breach notice within 72 hours where it requires.
California: CCPA and CPRA	Below the thresholds	The law does not apply to a business this size, but we keep its main promises: we never sell or share personal information, and the site honors Global Privacy Control.
Email law (CAN-SPAM, PECR, ePrivacy)	One step left	Only email you asked for, confirmed twice (double opt-in), from a real sender, with a one-click way to stop in every email. Still to do: our postal address in the footer of the Tuesday email, as US law asks.
Cookies (ePrivacy, PECR)	We follow it	No consent banner, because there is nothing to ask about: no tracking or advertising cookies at all. The only cookie keeps a member signed in; the sign-in form says so before you choose to sign in, and signing out removes it.
SOC 2	Not audited	A SOC 2 report comes from an independent CPA firm. We have not had one, so we do not claim it. This page and our records describe the controls an auditor would test. Paddle, one of the services below, has its own SOC 2 Type II report.
ISO/IEC 27001	Not certified	We follow good practice for a site this size, but hold no certificate ourselves. Our host, Hostinger, is certified to ISO/IEC 27001:2022.
PCI DSS	Handled by Paddle	We never see or store card details. Paddle, our merchant of record, takes payments in its own checkout and attests to PCI DSS.

Services we use

The only other companies that handle personal data for us. We add to this list before a new one starts.

Service	What it does for us	What it receives	Where
Hostinger	Web hosting, the network that delivers pages, and the contact@thinkhard.si mailbox	Everything stored on our server, ordinary access logs, and email sent to us	Our server is in India. Hostinger International Ltd is in Cyprus, and its own providers, listed in its data processing agreement, may handle some data in the EU, UK or US. Certified to ISO/IEC 27001:2022.
Buttondown	Sends the Tuesday prompt email	Your email, where you signed up, the kind of work you chose, and your IP address and the page you came from, which it uses to block spam signups	United States, on Amazon Web Services, under standard contractual clauses for data from the EU and UK
Microsoft (Outlook)	The mailbox that contact@thinkhard.si forwards to	Emails you send us	Microsoft’s data centers
Paddle	Sells Pro as our merchant of record, when payments open	What you enter at checkout; it tells us your email, plan and its status	Paddle.com Market Ltd is in the UK; it stores data in the US and EU. SOC 2 Type II and PCI DSS.

The AI providers you use with the tools are not on this list: your browser calls them with your own key, under your own agreement with them.

If something goes wrong

If personal data we hold is exposed, we contain it first, then find out what happened and whose data was involved. We tell the people affected without delay and in plain words: what happened, what it means for them, what we have done and what they can do. We report a cyber incident to CERT-In within six hours of noticing it. We tell the Data Protection Board of India without delay, with a full report within 72 hours. For people in the EU or UK, we notify the data protection authority where they live within 72 hours, where the breach puts their rights at risk. Then we fix the cause and record what happened and what we changed.

Report a security problem

If you find a vulnerability, please tell us before anyone else. Write to contact@thinkhard.si with what you found and how to reproduce it. Our security.txt has the same details for tools that look for it.

We reply within three working days and keep you posted until it is fixed.
If you act in good faith within these rules, we will not take legal action against you, and we will thank you by name on this page if you want us to.
Please do not access, change or delete other people’s data, run denial-of-service or volume tests, send spam through our forms, or try to trick people. Test only with your own account and your own email addresses.
In scope: thinkhard.si and its API, MCP server and downloads. Our providers’ own systems (Hostinger, Buttondown, Paddle) are theirs to fix; tell them directly.
There is no paid bug bounty.

Questions

Are you SOC 2 compliant?

We have not had a SOC 2 audit, so we do not claim to be. SOC 2 is a report an independent CPA firm writes after testing a company’s controls over time. What we can show you is on this page: what we hold, how it is protected and how long it is kept, and you can check much of it yourself, for example the security headers in your browser’s developer tools.

Do you use my prompts or data to train AI?

No. We never receive your prompts unless you have Pro and turn on sync, and we use nothing you give us to train any model. The AI provider you call has its own rules; most business and API plans do not train on your data, but check yours.

Do you sell or share my data?

No. The only companies that receive personal data are the services listed above, and only to do their part.

How do I get my data deleted?

Yourself, in a minute, on your data: we email you a private link, and one button deletes your account, records, messages and Tuesday email subscription. Data in your own browser is cleared in Keys and data.

Can my company get a data processing agreement?

The tools hold your work in your own browser, so most teams do not need one. If yours does, for example before using sync, write to contact@thinkhard.si.