Privacy Policy
Last updated 28 August 2026
This policy explains what personal data we collect, why we collect it, who else handles it, and what rights you have over it. It covers both this website and the Loose Thought app. Where the two differ, we say which one we are referring to.
In summary: your notes are yours, we don't sell data, we don't run advertising, and we don't use your content to train AI models.
Who is responsible for your data
The data controller is:
Grey Heron Technologies LtdA company registered in Ireland, company number 798784
support@loosethought.com
For any question about your data, or to exercise any of your rights, write to support@loosethought.com.
What we collect when you use the app
- Your account
- Your email address and a securely hashed password. Your email is used to authenticate your account, facilitate password resets, and acts as the contact for mandatory notifications.
- Your notes
- The entries you create, including notes, sheets, notebooks, their layout and their connections. This is stored on your device and synchronised to our servers so it is backed up and available on your other devices.
- Images and files you add
- Any image or file attachment you put into a notebook.
- Sharing and collaboration
- People you invite to a notebook and the access that you give them. When someone is invited to collaborate, we store their email address so the invitation can be dispatched to them and ongoing access can be controlled.
- Your subscription
- Whether your account has a trial, retail, or free licence, and the identifiers needed to match a recurring subscription to your account. We do not store your billing or payment details, see Payments.
- Technical logs
- Our servers record requests they receive, including the IP address, time, and resource requested. These are kept briefly and are used to operate the service, diagnose faults and detect abuse.
- Link previews
- When you paste a web link into a note, the app asks our preview service to fetch that page's title and image so it can show you a preview. The Link previews section explains this in more detail.
What we collect when you visit this website
You can browse loosethought.com without an account. This is what we collect:
- Page analytics
- We use GoatCounter, a privacy-focused analytics tool, to count page views and see which pages have been accessed. It does not set cookies or track you across sites.
- Newsletter sign-ups
- When you submit the newsletter signup form, we store the email address you entered, the date and time, your browser's user agent string, and your IP address. The last two are recorded to help us identify automated or abusive submissions. We use the address to send you the newsletter. Every email we send includes an unsubscribe link.
- A security cookie
- One strictly necessary cookie, used to protect the newsletter form against cross-site request forgery. It includes no personal information about you and is not used for tracking, which is why we don't show you a cookie consent banner.
Why we use your data, and our legal basis
| What for | Legal basis |
|---|---|
| Providing the service: storing, syncing and backing up your notes, running your account | Performance of our contract with you |
| Taking payment and honouring refunds | Performance of our contract, and our legal obligations |
| Keeping tax and accounting records of sales | Legal obligation |
| Keeping the service secure, diagnosing faults, preventing abuse | Our legitimate interests in preventing abuse and maintaining service quality for all users |
| Counting page views on this website | Our legitimate interests in understanding how people interact with the site, without invasively tracking individuals |
| Sending the newsletter | Your consent, which you can withdraw at any time |
We never use your content for anything other than providing the service to you. We do not use it to train AI models, we do not provide it to anybody else for that purpose, and we do not analyse it to profile you or to advertise to you. We do not read your notes except where you explicitly ask us to in the course of support, or where the law requires us to.
We do not make any decisions about you by purely automated means that have legal or similarly significant effects on you.
Payments
Payments are handled by our merchant of record (currently Creem). When you subscribe, you provide your payment details to the merchant of record and their payment processors. We never see or store your card details.
The merchant of record tells us when a subscription starts, renews or ends, along with an order identifier, a customer identifier and its status. The merchant of record is the data controller for the payment and billing information you share with them, and applies their own privacy policy accordingly.
Link previews
When you paste a web link into a note, Loose Thought fetches information about the link so it can show you a preview. Most of the time it does this through our own preview service, which is not tied to your account and keeps no record of what was requested.
For some sites (including YouTube and others) your browser contacts the site directly for this information. In these cases, the interaction is governed by the privacy policy of that site.
Who else processes your data
Loose Thought uses a small number of cloud service providers. They act on our instructions, under contract, and are not permitted to use your data for their own purposes. We use providers for:
- Hosting: running the app and its database, and storing your notes, attachments and our backups.
- Payments: taking payment and issuing receipts. This is our merchant of record, which controls the information that appears on your billing statements.
- Email: sending account email such as password resets, and receiving mail you send to our support address.
- Website hosting and analytics: serving this website, counting page views, and sending the newsletter.
We do not sell your personal data, and we do not share it with advertisers. We may disclose data where we are legally required to, or to establish or defend legal claims. If you would like to know which specific providers we use, you can request this information by sending an email to support@loosethought.com.
Where your data is held
Your notes, attachments and backups are stored in Europe. Images and documents are hosted in Ireland, and app hosting is in the United Kingdom.
Some of our hosting providers operate globally and may process data outside the European Economic Area. Where they do, the transfer is covered by an appropriate safeguard, such as the European Commission's Standard Contractual Clauses or the EU/US Data Privacy Framework.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Correct it if it is wrong or incomplete.
- Erase it, where that right applies.
- Restrict or object to our processing of it, including objecting to anything we do on the basis of legitimate interests.
- Portability so you receive your data in a structured, commonly used, machine-readable format.
- Withdraw consent at any time, where we relied on it. This does not affect processing carried out before you withdrew it.
To exercise any of these, send an email to support@loosethought.com. We will respond within one month. There is no charge.
If you are unhappy with how we have handled your data, you can complain to the Irish Data Protection Commission (dataprotection.ie), or to the supervisory authority in the EU country where you live.
How long we keep your data
- Your account and notes: for as long as your account exists. If you ask us to delete your account, we will remove your notes and attachments from our live systems promptly, and they eventually age out of our backups in due course.
- Server logs: up to 90 days, then deleted.
- Email you send us: we keep support correspondence so that we can maintain the history of our interactions if you contact us again.
- Records of purchases: for as long as tax and accounting law requires, which we are unable to shorten on request.
- Newsletter sign-ups: until you unsubscribe or ask us to remove you.
Security
Connections to the app and to this website are encrypted in transit. Passwords are hashed and not stored in plain text. Access to production systems is strictly limited to authorised personnel. We keep backups so that data can be restored if something goes wrong.
In the unlikely event of a security breach which puts your rights at risk, we will notify the Data Protection Commission, and if the risk to you is high we will contact you directly.
Children
Loose Thought is not intended for children, and you must be at least 16 to create an account. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time as the service evolves. If a change materially affects you, we will notify you by email.
Contact us
support@loosethought.com. If you require a postal address for a formal request, please ask and we will provide one.
See also our Terms of Service.