Privacy

You can use over-thinking without an account. Anonymous dumps are processed in memory and never stored. If you log in, your history is saved to your account, visible only to you, and you can delete any of it — or your whole account — anytime. We never sell your data, and our AI providers are contractually barred from training on it. over-thinking is operated by Whatatime, Inc., a US company; the full legal details are below.

over-thinking is made by Whatatime, Inc., 390 NE 191st St, STE 93224, Miami, FL 33179, United States. Under privacy laws like the EU's GDPR and Brazil's LGPD, Whatatime is the "data controller" — the party responsible for how your data is handled. Reach us at ted@over-thinking.com.

Anonymous use: your dump travels to our server over TLS, is turned into your reasoning tree, and is discarded — it never lands in our database. We keep only anonymous counters: token totals and a one-way SHA-256 hash (of your IP or a random visitor id) used to enforce the free daily limit. Neither can be traced back to you or your words. Basic analytics (page visited, a random visitor id, session heartbeats) help us understand traffic; none of it contains your text.

With an account: your email address (for sign-in codes and product email), your untangle history and committed decisions (so you can reopen them), and your subscription status. History is protected by row-level security — readable only by you — and encrypted at rest (AES-256).

If you subscribe: on the web, payments are processed by Stripe; in the iOS app, by Apple. Your card number never touches our servers; we store only the customer/subscription identifiers and status.

One thing worth naming:a dump is your own words about your own life. It can touch on your health, your relationships, your beliefs — things privacy law calls "special category data". We never ask for any of it, we don't extract or profile it, and it's processed only as free text, only to answer you. By submitting a dump, you consent to us processing whatever you chose to include (GDPR Art. 9(2)(a)). You can withdraw that consent at any time by deleting your history and not submitting more; withdrawal doesn't affect processing that already happened.

The reasoning runs on enterprise AI APIs under terms that forbid using your data to train models:

· Anthropic— the reasoning engine that builds your tree. Inputs and outputs are deleted from Anthropic's systems within at most 30 days.
· xAI — optional live web search that grounds an untangle in current, real-world context.

Both receive the text you submit, process it to produce your result, and are bound by API terms that exclude training on your inputs.

Supporting infrastructure, all acting as our processors under data processing agreements: Supabase (database & authentication), Vercel (hosting & privacy-friendly analytics), Stripe (payments on the web), Resend (transactional email). Apple processes App Store purchases as an independent controller. That's the whole list — nobody else sees your data.

Our servers and providers are in the United States. When your data travels from the EU/EEA, the UK, or Brazil to the US, the transfer is covered by the EU–US Data Privacy Framework (for certified providers) and Standard Contractual Clauses (GDPR Art. 46), or the equivalent safeguards under the LGPD.

We never sell or rent your data. We never use your words for advertising. We never train models on your dumps — and neither may our providers. Founder feedback you send us is read by a human (Ted); your dumps are not.

· Running the product for you — generating your tree, keeping your history, managing your subscription: performance of a contract (GDPR Art. 6(1)(b))
· Any sensitive details you choose to include in a dump: your explicit consent (Art. 9(2)(a))
· Security, abuse prevention, debugging, and aggregate analytics: our legitimate interests (Art. 6(1)(f))
· Tax and accounting records: legal obligation (Art. 6(1)(c))

The AI response is generated automatically, but it decides nothing about you — it's a reflection, not a verdict. GDPR Art. 22 (automated decision-making) doesn't apply.

· Anonymous dumps: not stored, period.
· Your history and saved decisions: until you delete them.
· Your account: removed immediately when you delete it; residual copies in backups purge within 30 days.
· Technical logs: up to 90 days.
· Transaction records: as long as tax and accounting law requires.

Wherever you are, you can access, correct, delete, and export your data, object to or restrict certain processing, and withdraw consent — without being treated worse for exercising any of it. Most of this you can do yourself in the app; for the rest, email ted@over-thinking.com and we'll answer within 30 days.

If you think we got something wrong, you can also complain to your data protection authority: your local DPA in the EU/EEA, the ICO in the UK, or the ANPD in Brazil. (We'd rather you tell us first.)

Any history entry can be removed one-by-one or all at once from the history page. Deleting your account removes your profile, history, saved decisions and subscription records; active subscriptions are cancelled first. You can delete your account from the account page on the web or in the iOS app — no email required, effective immediately.

We use a session cookie for sign-in, an anonymous visitor id for the daily limit and analytics, a referral cookie if you arrive via an invite link, and Stripe's fraud-prevention cookies at checkout. All of it is functional; none of it is advertising. No third-party ad trackers, no consent banner needed.

over-thinking is for people sorting out their own heads. You must be at least 13 — or 16 where your country sets that bar (much of the EU/EEA). If we learn we've collected a younger child's data, we delete it.

over-thinking helps you think; it isn't medical, psychological, legal, or financial advice. If you're in crisis, please reach out to a professional or an emergency service where you live.

If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect. The date at the top is always current.

Whatatime, Inc. · 390 NE 191st St, STE 93224, Miami, FL 33179, USA
ted@over-thinking.com — we answer.