Privacy policy

Thavala is made by ProAppLabs Development Studio Inc. In this document “Thavala”, “we” and “us” mean that company.

This policy says what personal information Thavala handles, why, who else handles it for us, and what you can do about it. It covers this website, the Thavala app, and the cloud service that the paid plans add. Thavala decides how that information is used, which makes it the “controller” of it in the words of data-protection law.

The short version

• This website keeps one thing about you: your email address, if you join the waiting list. It sets no cookies.
• The app is free and needs no account. It keeps your library on your computer, and we receive none of it.
• If you buy a plan, your library is also kept in Thavala's cloud, so that your computers can share it. It is encrypted, with keys that we hold, so technically we can read it. It is never used to train AI, and no person at Thavala looks at it unless you ask us to.
• We do not sell personal information, and Thavala carries no advertising.

This website

The waiting list

If you join the waiting list, we keep your email address, the time you signed up, the time you confirmed, and which page you signed up on. We send you one email that asks you to confirm. If you do nothing, you will not be on the list, and the address is removed after 30 days.

Once you have confirmed, you get one more email, on the day Thavala is ready. Within 30 days of that day the whole list is deleted. Every email has a link to a page where one button takes you off the list.

The check that you are a person

When you send the waiting-list form, Cloudflare checks that a person is sending it and not a program. To do that it looks at technical details of your browser and at your internet address (your IP address). It asks you nothing.

No cookies, and counting visits

This website uses no cookies and carries no advertising. We count visits with Cloudflare Web Analytics, which uses no cookies, does not identify you and does not follow you to other websites.

Sending you the pages

Like every website, this one reaches you through a hosting company, in our case Cloudflare. It handles your IP address and details of your browser in order to send you the pages and to block attacks. We do not use that information to identify you.

The app on your computer

The Thavala app needs no account. Your captures, recordings, meetings, notes and chats, the text Thavala reads from them and the index it searches are all kept on your computer. The AI you download for the app runs on your computer too. None of this is sent to us, and we cannot see it.

Thavala captures and records nothing until you start it. It does not watch your screen or listen in the background.

Nothing in Thavala inspects the content on your computer, or uploads it, to check on you. That is so whether or not you have an account.

The app does use the internet for some things:

• Updates and AI models. When the app downloads an update, or an AI model you chose, the server the file comes from sees your IP address, as with any download. Nothing from your library is sent.
• Your own AI key. If you connect a key from an AI company, what you ask, and the content the answer needs, goes straight from your computer to that company, under your own agreement with it. It does not pass through us.
• A paid plan, if you have one, as the next section describes.

With a paid plan

A plan needs an account, and it brings some of your information to our servers.

Your account

We keep your email address and how you sign in: with a code sent to your email address, or with Google or Apple. If you sign in with Google or Apple, we receive what they pass on to us when you sign in, such as your name and email address. We keep a list of the computers you have signed in on: the name of each one, which you can change, whether it is a Windows computer or a Mac, and when it was last seen. We keep which plan you have and whether it is paid, and how much cloud storage and cloud AI you have used. Those are amounts only, never content.

We email you only about your account: sign-in codes, reminders about your plan and your payments, and notices we have to send. We send no newsletters.

Your payment

Plans are sold by Paddle, the Merchant of Record for Thavala's orders. Paddle collects your payment details and the billing information that tax law requires, and is responsible for them under its own privacy policy. We never see your card number. Paddle tells us what we need to run your plan: the email address you bought with, which plan you bought, and the state of your payments.

Your library

When you have a plan and add a computer's library to your account, the library is copied to Thavala's cloud and kept in step across the computers you sign in on. That covers your captures, recordings, meeting audio, transcripts, notes, chats and tags, the text Thavala read from your captures, and the settings you chose.

Two things stay behind. An AI key you added yourself never leaves the computer it is on. And you can keep any recording, or the audio of any meeting, out of the cloud: it then stays on the computer that made it, and only its small preview picture and its text are synced.

How your library is protected

Your content is encrypted on its way to our servers and while it is stored there, with keys that we hold. It is kept separately for each account, and under separate access controls from account and billing information, so the services that process payments cannot read it. Your content is never used to train AI models, and it is never looked at by a person at Thavala unless you explicitly ask us to.

These are promises about our rules and about how the service is built. They are not a guarantee made by mathematics: technically, we can read what you sync. That is a deliberate choice, because it lets our servers work on your library when a feature needs them to. It is not the kind of encryption in which only you hold the keys, and we do not claim that it is.

Cloud AI

Cloud AI comes only with a plan, or with a plan's trial. With one, your content is sent to cloud AI in two cases, and in no others:

• when cloud AI is the AI in use for what you ask. It is in use when you have chosen it. And if you have set up no other AI, cloud AI is the one in use, without your being asked first;
• for the notes of a meeting, which are written in the background, when cloud AI is the AI chosen for meetings.

You can change which AI is in use at any time, in the app.

When cloud AI is used, your question and the content the answer needs (a capture, some text, or the items of your library that the AI opens in order to answer) are sent through our servers to the AI company named in the list below, which writes the answer. That company does not use what it receives to train its models. It may keep a copy for up to 30 days to watch for abuse, and then deletes it.

Why we use this information

Data-protection law asks us to give a reason for each use. Ours are these:

• Your consent, for the waiting list. You can take it back at any time with the link in each email.
• Our agreement with you, for everything a plan does: your account, keeping your library in the cloud and in step, cloud AI, and the emails about your account.
• Our legitimate interest in a safe, working service, for sending you this website, counting visits, and preventing abuse. Our checks against abuse use account and device details only, never your content.
• The law, where it requires us to keep a record or to answer a lawful request.

Who else handles your information

We do not sell personal information. It reaches other people and companies only in these ways.

Companies that work for us

These companies handle personal information for Thavala, on our instructions:

• Cloudflare sends you this website, keeps the waiting list and runs its check that you are a person, counts visits, delivers the app's installers and updates, and stores the pictures, recordings and audio of cloud libraries.
• Fly.io runs the servers of the cloud service, in the United States.
• Supabase runs the database of the cloud service and its sign-in, in the United States.
• SMTP2GO sends our emails.
• OpenAI provides cloud AI. It receives what you send to cloud AI, in order to write the answer.

We change this list whenever one of these companies changes.

Others

• Paddle, which sells the plans and takes the payments, as described above.
• Google or Apple, if you choose to sign in with one of them. It learns that you signed in to Thavala.
• Our professional advisers, such as lawyers and accountants, when we need their advice.
• Authorities, when the law requires it of us. We give only what the law requires.

Other countries

The servers of the cloud service are in the United States, and the companies above may handle information in other countries as well. If you live in the European Economic Area, the United Kingdom or Switzerland, that means your information leaves your region. Where the law requires a safeguard for such a transfer, we rely on the standard contractual clauses approved for it, in our agreements with those companies.

How long we keep it

• The waiting list: until the list is deleted after the day Thavala is ready, or until you leave it, as described above.
• Your account information: for as long as you have an account.
• Your library in the cloud: for as long as you have a plan. What you delete goes to the Trash for 30 days and is then removed. When a plan ends you have 90 days to download your cloud library, and then the cloud copy is deleted. If you delete your account, the cloud copy is deleted straight away.
• Backups: the backups of our database can hold deleted information for up to 7 more days.
• What you send to cloud AI: up to 30 days at the AI company, as described above.
• Payment records: Paddle keeps them for as long as tax and accounting law requires.

Your choices and your rights

Some things you can do yourself, at any time:

• leave the waiting list, with the link in each email;
• sign a computer out of your account, from the list of computers in the app;
• delete your account, in the app's account settings.

Wherever you live, you can also ask us for a copy of the personal information we hold about you, ask us to correct it or delete it, ask us to stop or limit a use of it, object to a use of it, ask for it in a form you can take to another service, and take back a consent you gave. Write to us at support@thavala.app. We answer within one month.

If you are not satisfied with our answer, you can complain to the data-protection authority where you live.

Security

Information travels to our servers encrypted and is stored encrypted. An account has no password that could be stolen: you sign in with a code that works once, or through Google or Apple. The app keeps your sign-in in your computer's own secure key store. You can see every computer that is signed in to your account, and sign any of them out.

No service can promise perfect security. If something goes wrong that affects your information, we tell you, and the authorities, as the law requires.

Children

Thavala is not made for children, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, write to us and we will delete it.

Changes to this policy

We may change this policy. The date at the top says when it last changed. If a change matters to how we use the information of people who have an account, we email them before it takes effect.

Contact

For any question about privacy, or to use one of your rights, write to us at support@thavala.app.