Legal

Privacy Policy

Effective date: 2026-10-05 / Version: v1 (free beta)

This is an unofficial English translation provided for convenience. The Korean version is the legally binding original and prevails in case of any discrepancy. The operator of Thinket (the "Operator") operates the web service and desktop app Thinket (the "Service") in compliance with applicable laws such as the Personal Information Protection Act, and processes users’ personal data as follows.

Article 1 (Categories, Purposes, and Retention Periods of the Personal Data Processed)

The Operator processes the following personal data.

• The Operator does not collect personal data other than the items above. It does not collect phone numbers, unique identifiers such as resident registration numbers, or sensitive data.
• Because the Service is provided as a free beta, no payment information is collected.
• The “API key” above is processed only where the user registers it directly. A key registered on the web is stored only in encrypted form and is never shown again on any screen after registration (only the last 4 characters are shown). A key registered in the desktop app is stored encrypted only on the user’s device and is not transmitted to the Operator’s servers. Users may delete the key at any time in settings, and it is destroyed without delay upon deletion.
• The "service-usage statistics" above may or may not constitute personal data, depending on whether they are linked to personal data. The Operator protects them to the same standard as personal data and does not attempt to combine statistics from demo use without signing in with other information to identify an individual. The Operator also does not use either the service-usage statistics or the account-linked usage records for any purpose other than improving the Service (such as advertising or third-party tracking).
• The "service-usage records (linked to the account)" above are processed only within the contractual purpose of providing and improving the Service. The Operator does not use these records to train AI models (separately from the restriction on training by external AI under Article 4, paragraph 3, the Operator itself also does not use them for training purposes), does not use them for advertising purposes, and does not provide them to third parties (Articles 5 and 9). Users may request suspension of processing of this item at any time (Article 7); upon such a request, account-linked collection for that account stops, the records already collected are destroyed, and usage is thereafter collected only as the "service-usage statistics" above.

Article 2 (Consent to the Collection and Use of Personal Data)

1. Pursuant to Articles 15 and 22 of the Personal Information Protection Act, the Operator obtains consent to the collection and use of personal data at the time the user signs in to (registers for) the Service.
2. When obtaining consent, the Operator clearly notifies the following four matters.
   1. The purpose of collecting and using personal data
   2. The categories of personal data collected
   3. The retention and use period of personal data
   4. The fact that the user has the right to refuse consent, and the content of the disadvantages resulting from such refusal
3. If the user refuses consent to the items essential for sign-in and use of the Service (the account information, service use content, and automatically collected information (limited to access logs, service-usage statistics, and usage and account-status records) under Article 1), the user cannot use the Service.
4. The "automatically collected information (service-usage records linked to the account)" under Article 1 is personal data processed without the data subject's consent pursuant to Article 15(1)(iv) of the Personal Information Protection Act (where necessary for the performance of a contract), and, pursuant to Article 22(3) of the same Act, its categories and legal basis are disclosed in this policy separately from personal data processed with consent. Users may request suspension of this processing at any time (Article 7).
5. Consent to receive the newsletter is an optional item. Refusing it places no restriction whatsoever on use of the Service. The subscription form on the website asks both for consent to the collection and use of personal data and for consent to receive commercial and promotional information under Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, and, as that Article requires, the Operator confirms consent to receive commercial and promotional information again every two years. Users may at any time request to unsubscribe (withdraw consent) through the unsubscribe link included in the newsletter or through the contact point in Article 11. Upon withdrawal, the email is no longer processed for the purpose of sending the newsletter, and an email received through a website subscription is destroyed without delay. Members can change this setting directly in their profile. When the Operator processes a consent, a refusal, or a withdrawal of consent, it notifies the user on screen or by email of the sender’s name, the date of processing, and the result, as required by Article 50(7) of the same Act.
6. The “API key” under Article 1 is an optional item processed to provide the feature of receiving answers with the user’s own key, where the user chooses that feature. Not registering one places no restriction on use of the Service (answers are provided by AI supplied by the Operator), and users may end this processing at any time by deleting the key in settings.

Article 3 (Age Restriction and Children's Personal Data)

Only persons aged 18 or older may register for the Service (a measure required by the age requirements in the terms and policies of the external AI providers Google, Anthropic, and OpenAI). The Operator does not collect the personal data of persons under 18, and any account confirmed to belong to a person under 18 is deleted without delay and the relevant personal data is destroyed. Under the Personal Information Protection Act, the personal data of children under 14 is never collected under any circumstances.

Article 4 (Outsourcing of Processing and Overseas Transfer of Personal Data)

1. Current Outsourcing (List of Processors)

To provide the Service, the Operator outsources part of its personal data processing tasks as follows. (Article 26(2) of the Personal Information Protection Act)

• The primary storage of user data (account information and the original conversation content) is domestic (the Seoul region, Supabase). The original conversation content is stored and kept domestically, and a signed-in user’s questions are transmitted, as described in paragraph 2 below, only at the point an AI answer is generated, to the provider of the model the user has selected: Google (United States, Gemini models), Anthropic (United States, Claude models), or OpenAI (United States, GPT models). However, if the selected provider is temporarily unable to respond, the question is transmitted to the default model, Google (Gemini models), and the synthesis feature, which weaves several conversations into a document, transmits to Google (Gemini models) regardless of the selected model. Account information such as the user’s name and email is not transmitted with them. Questions entered in the demo, which is used without signing in, are transmitted to OpenAI (United States) in the same manner; because the demo does not require sign-in, no account information is transmitted. Where a user registers their own API key and selects a “Anthropic API (your key)” or “OpenAI API (your key)” model, questions are transmitted to Anthropic (United States) or OpenAI (United States) as described in paragraph 4 below. The Service’s web traffic passes through relay servers of Cloudflare, Inc. (United States) in transit, for content delivery and security purposes. The relayed connection is encrypted, and Cloudflare is not a repository that stores the original conversation content.
• If a processor or the content of the outsourced tasks changes, this policy will be updated and notice given.

2. Current Overseas Transfers of Personal Data

Among the processors above, the details of the personal data transferred to those located overseas (the United States) are as follows. (Article 28-8 of the Personal Information Protection Act)

• This overseas transfer constitutes outsourced processing and storage necessary for the performance of the contract (providing AI answers to questions), and pursuant to Article 28-8(1)(iii) of the Personal Information Protection Act and its Enforcement Decree, it is notified by disclosure in this Privacy Policy without a separate consent procedure.
• If a user does not want the overseas transfer, the user may stop using the Service (entering questions) or delete the account. However, without the overseas transfer required to enter questions, the AI answer generation feature cannot be used.

3. Restriction on Use for Training by External AI

The Operator uses the paid tier of the Google Gemini API. Under Google’s paid-tier API policy, the content entered by users is not used to train Google’s AI models or to improve its products. (Unlike the free tier, Google has a policy of not using submitted content to improve its products on the paid tier, and the statement above is based on this Google policy.) For the OpenAI API used where a signed-in user selects a GPT model and for the demo (trial use without signing in) as well, under OpenAI’s API data policy, inputs and outputs sent through the API are not used to train OpenAI’s models. For the Anthropic API used where a signed-in user selects a Claude model, under Anthropic’s Commercial Terms, Anthropic does not train models on the inputs sent through the API or the outputs generated in response.

4. External AI Used with the User’s Own API Key (Anthropic, OpenAI)

When a user registers their own Anthropic or OpenAI API key, selects a “Anthropic API (your key)” or “OpenAI API (your key)” model, and asks a question, the Operator, at the user’s request, transmits the question, files attached to it, and the conversation context needed to generate an answer to that provider (the API of Anthropic, PBC or of OpenAI, both in the United States) using the user’s key. This processing takes place in the user’s own provider account, and the provider’s processing, retention, and any use for training are governed by the terms between the user and that provider (Anthropic’s Commercial Terms and Data Processing Addendum, OpenAI’s terms and Data Processing Addendum) and the user’s account settings. This processing with the user’s own key is not outsourcing by the Operator. Processing for signed-in use of Claude or GPT models with the Operator’s key, and for the demo, is governed not by this paragraph but by paragraphs 1 to 3.

• Country, timing, and method of transfer: United States. Transmitted over encrypted communication (HTTPS/TLS) each time the user asks a question with such a model. On the web the Operator’s server transmits it; in the desktop app the user’s device transmits it directly.
• Under Anthropic’s Commercial Terms, Anthropic does not train models on customer content sent in this way. Under OpenAI’s API data policy, data sent through the API is not used to train OpenAI’s models unless the user separately opts in to share it, and the Operator asks OpenAI not to store responses (abuse monitoring logs may be retained for up to 30 days under OpenAI’s policies). Where the model judges it necessary, it may search using that provider’s web search tool, and search charges are also billed to the user’s provider account.
• This transfer occurs only where the user registers a key and directly selects such a model. Users who do not want it may leave the key unregistered or delete it and use other models provided by the Operator.

5. Desktop app

The desktop app (Mac) stores forests (questions, answers, tree structure) and attached PDFs on the user’s device. When the user signs in to a Thinket account in the app, forests and attached PDFs are synchronized through the Operator’s server (Render, United States) to the database (Supabase, Seoul) so that the same forests can be continued on the web; this processing follows paragraphs 1 and 2. A signed-in app periodically connects to the Operator’s server to check access rights and new versions (including the app version), and sends the service-usage statistics and account-linked usage records under Article 1 to the Operator’s server.

• Where the user receives answers in the app through Claude Code or Codex CLI installed on the user’s own device, the question and the conversation context needed to generate the answer are transmitted directly from the user’s device to the provider (United States) through the user’s own Anthropic or OpenAI account. This processing is not outsourcing by the Operator and follows the terms between the provider and the user and the user’s account settings. Answers received this way are also synchronized as part of the forest as described above.
• The app’s sign-in information (token), API keys registered in the app, and the app’s connection settings are stored only on the user’s device and are not transmitted to the Operator’s servers.

Article 5 (Provision of Personal Data to Third Parties)

The Operator does not sell or provide users’ personal data to third parties. The following cases are exceptions, however.

1. Where the user has given prior consent
2. Where an investigative agency or the like requests it through lawful procedures under applicable law

Article 6 (Procedure and Method for Destroying Personal Data)

Article 7 (Rights of the Data Subject and How to Exercise Them)

1. Users may exercise the following rights at any time.

2. Where a user requests suspension of processing of the "service-usage records (linked to the account)", the Operator stops account-linked collection for that account without delay (usage is thereafter collected only as the service-usage statistics under Article 1) and destroys or anonymizes the account-linked usage records already collected so that no individual can be identified. Requesting suspension of processing places no restriction whatsoever on use of the Service (Article 37 of the Personal Information Protection Act).
3. Rights may be exercised by the user in person or by a legal representative or a duly authorized agent, and the Operator takes action without delay (within the statutory deadline) from the date the request is received and notifies the result.
4. Where a request such as for access falls under a ground for restriction under the law, the Operator notifies the reason.

Article 8 (Measures to Ensure Security and the Operator’s Access Policy)

1. The Operator takes the following measures to protect personal data.
   1. Encryption of the transmission channel (HTTPS/TLS)
   2. Minimizing database access rights to the Operator and securely managing the means of access (passwords and keys)
   3. Using the security features of the cloud infrastructure providers (access control, encryption of stored data, and so on)
   4. Promptly taking action if a serious security issue is identified and, upon becoming aware of the loss, theft, leakage, or similar of personal data (including becoming aware of the possibility of it), notifying the affected users without delay under Article 34 of the Personal Information Protection Act and, where the law so requires, reporting it to the Personal Information Protection Commission or the Korea Internet & Security Agency
   5. Encrypting API keys registered by users (AES-256-GCM), keeping the keys needed for decryption separately from the database, and not displaying keys on screens or in records (logs)
   6. Using secure authentication such as two-step verification when the Operator accesses personal data processing systems
   7. Keeping records of access to personal data processing systems for at least 1 year so that personal data breaches can be handled, and using security features to prevent those records from being forged, altered, stolen, or lost
2. The Operator’s access policy: The Operator holds the technical authority to access the database for service operation and fault response (the Service cannot be operated without such access), and users’ conversation content is stored in the database. As a matter of policy, however, the Operator does not read users’ individual conversation content. Access may nonetheless be made to the minimum extent necessary in the following cases.
   1. Where the user requests it or consents to it
   2. Where required by applicable law
   3. Where unavoidable in order to investigate and respond to a serious error, security incident, or abuse
3. Separately from the access policy above, the questions entered by users are transmitted to and processed by the provider of the model the user has selected, namely Google (United States), Anthropic (United States), or OpenAI (United States), in order to generate answers, as described in Article 4 (where the user has selected a “Anthropic API (your key)” or “OpenAI API (your key)” model with their own API key, they are processed in the user’s own Anthropic or OpenAI account). That is, even if the Operator does not look into conversations at will, conversations are stored to provide the Service and are transmitted to the external AI when answers are generated.

Article 9 (Cookies and Other Automatic Collection Devices)

The Service uses (i) cookies (or equivalent storage means) that are essential to maintaining the signed-in state, and (ii) local storage (localStorage) and transmission means (such as sendBeacon) to save usage preferences such as language and theme and to collect usage statistics for improving its own service. It also uses a cookie (30 days) to count daily use while the demo is used without signing in, and a cookie that remembers the language setting. These usage statistics are collected as the service-usage statistics under Article 1, and while signed in they are also collected as account-linked service-usage records (Article 1 and Article 2, paragraph 4). In either case this collection is carried out by the Operator directly, for the purpose of improving the quality and features of its own service; it is not provided to third-party analytics or advertising businesses, nor does it rely on third-party tracking technologies. The Service does not use cookies or tracking technologies for third-party advertising, cross-site behavioral tracking, or user profiling for advertising purposes. Users may refuse cookies in their browser settings, but in that case they cannot use features that require sign-in. The Service does not respond differently to browser “Do Not Track” signals. The Service does not, however, track users across other websites, and it does not allow third parties to collect information about users’ online activities over time and across different websites through the Service.

Article 10 (Notice on the Use of Generative AI)

1. The answers provided by the Service are outputs generated by generative artificial intelligence (AI). Pursuant to Article 31 of the Framework Act on the Development of Artificial Intelligence and the Establishment of a Basis for Trust, the Operator (i) gives advance notice that the Service is based on generative AI, and (ii) gives a standing notice on the service screen so that users can clearly recognize that the answers are outputs generated by generative AI, and, where a feature to take answers outside the Service is provided, indicates that fact on those outputs as well.
2. Questions entered by users are transmitted to an external AI only in order to generate answers. Signed-in use relies, depending on the model the user selects, on the Google Gemini API, the Anthropic API (Claude models), or the OpenAI API (GPT models), and the demo used without signing in relies on the OpenAI API. Under Google’s paid-tier API policy, the entered content is not used to train Google’s AI models or to improve its products, and the Operator uses that paid-tier API. Inputs and outputs sent to the Anthropic API and the OpenAI API are likewise not used to train each provider’s models (see Article 4, paragraph 3). Where the user registers their own API key and selects a “Anthropic API (your key)” or “OpenAI API (your key)” model, that provider’s API (Anthropic or OpenAI) is used through the user’s own account, and that processing is governed by Article 4, paragraph 4.
3. Users are advised not to enter personal data (their own or others’ names, contact details, health information, and the like) into questions.

Article 11 (Personal Data Protection Officer and Contact)

Users may direct inquiries, complaints, and requests for remedy regarding personal data to the contact above. Users may also apply for dispute mediation or counseling to the following bodies.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office: 1301 / National Police Agency: 182

Article 12 (Changes to the Privacy Policy)

When this policy changes, the changes and their effective date are announced on this page and by in-service notice. Changes that significantly affect users’ rights, such as adding categories collected or purposes of processing, extending retention periods, or a new overseas transfer, are announced within the Service from 7 days before they take effect and also by email. Changes that tidy wording, correct facts, or are not unfavorable to users may take effect on the date of posting.

Addendum

This policy takes effect on 2026-10-05. (Third revision of 2026-10-05: the access-record sentence in Article 8 paragraph 1 item 6 was split into item 7 and restated as keeping and protecting records of access to personal data processing systems in general; as a tidying of wording, it takes effect on the date of posting. Second revision of 2026-10-05: the protection officer entry in Article 11 was corrected to co-operator and the contact email changed to support@thinket.ai; as a correction of facts, it takes effect on the date of posting. First revision of 2026-10-05: corrected entries that differed from or were missing from actual processing. In Article 1, “anonymous statistics” became “service-usage statistics” and statistics collected while signed in are destroyed upon account deletion; the “usage and account-status records” item was added; the collection method of the profile photo was corrected and the display name added; the discontinued demo reply email was removed; and the handling upon suspension of processing was clarified. Anthropic and OpenAI were added to the basis of the age requirement in Article 3. Article 4 paragraph 1 now covers transmission when the selected provider cannot respond and for the synthesis feature, Resend’s outsourced tasks now include the start-of-use notice and security alerts, and Article 4 paragraph 5 (desktop app) was added. The methods of access and correction in Article 7, Article 8 paragraph 1 items 4 (possibility of a breach) and 6 (secure authentication and access records), Article 9 (cookies), and Article 12 (notice of changes) were supplemented, and the processor contacts in Article 4 paragraph 2 were changed to email addresses and the like. The previous edition is the second revision of 2026-10-02. As this revision corrects facts, it takes effect on the date of posting, and users are notified by email. Second revision of 2026-10-02: as signed-in users can now select Claude models (Anthropic) and GPT models (OpenAI) provided by the Operator, Anthropic, PBC was added to Article 4 paragraphs 1 and 2 as a processor and overseas transferee, OpenAI’s outsourced tasks were extended from the demo to cases where a signed-in user selects a GPT model, OpenAI’s entity name was corrected to OpenAI OpCo, LLC, and Article 4 paragraphs 3 and 4, Article 8 paragraph 3, and Article 10 paragraph 2 were supplemented. The previous edition is the first revision of the same day. This revision takes effect on the date of posting. First revision of 2026-10-02: Article 8 paragraph 1 item 4 now states the notification and reporting of personal data breaches under Article 34 of the Personal Information Protection Act; Article 2 paragraph 5 now covers the newsletter setting in the profile and the notice of the result of processing a consent, refusal, or withdrawal; the “Newsletter (optional)” item in Article 1 now covers destroying the website subscription upon account deletion; files attached to questions were added to Supabase’s entrusted tasks in Article 4 paragraph 1; and sentences on “Do Not Track” signals and third-party tracking were added to Article 9. The previous edition took effect on 2026-09-28. This revision takes effect on the date of posting. Revised 2026-09-28: for newsletter subscriptions on the website (no account required), the “Newsletter (optional)” item in Article 1 and Article 2 paragraph 5 were supplemented, and newsletter subscriber emails were added to Supabase’s entrusted tasks in Article 4 paragraph 1. This revision takes effect on the date of posting. Revised 2026-09-27: for the feature of receiving answers with the user’s own Anthropic or OpenAI API key, the “API key (optional)” item, Article 2 paragraph 6, Article 4 paragraph 4 (external AI used with the user’s own API key), and Article 8 paragraph 1 item 5 were added, and Article 4 paragraph 1, Article 8 paragraph 3, and Article 10 paragraph 2 were supplemented. The service notice email processor (Resend) was added to Article 4. The previous edition took effect on 2026-09-11. This revision takes effect on the date of posting, and users at the time are notified individually.)