Privacy Policy

1. Who we are

Train of Thought (trainofthought.io) is run by:

Dalpha - Media
Westergracht 1, Haarlem, the Netherlands
KvK (Chamber of Commerce) number: 80971083
Email: info@trainofthought.io

Dalpha - Media is the controller of your personal data. For any privacy question or request, email info@trainofthought.io.

2. The short version

• We collect as little as possible: an email address if you join the waitlist or create an account, and your focus-session history if you use the app.
• We never sell your data, never share it for advertising, and show no ads.
• Analytics run without cookies unless you click “Accept”. If you accept, we also record anonymised session replays in which all text and everything you type are hidden.
• You can change your cookie choice at any time via “Cookie settings” at the bottom of every page.

3. What we collect and why

3.1 Waitlist

• What: your email address, whether you’ve confirmed it, and when you signed up, confirmed and were last emailed. We don’t store your name or IP address with it.
• Why: to send you one email when the app launches, and nothing else.
• Legal basis: your consent (Art. 6(1)(a) GDPR). You confirm it by clicking the link in the confirmation email (double opt-in).
• How long: if you don’t confirm, your address is deleted after about 7 days (the confirmation link itself stops working after 48 hours). If you confirm, we keep your address until 30 days after the launch email has been sent, and then delete it. Every waitlist email has a “Remove me” link that deletes your address immediately.

3.2 Your account

• What: your email address; your password, stored only as a secure hash so we can’t read it; whether your email is verified; and when your account was created.
• Why: to let you sign in and use the app.
• Legal basis: performance of our agreement with you, i.e. the Terms of Service (Art. 6(1)(b) GDPR).
• How long: as long as you have an account. See section 6 for deletion.

3.3 Verification and password-reset codes

• What: the 6-digit codes we email you, stored only as a hash.
• Why: to verify your email address and to reset your password.
• How long: each code is valid for 15 minutes and can’t be used after that.

3.4 Sessions (staying signed in)

• What: when you sign in, we store a session record with your IP address and browser/device type (user agent).
• Why: to keep you signed in and to spot suspicious sign-ins.
• Legal basis: performance of our agreement (keeping you signed in), and our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).
• How long: a session ends when you sign out, or after 60 days without use. Ended sessions are deleted after about 7 days.

3.5 Focus sessions and journeys

• What: the focus sessions you complete: when, how long, and the route and stations of your journey.
• Why: this is the core of the app. It shows your journey, progress and history.
• Legal basis: performance of our agreement (Art. 6(1)(b) GDPR).
• How long: as long as you have an account.

3.6 Abuse protection (rate limiting)

• What: to stop brute-force sign-in attempts and waitlist spam, we briefly store your IP address together with the action you tried (for example “sign in” or “join waitlist”), a counter and a timestamp.
• Legal basis: our legitimate interest in protecting the service and our users (Art. 6(1)(f) GDPR).
• How long: about 7 days.

3.7 Emails we send

We only send emails you need: verification and password-reset codes; a notice if someone tries to sign up with an address that already has an account; the waitlist confirmation; and the one launch email. We send no newsletters or marketing.

3.8 Analytics (PostHog)

We use PostHog to understand how many people visit and which parts of the site work. PostHog runs on servers in the EU (Frankfurt, Germany). Analytics only run on the live site.

Without your consent (before you choose, or after “Decline”):

• What: anonymous page views, the page you came from (referrer) and campaign tags in the link (UTM parameters).
• What not: no cookies or other storage on your device, only a temporary random ID that disappears when you reload or leave the page; no session replays; and PostHog is configured to discard your IP address.
• Legal basis: our legitimate interest in knowing how many people visit and where they come from (Art. 6(1)(f) GDPR). You can object at any time by emailing us or by using a content or tracker blocker.

With your consent (after “Accept”):

• What: PostHog stores an identifier on your device (a cookie and localStorage) so it can recognise repeat visits. PostHog also records session replays: a reconstruction of the page layout and your mouse movements and scrolling, in which all text and everything you type is masked. We see the shape of the page, not its content.
• Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via “Cookie settings”.

For everyone:

• We don’t track clicks automatically.
• The only events we send are page views; that the waitlist form was submitted, confirmed or removed; and that you accepted or declined cookies.
• No event ever contains your email address. Email addresses and security tokens are removed from web addresses before anything is sent.
• Analytics requests go through our own domain, and no cookies are forwarded to PostHog.
• How long PostHog keeps it: events up to 12 months, session replays up to 30 days.

3.9 Server logs

Our hosting provider keeps standard web server logs (IP address, requested page, time, browser) for security and troubleshooting. Our own application error logs are kept only for a short time, for troubleshooting.

4. Cookies and similar technologies

Our fonts are hosted on our own server, so no request goes to Google or any other font service.

You can change your choice at any time via “Cookie settings” at the bottom of every page.

5. Who we share data with

We use a small number of service providers (processors). Each processes data only on our instructions and under a data processing agreement:

We don’t sell or rent personal data, and we don’t share it for advertising. We only disclose data to authorities if the law requires us to.

International transfers: your data is stored in the EU. Both providers are US companies, so limited access from outside the EU (for example for support) can’t be ruled out. Such transfers are covered by the EU Standard Contractual Clauses in their data processing agreements and, where the provider is certified, the EU–US Data Privacy Framework.

6. How long we keep data, and deleting your account

Deleting your account: email info@trainofthought.io. We then send a confirmation request to your account’s email address, and only delete once you’ve confirmed from there. After that, we delete your account, sessions and journey history within 30 days, and let you know when it’s done. Our hosting provider keeps backups for up to 6 months. Deleted data disappears from them when they are overwritten, and we never restore it for any other purpose. A delete button inside the app will follow.

7. Children

You must be at least 13 to use Train of Thought. If you’re between 13 and 15, you need permission from a parent or guardian to create an account, join the waitlist or accept analytics cookies. If we learn that a child under 13, or a 13- to 15-year-old without permission, has given us personal data, we delete it. Parents can contact us at info@trainofthought.io.

8. Security

We protect your data with encrypted connections (HTTPS), hashed passwords and codes, rate limiting, and by keeping access to the database to a minimum. No system is perfectly secure. If a breach affects your data, we will inform you and the Dutch Data Protection Authority as the law requires.

9. Your rights (GDPR)

You have the right to:

• access the personal data we hold about you and get a copy;
• have it corrected if it’s wrong;
• have it deleted;
• restrict how we use it;
• object to processing based on legitimate interest (for example the cookieless analytics);
• data portability: get your data in a machine-readable format;
• withdraw consent at any time (waitlist: “Remove me”; analytics: “Cookie settings”), without affecting what happened before.

Email info@trainofthought.io to use any of these rights. It’s free, and we answer within one month. To make sure it’s really you, we send a confirmation request to your account’s email address and act once you’ve confirmed from there.

If you’re not happy with how we handle your data, you can complain to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) or to the authority in the country where you live.

We don’t use automated decision-making or profiling that has legal or similarly significant effects on you.

10. Additional information for users in Switzerland

For users in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies alongside this policy. You have the right to:

• access your personal data;
• have incorrect data corrected;
• object to processing, which includes asking us to restrict or delete your data or to stop disclosing it;
• receive your data in a portable format.

The categories of data, purposes, recipients and retention periods are described in sections 3 to 6. Send requests to info@trainofthought.io. They’re free.

11. Additional information for users in Brazil (LGPD)

For users in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies.

Legal bases: we process your data on the bases described in section 3: your consent, the performance of a contract with you, and our legitimate interests, as long as your fundamental rights and freedoms don’t outweigh them.

Your rights:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability to another provider;
• deletion of data processed on the basis of consent;
• information about who we share data with (see section 5);
• information about the possibility to refuse consent, and the consequences of refusing;
• withdrawal of consent;
• a complaint to the ANPD (Autoridade Nacional de Proteção de Dados) or to consumer protection bodies.

Requests: send them to info@trainofthought.io. They’re free. For a complete disclosure of your data, we respond within 15 days. You will never be disadvantaged for using your rights.

Transfers outside Brazil: your data is stored in the EU. Transfers are based on the safeguards described in section 5 and on the other grounds the LGPD allows, such as the performance of a contract with you.

12. Additional information for users in the United States

This section applies to residents of US states with consumer privacy laws, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others.

Categories we collect:

• identifiers: email address, IP address and an analytics identifier (the identifier only with consent);
• internet or network activity: pages viewed, referrer, and masked session replays with consent;
• account content: your focus-session history.

Where it comes from: directly from you, and automatically from your browser, as described in section 3.

We do not sell personal information and do not share it for cross-context behavioural or targeted advertising. We don’t collect sensitive personal information, and we don’t use personal information for profiling that produces legal or similarly significant effects.

Your rights:

• know and access the personal information we hold;
• correct it;
• delete it;
• get a portable copy;
• opt out of sale, sharing or targeted advertising (we don’t do these, so there’s nothing to opt out of);
• not be discriminated against for using your rights.

Because we never sell or share personal information, a Global Privacy Control (GPC) signal from your browser is effectively always respected.

Requests: email info@trainofthought.io. We need to verify that the request comes from you, usually by sending a confirmation request to your account’s email address. We use the verification information only for that purpose. An authorised agent or a parent or guardian can make a request on your behalf. We respond within the time the law requires, and if we refuse a request we explain why.

13. Changes to this policy

When this policy changes, we publish the new version here with a new “Last updated” date. If a change is significant, we also email account holders. If we start tracking something new that needs consent, we ask for your consent again.