Privacy Policy

1. Introduction

Welcome to Thora.

Thora is owned and operated by Thora LLC, a company registered in Albany, New York, United States.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Thora mobile application (available on iOS and Android) and our website at https://www.thoraapp.com.

By using Thora, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use the app.

2. Who Can Use Thora, and Protections for Minors

Thora is intended for users 13 years of age or older. Users under 13 are not permitted to use Thora, and we do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly.

When you create an account, we ask for your age or date of birth to confirm eligibility. If you are between 13 and 17 years old, you confirm that a parent or legal guardian has reviewed this Privacy Policy and permits you to use Thora.

For users we know to be under 18, we apply additional protections:

• We do not sell their personal data, and we do not process it for targeted advertising or for advertising-related profiling. (Thora does not run advertising for any user.)
• We minimize the data we collect to what is needed to provide the app.
• We do not send marketing emails to users between 13 and 17 unless we have obtained verifiable parental or guardian consent, where required by law.
• Where a minor uses our AI features, we make clear inside the app that the AI is an automated tool and is not a human being or a therapist.

A parent or legal guardian may contact us at hello@thoraapp.com to review, correct, or delete a minor’s personal data.

3. Our Use of Artificial Intelligence

Thora uses artificial intelligence (AI). Some features, including the in-app support chat and certain personalized suggestions, are powered by AI, which means automated systems generate responses and content for you. AI responses are automated, may be incomplete or inaccurate, and are supportive and educational only. Thora is not a therapy service, and AI features do not replace professional medical or mental health care. Where a user is a minor, we make clear inside the app that the AI is automated and is not a human or a licensed professional.

To generate these responses, the messages and inputs you share with our AI are processed by OpenAI, the provider of the GPT models behind these features. OpenAI acts as our service provider under a data protection agreement and processes your inputs only to return a response to Thora. OpenAI does not use content submitted through Thora to train its models.

Your AI chat data is stored and handled as described in Section 4.2 below.

4. Information We Collect

We only collect information that is necessary for Thora to function properly.

4.1 Information You Provide

When you use Thora, you may provide:

• Email address
• Account login information
• Age group
• Responses to in-app questions and reflections
• Messages written in the AI chat
• Subscription-related information (managed by Apple or Google)

You are not required to share sensitive personal details beyond what is needed to use the app.

4.2 AI Chat Conversations

Thora includes an AI-powered support chat designed to help users regulate emotions during moments of stress related to food, body image, and emotional overwhelm.

• Conversations are stored securely so you can revisit or delete them.
• You may delete your AI chat history at any time from within the app.
• We do not sell or publish AI chat conversations.
• Conversations are not reviewed individually for profiling or diagnosis.
• Your messages may be processed by third-party AI providers solely to generate responses, as described in Section 3.

AI chat data may be used in aggregated and anonymized form to improve app performance, safety, and quality. Thora is not a therapy service, and the AI chat does not replace professional mental health care.

4.3 Automatically Collected Information

When you use the app, we may automatically collect:

• Device type and operating system
• App usage events (for example, feature interactions)
• Anonymous analytics data
• Crash and performance data

This data helps us understand how the app is used and improve stability and experience.

4.4 Categories of Data We Collect, and Our Service Providers

For transparency, and to match the privacy labels we declare in the Apple App Store and the Google Play Data Safety form, the categories of data associated with Thora are:

Contact information. Your email address. Used for account creation, essential communications (such as password recovery and service notices), and, unless you opt out, marketing communications as described in Section 12.

User content. Your reflections, check-ins, and AI chat messages. Used to provide the core features of the app.

Identifiers. Account ID, user ID, and device identifiers. Used for authentication, security, and analytics.

Usage data. Feature interactions and in-app events. Used to understand how the app is used and to improve it.

Diagnostics. Crash logs and performance data. Used to keep the app stable and reliable.

Purchase information. Your subscription status. Used to manage your paid plan.

We do not use any of this data for third-party advertising, and we do not track you across other companies’ apps or websites (as Apple defines tracking). We do not sell your personal data.

We work with the following third-party service providers, who process certain data on our behalf under data protection agreements:

Firebase (Google). We use Firebase for analytics and crash reporting. Firebase may process usage data, diagnostics and crash logs, and device identifiers to help us understand app usage and maintain stability.

RevenueCat. We use RevenueCat to manage subscriptions. RevenueCat processes your subscription status, purchase history, and associated identifiers so we can provide and manage your paid plan.

These providers act under our instructions and do not use your data for their own advertising purposes.

5. How We Use Your Information

We use your information to:

• Provide and maintain the Thora app
• Personalize your experience
• Enable AI chat and core features
• Process subscriptions (via Apple App Store or Google Play)
• Improve app functionality and safety
• Send essential service-related communications
• Send marketing communications, which you can opt out of at any time (see Section 12)
• Comply with legal obligations

We do not use your data for advertising, and we do not sell it to third parties.

6. Subscriptions & Payments

All payments and subscriptions are processed by:

• Apple App Store (iOS)
• Google Play Store (Android)

Thora does not store or have access to your credit card or payment details. Subscription management, refunds, and billing issues must be handled directly through Apple or Google.

7. Data Sharing

We may share limited data only with:

• Trusted service providers, including Firebase (analytics and crash reporting), RevenueCat (subscription management), OpenAI (AI features), and our hosting provider
• Legal authorities if required by law

All third parties are required to protect your data and use it only for necessary services. We do not sell personal data, and we do not share it for third-party advertising.

8. Data Storage & Security

We take data protection seriously and use reasonable technical and organizational safeguards to protect your information. However, no system is 100% secure, and we cannot guarantee absolute security.

9. Data Retention

We keep your personal data only as long as necessary to provide the service.

• You may delete your account at any time.
• When you delete your account, your personal data is permanently removed, except where retention is required by law.

10. Your Choices & Rights

Depending on your location, you may have the right to:

• Access the personal information associated with your account
• Correct inaccurate account information
• Delete your account and personal data
• Withdraw consent for optional communications

You can manage most of these directly inside the app or by contacting us.

11. Your U.S. State Privacy Rights

If you are a resident of California or another U.S. state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, and others), you may have the following rights, subject to certain exceptions:

• The right to know what personal information we collect and how we use it
• The right to access a copy of your personal information
• The right to correct inaccurate personal information
• The right to delete your personal information
• The right to opt out of the sale or sharing of personal information, and of targeted advertising
• The right to not be discriminated against for exercising these rights
• The right to appeal a decision we make about your request

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and similar laws.

To exercise any of these rights, contact us at hello@thoraapp.com. You may use an authorized agent to submit a request on your behalf where permitted by law. We will verify your identity before acting on your request.

12. Communications & Emails

We use your email address to send you two types of messages: essential service emails and marketing emails.

Essential service emails. These include account confirmations, subscription updates, security notices, important changes to this Privacy Policy or our Terms, and other messages necessary to provide the Services. You cannot opt out of these emails while your account remains active, as they are required for Thora to function.

Marketing emails. We may also send you promotional and educational emails, including newsletters, tips related to emotional regulation and eating behavior, product updates, special offers, surveys, and information about new features.

We do not use sensitive information from your AI chat conversations, check-ins, reflections, or other personal entries inside the app to decide what marketing emails to send you. This kind of content is used solely to provide the Services.

Legal basis. For users in the United States and other jurisdictions where opt-out regimes apply, we send marketing emails on the basis of our legitimate interest in maintaining a relationship with you as a Thora user, in line with applicable laws such as the CAN-SPAM Act. For users in the European Economic Area, the United Kingdom, and Switzerland, we rely on the “soft opt-in” exception under Article 13(2) of the ePrivacy Directive: because you provided your email when registering for Thora, we may send you marketing emails about Thora and similar wellbeing services we offer, as long as you have a clear and free way to opt out at any time.

Personalization. We may personalize the marketing emails you receive based on your in-app activity, lifecycle stage, language, country, and inferred preferences, so that the content you get is relevant to you. You can object to this personalization at any time by contacting us.

How long we keep marketing data. We keep your email preferences and communication history for as long as your account is active, and for up to 24 months after you delete your account or unsubscribe, so we can honor your unsubscribe request and meet our legal obligations.

Your choices. You can unsubscribe from marketing emails at any time, free of charge, by clicking the unsubscribe link at the bottom of any marketing email, or by emailing us at hello@thoraapp.com. Unsubscribing will not affect the lawfulness of processing carried out before, and will not stop the essential service emails described above.

Service providers. We rely on trusted third-party email providers (such as our email service platform and analytics tools) to deliver these emails on our behalf. They act under our instructions and are bound by data protection agreements. Where data is transferred outside the EEA, the UK, or Switzerland, we use Standard Contractual Clauses or other lawful transfer mechanisms.

No sale of personal data. We do not sell your personal data to third parties for their own marketing purposes.

13. Third-Party Services

Thora may include links or integrations with third-party services. We are not responsible for the privacy practices of those services. Please review their privacy policies separately.

14. International Users

Thora is operated from the United States. By using the app, you understand that your information may be processed and stored in the United States or other jurisdictions where our service providers operate.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of Thora after changes means you accept the updated policy.

16. Contact Information

If you have questions about this Privacy Policy or your data, you can contact us at:

Thora LLC Email: hello@thoraapp.com