Thaw Privacy Policy
Effective November 1, 2026. Contact: support@thaw.ink.
Thaw is an iPad notebook with an iPhone camera companion and a Mac app. This policy covers all three. Thaw has no ads, no analytics service and no tracking, and it doesn't sell your data.
What stays on your devices and in your iCloud
Your notebooks, ink, board photos, recordings and transcripts are stored on your devices. To move them between your devices, Thaw uses your private iCloud database. Thaw's developer can't read that data. Apple's privacy policy covers iCloud.
Recordings are transcribed on your device, and audio is never sent to Thaw's server or to Anthropic.
If you pair your iPhone with your iPad, photos and recordings can also go directly between the two over Wi-Fi, without the internet, encrypted with a key only those two devices hold. They don't pass through any server. Thaw asks for Local Network access for this.
What leaves your device when you use Claude
Thaw's AI features use Claude, made by Anthropic. Nothing is sent until you agree on the consent screen, and each item is sent only when you ask for it:
- board photos you convert
- a page and its board photos, when you check the page
- a block and your pencil marks over it, when you ask Thaw to read them
- a lecture's transcript and board text, when you write up lecture notes
- the notes you choose and your questions, in chat on the Mac
Photos can include anything in frame, so avoid people and anything private.
With Thaw's server
Without an API key of your own, these items go through Thaw's server, which runs on Cloudflare, to Anthropic.
What you send is deleted from the server when the job ends. The result is deleted once it reaches your device, or after 7 days if it never does.
Anthropic processes this data to produce the answer, under its commercial terms and privacy policy. It doesn't train its models on this data. It deletes it within 30 days, except that it can keep what its automated systems flag as a Usage Policy violation for up to 2 years, and what the law requires.
Claude is an AI, not a person. Its answers can be wrong, incomplete or out of date, so check anything that matters against the board or your own notes.
With your own API key
If you add your own Anthropic API key, the app sends these items straight to Anthropic under your own agreement with them, and Thaw's server isn't involved. The key is kept in your device's Keychain.
What Thaw's server keeps
The server needs a few records to run the service, limit abuse and honor subscriptions. None of them holds your name, email address or notes.
| Data | Why | How long |
|---|---|---|
| A random account ID, kept in your iCloud Keychain | To tie credits and a subscription to you across your devices | Until you delete your server data |
| Device keys and push tokens | To check requests come from a real copy of Thaw, and to tell your device a result is ready | Until you delete your server data |
| Subscription and App Store transaction details | To apply Thaw Pro | Until you delete your server data |
| Job records: the kind of job, its date, state and credits used | To count your monthly credits | Until you delete your server data |
| The date and version of your consent | To show you agreed | Until you delete your server data |
| A keyed hash of your network (the /24 or /64 part of your IP address) | To limit how many free allowances one network can take in a day. It can't be reversed without our secret key and isn't stored with your account | Deleted the next day |
| Records of each job's run: its job ID, kind and timing, with no account ID | To run jobs | Kept by Cloudflare for 30 days |
| Service logs with account and job IDs, on failures | To find and fix faults | Kept by Cloudflare for 7 days |
Apple's DeviceCheck stores one bit per device, which marks that the device has given out its free allowance. This bit survives a reinstall, holds no personal data, and can't be read by anyone outside Thaw's developer team.
Apple handles payment for subscriptions. Thaw never sees your payment details.
Who receives data
- Anthropic runs Claude.
- Cloudflare hosts Thaw's server, and sees the IP address of each request as any host does.
- Apple provides iCloud, push notifications, App Attest, DeviceCheck and purchases.
Thaw doesn't share data with anyone else, unless the law requires it.
Your choices
- Decline the consent screen and nothing goes to Anthropic through Thaw's server. The AI features then need your own API key.
- Delete a notebook to remove it from your devices and your iCloud.
- Turn off iCloud for Thaw in your device's Apple Account settings to stop syncing.
- Delete your server data in Thaw: on iPad, Settings › Server Data › Delete Server Data, and on Mac, Thaw › Settings › Delete Server Data.
Deleting server data erases your account ID, device keys, push tokens, subscription records, job records and consent from Thaw's server, along with any work and results waiting there, and stops work in progress. It can't be undone. Your notebooks aren't on the server and aren't affected. A new account starts the next time Thaw contacts the server.
Deleting doesn't cancel a Thaw Pro subscription, because Apple handles those. Apple keeps charging until you cancel in your Apple Account's subscriptions, and the subscription doesn't carry over to a new account, so cancel it first if you don't want to keep paying. Thaw warns you before deleting.
A few things can't be erased at once or at all:
- Apple's DeviceCheck bit stays set with no expiry, so the device won't get free credits again, even with a new account.
- The server keeps one marker with no data in it, under a one-way hash of the account ID, so that ID can't be used again.
- On a Mac, the transaction ID of your App Store download stays on the server with no link to the account, to limit how many accounts one download can start.
- Cloudflare's records of job runs last up to 30 days and its service logs up to 7 days, as in the table above.
- A file arriving at the moment you delete is removed within 2 days.
- The network hash is deleted the next day, as above.
- Anthropic and Apple keep what they hold under their own terms.
Children
Thaw is for people 13 and older. It isn't directed at children under 13, and doesn't knowingly collect their data. If you think a child under 13 has used Thaw's server, write to support@thaw.ink and we'll delete the records.
Changes
If this policy changes in a way that affects what is sent, Thaw asks for your agreement again before sending anything.