PRIVACY POLICY

Last updated October 8, 2026

This Privacy Notice for Dumke Ventures UG (haftungsbeschränkt) ("we," "us," or "our") describes how and why we collect, store, use and share ("process") your personal information when you use our services ("Services"), including when you:

  • Download and use our mobile application (Thirdy), or any other application of ours that links to this Privacy Notice
  • Visit our website thirdy.app or contact us by email

We are the controller responsible for your personal information. Our full legal notice (Impressum) is available at /impressum.

If you have questions or concerns, contact us at info@thirdy.app.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? The information you give us in the App (your profile, your interview answers, your check-ins and recordings), the content we generate for you, your subscription status and technical logs. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Yes. The interview asks about your life, and if your goal is about love it asks how you describe your sexuality. Your answers, check-ins and notes can also contain information about your health, body, eating, grief or abuse. Please avoid sharing anything you would not want processed by an AI service. We process what you share only to write and voice your daily chapters and related content, and to run the safety check described in Section 7. We do not collect photographs or facial images, and we do not use your voice recordings for identification. Learn more.

Do we collect any information from third parties? We receive limited information from the Apple App Store and from RevenueCat, our subscription service, for example whether your subscription is active. Learn more.

How do we process your information? We process your information to provide and administer our Services, to answer you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We share information with the service providers named in Section 4 so that they can run parts of the Services for us. Learn more about when and with whom we share your personal information.

Do we offer AI-based products? Yes. Thirdy's daily chapters, stories, affirmations, and their audio are generated with artificial intelligence from the details you share. Learn more about our AI products.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information, including the right to object and the right to lodge a complaint with a supervisory authority. Learn more about your privacy rights.

How do you exercise your rights? You can delete your account in the App at any time, or contact us at info@thirdy.app. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

TABLE OF CONTENTS

  1. WHAT INFORMATION DO WE COLLECT?
  2. HOW DO WE PROCESS YOUR INFORMATION?
  3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
  4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
  5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?
  6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
  7. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
  8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
  9. HOW LONG DO WE KEEP YOUR INFORMATION?
  10. HOW DO WE KEEP YOUR INFORMATION SAFE?
  11. WHAT ARE YOUR PRIVACY RIGHTS?
  12. CONTROLS FOR DO-NOT-TRACK FEATURES
  13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
  14. DO WE MAKE UPDATES TO THIS NOTICE?
  15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
  16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
  17. CHILDREN AND TEENAGERS

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

You use Thirdy without creating a username, email login, or password: the App creates an anonymous account identifier on your device. We collect the personal information that you provide when you use the App, contact us, or otherwise interact with the Services:

  • Profile and demographic data: the first name you choose, your age, gender (or how you describe it in your own words), where you live (as you type it, for example a city), whether you have children, your relationship status and, if your goal is about love, how you describe your sexuality.
  • Interview and program content: your goal, why it matters, the obstacle you name, your work and how it feels, how you describe yourself, your past, your dream place and home, what you want to feel more of, your daily check-ins, notes and step choices.
  • Data about other people you mention: the names and roles of people who matter to you, your partner's name and what you tell us about them, and the name and relation of a person you choose as your witness.
  • Voice recordings you choose to make (the sealed message to your day-30 self), recorded only after you grant microphone access.
  • Settings: app language, time zone and notification preferences.
  • Content we generate for you: your chapters, stories, affirmations, playbacks and their audio, and the short profile of you (traits) that the App builds from your answers. You can see this profile on the You screen, remove single items from it, or have it rewritten.
  • Safety signals: see Section 7.
  • any information you send us when you contact support.

What you share is free-form. Your interview answers, check-ins, and notes may contain personal or sensitive information. Please share only what you are comfortable having processed by us and by our AI service providers. We do not sell what you share and we do not use it for advertising.

Information about other people. If you name other people (for example your partner, people who support you, or your witness), we store their first name, their relation to you and what you write about them only to write your chapters, and we pass this to OpenAI and ElevenLabs for that purpose. We do not contact them and cannot identify them beyond what you write, so we do not inform them individually (Art. 14(5)(b) GDPR). A person you named can ask us to delete this information at info@thirdy.app.

We do not collect photographs or facial images, and we do not use your voice recordings to identify you.

Payment and subscription data. If you buy a subscription, the Apple App Store processes your payment details as an independent controller. We never see or receive your card details. Our subscription provider RevenueCat, Inc. receives your anonymous account ID, the store receipt and your purchase information, such as the product, price, start and renewal dates, trial and cancellation status, so the App knows whether your subscription is active. We store your current subscription status with your account.

Usage and Device Data. When the App talks to our backend, our service providers automatically process information such as your device type and operating system, app version, language settings, IP address, and technical logs of requests to our backend. We use this to keep the Services secure and working and to fix errors.

Information from third parties. We receive limited information from the Apple App Store and from RevenueCat, our subscription service, for example whether your subscription is active.

Emails. If you email us, we use your email address and message to answer you and delete them when the matter is closed, unless statutory retention periods apply.

You have no legal duty to give us any information. Your first name, age and your answers to the interview are needed to write your program, and without them the App cannot create it. Only share what you are comfortable sharing.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide and administer our Services, to answer you, for security and fraud prevention, and to comply with law.

We process your personal information for the following purposes:

  • To facilitate account creation and authentication and otherwise manage user accounts.
  • To deliver and facilitate delivery of services to the user, including writing and voicing your daily chapters, stories, affirmations, and playbacks from the details you provide.
  • To run the automated safety check described in Section 7.
  • To process your purchases and manage your subscriptions.
  • To answer your messages and send you administrative information about the Services.
  • To protect our Services, including for fraud prevention, security, and to maintain the safe operation of the App.
  • To keep the Services working by fixing errors found in technical logs.
  • To comply with legal obligations and to establish, exercise, or defend legal claims.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We process your personal information only when it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law.

If you are located in the EU or EEA, the General Data Protection Regulation (GDPR) requires us to explain the legal bases we rely on to process your personal information. We rely on the following legal bases:

  • Running your account and creating and voicing your program (profile, interview, chapters, stories, audio, check-ins, voice recording, reminders, settings): performance of our contract with you, Art. 6(1)(b) GDPR; for special categories of personal data, your explicit consent, Art. 9(2)(a) GDPR (see "Special categories of personal data" below).
  • Automated safety check (Section 7): your explicit consent, Art. 9(2)(a) GDPR, where it concerns health or other special category data; otherwise performance of our contract with you, Art. 6(1)(b) GDPR.
  • Purchases and subscriptions (RevenueCat, Apple): Art. 6(1)(b) GDPR.
  • Support requests: Art. 6(1)(b) GDPR, or our legitimate interest in answering you, Art. 6(1)(f) GDPR, for general enquiries.
  • Security, abuse and fraud prevention, error logs and technical logs (for example limits on how often functions can be called): our legitimate interest in running a safe, working service, Art. 6(1)(f) GDPR.
  • Website hosting and the website's server logs: our legitimate interest in a secure, working website, Art. 6(1)(f) GDPR (see Section 6).
  • Keeping records required by law: legal obligation, Art. 6(1)(c) GDPR with § 147 AO and § 257 HGB.
  • Establishing, exercising or defending legal claims: Art. 6(1)(f) GDPR.
  • Consent (Art. 6(1)(a) GDPR). Where we rely on your consent, we process your information for the purpose you agreed to. You can withdraw consent at any time with effect for the future.

Special categories of personal data (Art. 9 GDPR). Some of what you can tell Thirdy is special category data under the GDPR. Examples are how you describe your sexuality (asked only when your goal is about love) and anything about your health, body, eating, grief or abuse that you mention in your answers. Our automated safety check (Section 7) can also note that an answer touches one of these topics. The App asks for this information in the interview, and you decide what you write. By giving these answers and continuing, you explicitly consent to us processing them to write your program and to run the safety check (Art. 9(2)(a) GDPR). You can withdraw this consent at any time by deleting your account in the App or by emailing info@thirdy.app. Withdrawal does not affect processing that happened before it. Without this information we cannot use it to write your program.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information with the service providers listed below to operate the Services. We do not sell your personal information.

We share your personal information with the following recipients:

  • Google (Firebase Authentication, Cloud Firestore, Cloud Storage and Cloud Functions): sign-in with an anonymous ID, storing your account, interview, check-ins, recordings and generated content, and running the functions that create your program.
  • OpenAI (OpenAI Ireland Ltd, Dublin, with processing by OpenAI, L.L.C. in the USA): writing your chapters, stories, reflections and steps, and running the automated safety check. It receives the text needed for each piece: your interview answers, check-ins and notes, your first name and age, your app language, the place you live, whether you have children, and the names and roles of the people you mention.
  • ElevenLabs (Eleven Labs Inc., USA, and its affiliates): turning the finished text of your chapters into audio.
  • Neither OpenAI nor ElevenLabs receives your voice recording.
  • RevenueCat, Inc.: managing your subscription. It receives your anonymous account ID and your purchase information from Apple.
  • Apple: app distribution and payment.
  • Cloudflare, Inc.: hosting and protecting our website, and receiving and forwarding email sent to our thirdy.app addresses.
  • Apple (iCloud Mail): the mailbox our thirdy.app email is forwarded to.
  • Professional advisers and authorities: where required to comply with law, enforce our terms, or protect rights, property, or safety.
  • Business transfers: in connection with any merger, sale of company assets, financing, or acquisition.

Our service providers act as our processors under a data processing agreement (Art. 28 GDPR), except Apple for app distribution and payments, which acts as an independent controller.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

In Short: We are not responsible for the safety of any information that you share with third parties that we may link to or who advertise on our Services, but are not affiliated with, our Services.

The Services may link to third-party websites, online services, or mobile applications. We cannot guarantee the safety and privacy of data you provide to any third parties. Any data collected by third parties is not covered by this Privacy Notice. We are not responsible for the content or privacy and security practices and policies of any third parties. You should review the policies of such third parties and contact them directly with any questions.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: No tracking. Our website sets one strictly necessary cookie, and the App stores on your device only what it needs to work.

Website. Our website does not use analytics, advertising or conversion-tracking cookies, pixels or tags. It stores one cookie on your device, thirdy_cookie_consent, a first-party cookie that remembers your choice in our cookie notice for 12 months. It is strictly necessary for a service you request, so it does not need consent (§ 25(2) No. 2 TDDDG). Our website loads its fonts from our own server. Your browser does not connect to Google or any other font provider.

Website visits. When you visit thirdy.app, our hosting and security provider Cloudflare, Inc. processes your IP address, browser type, the page requested and the date and time of the request to deliver the page and protect it from attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We do not keep these logs ourselves; Cloudflare keeps them only for the short period it needs to deliver and protect the website.

App. The App contains no analytics, advertising or tracking tools (SDKs), does not access your advertising identifier and does not track you across other companies' apps or websites. It stores on your device only what it needs to work: a login token for your anonymous account (Firebase Authentication), your settings and your onboarding progress. RevenueCat receives your anonymous account ID and purchase receipts from the App Store to confirm your subscription. This storage is strictly necessary for the service you asked for (§ 25(2) No. 2 TDDDG).

7. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: Yes. Thirdy's chapters and audio are generated with AI, and an automated safety check reads your answers first.

Thirdy writes a personal 30-day program: daily chapters, stories, affirmations, and playbacks, delivered as text and synthesized audio. To do this, the goal, obstacles, check-ins, and other details you share are processed by us and by OpenAI (text generation) and ElevenLabs (speech synthesis) to produce content written for you alone.

Content is generated automatically, may be inaccurate or unexpected, and must not be relied upon as professional, medical, psychological, financial, or crisis advice; if you are in crisis, contact a qualified professional or your local emergency services.

Safety check. Before we write anything, an automated system (an AI model run by OpenAI on our behalf) reads your interview answers, and any note you send when a piece sounded off. It checks whether they touch on crisis or self-harm, disordered eating, abuse, grief, or a goal about your body or appearance, and which area of life your goal is about. If it finds such a sign, the App changes what it writes for you: it avoids certain topics, leaves out numbers, uses a gentler tone, and uses fixed reflections and steps instead of tailored ones. If the check cannot run, the App uses the gentler way to be safe. We store the result (which categories were detected) with your account so that later chapters stay consistent, and our server logs record it next to your account ID (see Section 9). The result is not shown in the App. This can be information about your health. No person reviews it, it does not lead to any decision with legal effect or a similarly significant effect on you, and it is not used for any other purpose. Legal basis: see Section 3. You can ask us at any time which categories are stored for you, and have them corrected or deleted, by emailing info@thirdy.app; deleting them means the App can no longer adjust for them.

Your profile in the App. From your interview, Thirdy builds a short list of what you are working on, what is in your way, the people around you and how you live. You can see this list on the You screen, remove single items, or have it rewritten. We use it only to write your program.

We do not use your content to train AI models. OpenAI and ElevenLabs process it only to provide the service to us and do not use it to train their models. OpenAI keeps data sent through its API for up to 30 days for abuse monitoring before deleting it.

8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Yes. Your account content is stored and processed in the United States.

The functions that process your answers and create your content run on Google Cloud in the United States (region us-central1). Your account data is stored in Google Cloud Firestore and Cloud Storage in the United States. The following recipients are outside the EEA, with the safeguard we rely on:

  • Google LLC (Firebase hosting, database, storage and backend functions): EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as a fallback.
  • Cloudflare, Inc. (website delivery and email forwarding): EU-U.S. Data Privacy Framework.
  • Eleven Labs Inc. (speech synthesis): EU-U.S. Data Privacy Framework.
  • OpenAI, L.L.C. (text generation and safety check): Standard Contractual Clauses.
  • RevenueCat, Inc. (subscription management): Standard Contractual Clauses.

The EU-U.S. Data Privacy Framework applies through the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). The Standard Contractual Clauses are those adopted by the European Commission (Decision (EU) 2021/914, Art. 46(2)(c) GDPR). Apple also processes purchase data as an independent controller under its own terms. You can request a copy of these safeguards at info@thirdy.app.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your account data until you delete your account or ask us to delete it.

Your account is anonymous and tied to the App on your device, not to an email address. We keep your account data (profile, interview, check-ins, generated content and voice recording) until you delete your account in the App or ask us to delete it. If you delete the App without deleting your account first, you can no longer access that data yourself and we cannot link a new install to your old account, so your data stays with us. To remove it, delete your account in the App before uninstalling, or email us at info@thirdy.app.

When you delete your account in the App (You > Delete my account), we immediately delete your profile, interview, chapters, check-ins, audio and voice recordings from our database and storage, and your anonymous account itself.

Some data is kept for longer: our server logs, which can include your account ID and the result of the safety check, for up to 30 days; the purchase records RevenueCat holds under your anonymous account ID, which deleting your account in the App does not remove; the inputs our AI providers receive, which OpenAI keeps for up to 30 days for abuse monitoring before deleting them; and records we must keep under German tax and commercial law for up to 10 years (§ 147 AO, § 257 HGB). Apple keeps its own records of purchases made through the App Store.

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. You should only access the Services within a secure environment.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your location, you have rights that allow you greater access to and control over your personal information.

If you are located in the EEA or UK, you have the following rights under applicable data protection law: the right to request access to and a copy of your personal information (Art. 15 GDPR); to request rectification (Art. 16) or erasure (Art. 17); to restrict processing (Art. 18); and to data portability (Art. 20). Where we process your information based on consent, you have the right to withdraw your consent at any time (Art. 7(3)); withdrawal does not affect the lawfulness of processing before the withdrawal.

Your right to object (Art. 21 GDPR). Where we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. To object, email info@thirdy.app.

We do not make decisions about you that are based solely on automated processing and have legal or similarly significant effects on you (Art. 22 GDPR).

Right to complain. You also have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg) (website: lda.brandenburg.de). You may also contact the supervisory authority in your country of habitual residence.

To exercise any of these rights, delete your account in the App or contact us at info@thirdy.app. Because your account is anonymous, we may need details from you that let us find your account before we can respond to a request.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") or Global Privacy Control ("GPC") setting you can activate to signal that you do not want your online activity tracked. Our website and the App do not track you and do not sell or share your personal information for advertising, so there is nothing for such a signal to switch off. We treat a GPC signal as a valid request to opt out of the sale or sharing of your personal information.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of certain US states, you may have additional rights regarding your personal information.

Depending on your state, you may have the right to know what personal information we collect, to access, correct or delete it, to opt out of its sale, of targeted advertising and of certain profiling, and to appeal if we decline your request (reply to our decision at info@thirdy.app with the subject "Appeal"). We collect the categories of personal information described in Section 1 for the purposes described in this notice. We do not sell your personal information, we do not share it for cross-context behavioral advertising, whether or not for money, and we do not use it for targeted advertising. We have no actual knowledge of selling or sharing the personal information of consumers under 16. We collect some sensitive personal information: how you describe your sexuality if your goal is about love, and health-related information you share or that our safety check notes (Section 7). We use it only to provide and adjust your program, based on the answers you choose to give, and never for advertising. We do not use your personal information for profiling or automated decisions that have legal or similarly significant effects. To exercise your rights, contact us at info@thirdy.app. We will not discriminate against you for exercising your rights.

Washington consumer health data. If you live in Washington State, the health-related information described above (health, body, eating, grief or abuse details in your answers, and the result of the safety check) can be consumer health data under the Washington My Health My Data Act. We collect it from you in the App, use it only to write your program and to run the safety check, share it only with the processors named in Section 4 (Google, OpenAI and ElevenLabs) for those purposes, and never sell it. You can confirm, access or delete it, and withdraw your consent, by deleting your account in the App or by emailing info@thirdy.app; you can appeal a refusal as described above.

14. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date on this page and will be effective as soon as it is accessible.

15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at info@thirdy.app or contact us by post at:

Dumke Ventures UG (haftungsbeschränkt)
Ebersprung 2
16321 Bernau
Germany

Managing Director (Geschäftsführer): Tom Dumke. Our full legal notice is available in our Impressum.

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. In the App you can see your profile on the You screen, remove items from it, and delete your account and its data (You > Delete my account). For anything else, email us at info@thirdy.app.

17. CHILDREN AND TEENAGERS

Thirdy is intended for people aged 16 and over. We do not knowingly collect personal information from anyone under 16. If you are a parent or guardian and believe your child under 16 has used Thirdy or given us personal information, email us at info@thirdy.app and we will delete the account and its data once we can identify it.