Privacy

Last updated: 11 November 2026

Effective Date

The Thingway Privacy policy, is effective as of 01 September 2026

This policy is provided in plain English where possible, and is relatively short because Thingway collects very little. The only data we collect is necessary for the features of our software and website to run properly. That is a design decision, not an oversight.

Who is responsible

The data controller is Matthew J Glen, based in the United Kingdom. You can reach us at about anything on this page.

The Thingway App

Thingway stores your documents offline as accessible files, in a folder you choose on your own device. We have no access to them, no copy of them, and no ability to read them.

If your device supports cloud sync, and you choose to use sync, it runs through your own cloud storage (Google Drive, iCloud, Dropbox and the like) or your local network. There is no Thingway server in between. We cannot see if you use sync, what you sync, when you sync, or how much of it there is.

Buying a perpetual desktop licence

When Thingway goes on sale directly from us, payments will be handled by a third-party payment provider acting as merchant of record. We never see or store your card details. They are handled entirely by the payment provider.

What we will receive and keep is:

• your email address
• an order reference
• the licence key issued to you, and which version it unlocks
• the date of purchase

We keep this for as long as the licence is valid. For a perpetual desktop licence that means indefinitely, so that we can reissue your key if you lose it or reinstall years later. Our lawful basis is performance of a contract with you.

Buying via In-app purchases on mobile

Purchases made inside the mobile app are processed by Apple or Google, and by RevenueCat, who manage subscription state on our behalf. RevenueCat receives a device identifier, general location (country) and purchase history so the app knows what you are entitled to. It does not receive your writing, nor any other data from your device.

The Thingway Website

This site is hosted through "Cloudflare Pages" by the third party "Cloudflare" which acts as a content delivery network and security provider. It sets and uses no cookies of any kind, including no advertising and no tracking cookies, and we do not run analytics on it.

The Data collected by Cloudflare: When you access our website, Cloudflare automatically processes the following information to deliver content, protect the site from malicious traffic, and improve performance:

• Your IP address
• Your browser type and device information (User-Agent)
• Details of your request, including the URL/path requested, query parameters, HTTP method, and referring page
• Your approximate geographic location (country), derived from your IP address
• The date and time of your visit
• Response status and data transfer size

Purpose and legal basis: This processing is necessary to provide the service you requested — delivering the website securely and protecting it from abuse.

Data transfers: Cloudflare may process this data in data centers outside your country of residence, including in the United States. Cloudflare relies on Standard Contractual Clauses and applicable Data Privacy Framework certifications for such transfers.

For more information, see Cloudflare's Privacy Policy and Cloudflare Cookies page.

Bot protection on the signup form

The waitlist form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than an automated script. It runs invisibly, so there is nothing for you to click.

To do this, Turnstile collects some information about your browser and your interaction with the page. It is used only to tell humans from bots, and Cloudflare states that it is not used to build an advertising profile of you. Cloudflare's handling of that data is covered by the Cloudflare Turnstile Privacy Addendum.

We chose Turnstile specifically because it does not track people across the web the way a conventional CAPTCHA does.

The waitlist

If you enter your email address on this site, we store it with our email-list provider Buttondown, so we can tell you when Thingway launches, and send occasional updates and founders launch goodies.

• What we collect: your email address, and the date you signed up.
• Why: to send you the emails you asked for. Our lawful basis is your consent.
• How long: until you unsubscribe or ask us to delete it.
• Processor: Buttondown, who store the list on our behalf. Their handling of it is covered by the Buttondown privacy policy.

Every email we send includes an unsubscribe link. One click and you are off the list for good.

What we do not do

• We do not sell or rent your data. Not ever.
• We do not run advertising, and there are no ad networks in the app.
• We do not track your behaviour inside the app.
• We do not read, scan, or train anything on your writing.

Your rights

Under UK GDPR you can ask us to show you what little we hold about you, correct it, delete it, or stop using it. As this will be minimal and exclusively related to purchases, deletion of this data will remove access to your Thingway Premium and void your licence. Email and we will deal with it within one month.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can fix it.

Changes

If this policy changes in a way that matters, we will say so on this page and, where the change is significant, email people on the list.

* Thingway is free to download and use on mobile. Some features (custom themes, translation, and the built-in thesaurus and dictionary) are part of Premium, a monthly or annual subscription. The desktop app is a one-time paid licence. Exporting your work is free on every platform, always.