Privacy Policy

Effective date: October 17, 2026

This Privacy Policy describes how ThoughtBox ("we," "us," or "our") handles your information when you use the ThoughtBox app at thoughts.thoughtbox.ai, or connect an AI assistant to ThoughtBox through the ThoughtBox MCP (Model Context Protocol) server at api.thoughtbox.ai.

When you use ThoughtBox through another AI client (such as Claude), that client's own privacy practices also apply. Please review your AI assistant provider's privacy policy too.

1. How ThoughtBox works

ThoughtBox is an AI assistant that works with the accounts you connect, such as Google, Microsoft, Dropbox and Box. In the ThoughtBox app you chat with the assistant directly. Through the MCP server, an AI client you choose calls ThoughtBox's tools on your behalf.

When you connect an AI client to ThoughtBox, you go through an OAuth 2.1 authorization flow in your browser. You sign in to your ThoughtBox account and explicitly grant the AI client permission to access your data. After you approve, the AI client receives an access token it uses to call ThoughtBox tools on your behalf.

ThoughtBox acts as a data provider. When your AI assistant invokes a ThoughtBox tool (for example, searching your files), ThoughtBox fetches the result from your connected accounts and returns it to the AI client. ThoughtBox does not initiate or control the AI conversation — it only responds to requests the AI client makes with your access token.

To answer you, the assistant sends the data it needs for your request to the AI model that generates the reply: in the ThoughtBox app, the AI model provider set up for your account (for example Anthropic, OpenAI or Google, directly or through AWS Bedrock); through MCP, your AI client. We send it only to answer the request you made. We do not control how a third-party AI client handles the data it receives, so please review its privacy policy separately.

2. What data ThoughtBox can access

ThoughtBox can only access the data from providers you have explicitly connected in your ThoughtBox account. Connecting the MCP server does not grant any additional access beyond what you have already authorized.

Document storage

• Google Drive: File names, folder structure, and file content (read).
• Microsoft OneDrive: File names, folder structure, and file content (read).
• Dropbox: File names, folder structure, and file content (read).
• Box: File names, folder structure, and file content (read).
• ThoughtBox storage: Files you have created or saved within ThoughtBox (read and write).

Financial data (Plaid)

If you have connected a bank account via Plaid, the MCP server can retrieve account names, account types, current balances, and transaction history for the date ranges you request. Financial data is fetched in real time from Plaid; ThoughtBox does not store transaction data beyond the duration of the request.

Plaid's privacy policy governs how Plaid handles your banking credentials and data. ThoughtBox only receives and forwards the data Plaid provides under your authorization.

Google

Connecting Google gives ThoughtBox your basic Google account information (name, email address and profile picture, which fill in your ThoughtBox profile) and read access to your Google Drive, and nothing else. Every other Google permission is asked for separately, the first time you ask the assistant to do something that needs it, and you can decline. ThoughtBox uses each one only for the action you asked for:

• Google Drive (read): to find and read the files you ask about.
• Google Drive (a folder and files you choose): to save files into a folder you pick with the Google Picker, and to update or replace files you pick or ThoughtBox created. ThoughtBox cannot change any other file this way.
• Contacts and Workspace directory (read): to look up a person's email address when you ask the assistant to email them.
• Gmail (send): to send an email you have asked for and confirmed.
• Gmail (read): to search your mail and read messages and their attachments when you ask, for example "have I received any invoices this month?" This permission lasts about an hour: ThoughtBox keeps no long-term access to your mailbox and asks again next time.
• Google Calendar (availability): to see when you are free or busy, so the assistant can suggest meeting times. ThoughtBox sees only busy times, not what your events are.
• Google Calendar (events on calendars you own): to add an event you ask for, such as a reminder or a meeting time you picked. ThoughtBox does not invite other people.
• Google Tasks: to add a task you ask for, such as "remind me next week to send the invoice."

Google API Services User Data Policy

ThoughtBox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide the features you use in ThoughtBox, as described above.
• We transfer it to others only as needed to provide those features (for example, to the AI model generating the reply you asked for), to comply with law, or as part of a merger or acquisition with your notice.
• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google user data to develop, improve or train generalized AI or machine-learning models.
• No person at ThoughtBox reads your Google user data unless you ask us to (for example in a support request), it is needed for security, such as investigating abuse, or it is required by law.

3. What ThoughtBox stores

ThoughtBox stores only what is necessary to operate securely:

• OAuth client registrations: A record of each AI client that has registered with the ThoughtBox OAuth server, including the client name, redirect URIs, and registration timestamp. These expire automatically if the OAuth flow is never completed (2-hour TTL) or after 30 days of inactivity.
• Access and refresh tokens: Hashed (SHA-256) tokens that allow the AI client to make requests. Raw tokens are never stored.
• Activity history: Which tools were called and when, associated with your account, sometimes with a short detail such as a search query or an email's recipient and subject. It is kept with your account until the account is deleted. Server logs used for debugging are deleted automatically after 30 days.
• OAuth tokens for your connected providers: Encrypted at rest. These are the same tokens your ThoughtBox account already holds — no additional copies are created for the MCP integration. One-time permissions, such as Gmail read, are kept only until they expire, within about an hour.
• Your ThoughtBox conversations: In the ThoughtBox app, your chats are saved to your account so you can come back to them. The assistant's replies may quote or summarize data it read for you, such as an email's subject or an invoice total. You can delete a conversation at any time.
• Text extracted from documents: When the assistant in the ThoughtBox app reads a document for you (a PDF or spreadsheet, for example), it keeps the extracted text so follow-up questions about the same document don't have to read it again. That text is kept with your account until the account is deleted.
• Files and notes you ask to save: Files the assistant creates in ThoughtBox storage, and notes you ask it to remember, are kept until you delete them.

Apart from the items above, ThoughtBox does not store the content it reads for you (file contents, email messages, calendar data, transaction details) beyond a single request. Through the MCP server, ThoughtBox stores only the files and notes you ask it to save.

4. What ThoughtBox does not do

• We do not sell, rent, or share your data with third parties for advertising or marketing.
• We do not use your files, email, calendar, financial data, or contacts to train AI models.
• We do not read your data proactively. Data is only fetched when you, or the AI client acting for you, ask for it.
• We do not send email, create events or create tasks unless you ask.

5. Security

• All connections use TLS (HTTPS).
• OAuth tokens are stored as SHA-256 hashes — the raw token is never written to disk.
• Provider credentials (OAuth tokens for Google, Microsoft, Dropbox, Box, Plaid) are encrypted at rest using application-level encryption before storage.
• The authorization flow uses OAuth 2.1 with PKCE, which prevents authorization code interception.
• AI clients must re-authorize if their registration expires or is revoked.

6. Revoking access

You can revoke an AI client's access at any time:

• From the Connections page in your ThoughtBox account.
• By deleting the ~/.mcp-auth folder on the machine running your AI client (this clears the locally cached access token).
• By disconnecting individual storage providers from the Connections page, which immediately removes ThoughtBox's access to that provider — and therefore the AI client's access as well.
• For Google, you can also remove ThoughtBox's access to your Google Account at any time at myaccount.google.com/permissions.

To delete your account and everything ThoughtBox holds for you, including your conversations, activity history, connections and their tokens, and files in ThoughtBox storage, email support@thoughtbox.ai. We complete deletion within 30 days.

7. Children's privacy

This service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children.

8. Changes to this policy

We may update this policy as the service evolves. Material changes will be noted with a revised effective date at the top of this page. Continued use of ThoughtBox after changes take effect constitutes acceptance of the updated policy.

9. Contact

Questions about this policy or your data? Email us at support@thoughtbox.ai.