Who this policy covers.
Thumbs is published by MIP, Inc. This policy covers the Thumbs app, thumbshq.com, and the services we operate to connect and provision computers. For questions or requests, contact support@thumbshq.com.
Thumbs lets you direct AI agents on a computer you connect. That can be your own Mac or Linux computer, a computer managed by your organization, or a cloud computer we provision. Your chosen AI providers and the administrator of a computer also have responsibilities for the information they handle. This policy does not replace their policies.
What Thumbs handles, and why.
- Work you send and create
- Messages, task instructions, replies, project files, code, images, videos, audio, documents, previews, and agent results. We handle this content to run your tasks, show progress, let you review results, and support the sharing or transfers you request. Files can contain personal information you include in them.
- Connections and account information
- Computer addresses and identifiers, pairing and device credentials, provider sign-in information, connected account details (including provider account identifiers, email, plan status, usage allowances, and available API balances or costs), and the permissions needed to work with your services. The app stores native pairing credentials using the operating system’s secure storage; the web client uses browser storage. Agent credentials are stored on the paired computer.
- Notifications and device information
- Device identifiers, push tokens, app and operating-system versions, and notification routing information. These let us connect the right device, send task updates, and diagnose compatibility problems. Notifications can include task or project context visible on your lock screen.
- Diagnostics and product use
- Crash reports, error text and stack traces, launch and screen timings, performance measurements, feature interactions, and installation identifiers. These help us find failures and improve reliability. Diagnostics are not necessarily anonymous; error text can incidentally contain information from your work. Optional network tracing is off by default.
- Invitations and support
- Invite redemption and computer mappings, and information you choose to send when asking for help, such as your email, device details, screenshots, and a description of a problem. We use them to provide access, operate the service, respond to requests, and prevent misuse.
- Website and infrastructure requests
- Network addresses, browser and device information, request logs, and performance data processed by our hosting and delivery providers. These are used to deliver the website, protect services, and understand reliability.
Camera and photo-library access are used for actions you choose, such as scanning a pairing code or attaching media. The app does not require continuous access to your camera or photo library. Operating-system permissions can be changed in your device settings.
If paid hosting checkout is enabled, our payment provider processes payment details and we may retain checkout email, transaction identifiers, and the invitation or computer associated with that transaction. Card details are entered with the payment provider rather than stored by Thumbs.
What an AI provider receives.
When you ask an agent to work, your instructions and the project content it needs can be sent to the AI provider you select. Agents may read files, use connected services, or run commands within the access you grant. A team of agents can involve more than one provider.
Claude Code uses Anthropic services. Codex uses OpenAI services. OpenCode uses the model provider you configure, which may include a service such as OpenRouter. Generating an avatar uses Google Cloud Vertex AI (Gemini); the paired computer sends the avatar name and optional description to Google for that request. Signing in to a provider is separate from connecting a computer to Thumbs.
Those services process information under their own terms, privacy policies, account settings, and retention practices. Review those settings before using personal or confidential content. Thumbs does not promise that every provider handles information in the same way.
How long information stays.
Retention depends on where the information is stored and what it is needed for. Projects, transcripts, results, and account credentials can remain on a computer until they are deleted there. A self-hosted computer’s administrator controls its storage and backups.
Some app and computer stores have size limits or pruning rules. Protected results can be retained longer. These limits do not establish one deletion period for all projects, diagnostics, invitation records, logs, or backups.
For services we manage, information is retained while needed to provide the service, resolve support and security issues, comply with applicable obligations, or maintain necessary operational records. Backups and infrastructure logs may not be removed at the same time as active data. Contact us about the specific information you want removed; we will explain the scope of the request and any information that must be retained.
Access, change, or delete your information.
You can manage device permissions and notifications, choose which files to attach, and choose the computer and AI services used for your tasks. You can revoke a paired device or connected-service authorization using the available account and device controls.
Withdrawing AI-sharing permission stops new AI requests from that app installation. It does not stop tasks already running or remove content a provider has already received. Stop active work separately if needed.
Removing a computer from the app or uninstalling Thumbs does not by itself delete that computer or its contents. To delete information on a self-hosted computer, use its controls or contact its administrator. For a computer or records we manage, send an access, correction, export, or deletion request to support@thumbshq.com. Include the computer’s name and a way to contact you. Do not send passwords or access tokens.
We may need to verify that you control the relevant computer or information before acting. Deleting a cloud computer can permanently remove its projects, files, results, and stored credentials. Disconnecting a provider from Thumbs does not close your account with that provider.
Depending on your location, applicable law may provide additional rights, including the right to object to certain processing or contact a privacy regulator.
Protecting connections and credentials.
Thumbs uses authenticated connections and HTTPS/TLS where supported. Native pairing credentials use secure device storage. A relay can terminate TLS and process traffic; ordinary relay traffic is not end-to-end encrypted. Computer-to-computer handoffs use a separate encrypted transfer mechanism.
No security measure can prevent every incident. The services, tools, and accounts you connect have their own security boundaries. Keep your devices and computers protected, review the access you grant agents, and contact us if you suspect unauthorized access.
A service for adults.
Thumbs is intended for adults and is not directed to children under 18. If you believe a child has provided personal information to a service we operate, contact us so we can investigate and address it.
A person to talk to.
For privacy questions and requests, contact Thumbs at support@thumbshq.com. For help using the app, visit Thumbs support.
We may update this policy as the product or our practices change. The date at the top identifies the current version. Material changes will be communicated through an appropriate service notice.
Contact us