Privacy

Thousandfold provides fully managed droids: software workers that are set up and run for you. This policy covers thousandfold.io, the customer portal at app.thousandfold.io, the Thousandfold desktop and mobile apps, and the droids we operate on your behalf.

If you want to reach a person about anything on this page, write to [email protected].

Account information

Your name, email address and the password you set for the portal, stored hashed. Which droids you are allowed to see and operate. A record of significant actions you take in the portal, including when you connect or disconnect an account, who did it and when.

Desktop and mobile apps

We store your profile, workspace membership, messages, shared files, notes, tasks and other content you send so you and the people you share it with can use them across devices. Your device also keeps a local copy of some content and the credentials used to access your workspace.

Content shared with a droid can be sent to its configured AI provider to carry out your request. A droid may also receive content in a shared channel it has access to. The providers we use are listed below. Private workspaces and messages are access-controlled; they are not a promise of end-to-end encryption.

Camera, photo and microphone access is used for the features you choose, such as scanning a pairing code, sharing a photo or joining a call. When transcription is enabled, call audio is processed to produce the transcript. Device tokens and notification payloads are used to deliver messages and incoming-call alerts. You can change device permissions and notification settings in iOS Settings.

Connected accounts

When you connect an account such as Outlook or Google, we store the address of the account, its display name, the stable identifier the provider gives it, the permissions you granted, and a credential that lets your droid keep reading that account without asking you to sign in again.

We never see or store your password for those accounts. Sign-in happens on Microsoft's or Google's own pages, and they hand us a credential instead of your password.

You can connect Gmail through a short-lived invitation even if you use your droid only through Telegram. The invitation identifies the mailbox to connect and asks for permission to read and send email. Your browser returns consent directly; you do not send passwords or sign-in codes in a conversation. Pending consent results expire after 15 minutes and are removed automatically. The credential used by your droid is encrypted in its isolated storage.

What your droid reads

Only what the permissions you picked allow, and only from the accounts you connected. If you grant mail and calendar reading, your droid can read the mail and calendar of that account. That content is used to do the work you asked for, such as preparing your daily brief.

Your droid holds this content while it is working and in its own private working memory so it can do useful work over time. It stays inside your droid's isolated storage.

Operational data

Logs, error reports and usage counts that tell us whether the platform is working. We keep these free of message content and credentials by design.

When you connect an account you choose what your droid may do. We want to be precise about which part of that choice is enforced by the provider and which part is enforced by us, because they are not the same and the difference matters.

Layer	What enforces it
The access level you pick, such as read only versus permission to send	Microsoft or Google. A credential issued for reading cannot be used to send, no matter what our software does.
The individual permissions you tick inside a level	Our software. We do not give your droid the ability to perform an action you did not tick.

On Microsoft specifically, a credential can carry every permission your organization has ever approved for an application, not only the narrower set you picked. Where that happens, your portal shows you both: what you allowed, and what Microsoft actually granted. We would rather show you an uncomfortable difference than hide it.

You can change permissions or disconnect at any time from the Connections section of your portal. You can also revoke our access directly at myaccount.microsoft.com or myaccount.google.com. Disconnecting in your portal stops your droid immediately and deletes its stored credential, but it does not by itself revoke the grant on the provider's side, which is why we point you at both.

Thousandfold's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data we receive from Google APIs is used only to provide or improve the features you connected it for, is not used for advertising, is not sold, is not transferred to others except as required to provide the service, to comply with law, or as part of a merger or acquisition with your notice, and is not read by humans except with your explicit permission, to resolve a support issue you raised, for security purposes, or where required by law.

We do not use your Google data, or any of your content, to train AI models.

We do not sell your data and we do not share it for advertising. We use a small number of providers to run the service:

Provider	What they handle
Anthropic, OpenAI, Google	The AI models your droid uses to do its work. Content your droid is working with passes through the model provider configured for your droid. These providers do not train on data sent through their business APIs.
Microsoft, Google	The source of any mailbox or calendar you connect.
Apple	Push delivery to Apple devices, including device tokens and notification payloads.
Cloudflare	Network delivery and protection for our sites.
Amazon Web Services	Encrypted off site storage of backups.

We may also disclose information where we are legally required to, or to protect someone's safety. If we are ever compelled to hand over your data and we are permitted to tell you, we will.

• Each customer's droid runs isolated from every other customer's droid, with its own storage and its own network policy.
• Credentials for connected accounts are stored with restrictive permissions on your droid's own storage, not in a shared pool.
• Credentials that reach our source control are encrypted so that only the running cluster can decrypt them.
• Traffic to our sites and to providers is encrypted in transit.
• Backups are encrypted, and copied to separate off site storage.

No system is perfect, and we would rather say that plainly than imply otherwise. If you believe an account has been compromised, disconnect it in your portal and write to [email protected].

Removing a workspace from the app disconnects that device; it does not delete your workspace or the content held by its server. Contact us to request deletion of your account or data. Shared content and backups may need separate handling, as described below.

When you disconnect a connected account through Thousandfold, access is removed from your droid and its stored credential is deleted. Revoking access directly through Google or Microsoft invalidates the credential at the provider; contact us to remove the stored connection from your droid as well.

Content your droid already worked with, and its working memory, are removed when your droid is retired, or sooner on request.

Backups are the honest exception. We keep encrypted backups on a rolling schedule of seven daily, four weekly and six monthly copies, so a deletion can persist in backups for up to about six months before it ages out. We also keep a separate off site copy for disaster recovery that is not on that rolling schedule. If you need a hard guarantee that every copy is gone by a given date, ask us, and we will tell you exactly what we can and cannot commit to for your situation rather than promise something the system does not do.

• See it. Ask for a copy of what we hold about you.
• Correct it. Tell us what is wrong and we will fix it.
• Delete it. Ask us to remove your data, subject to the backup reality above and anything we are legally required to keep.
• Disconnect. Remove a connected account yourself at any time, without asking us.
• Object. Tell us to stop a particular use of your data.

Write to [email protected] and we will respond within 30 days. Depending on where you live you may also have the right to complain to a data protection authority.

Thousandfold is sold to businesses and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe we have, write to us and we will delete it.

If we change something that matters, we will update the effective date above and tell the people it affects. We will not quietly broaden what we do with your data and leave you to notice.