Privacy policy
Version 2026-10-09. The data controller is Adi Carlisle, a sole trader trading as BigThought, Flat 8 Kings Court, Bennington Drive, Borehamwood, WD6 4UD, United Kingdom. Contact: adi.carlisle@ghostcompany.co.uk.
What we collect and why
| Data | Why | Kept |
|---|---|---|
| Email address, password (stored only as a scrypt hash), two-factor secret (encrypted) | Your account and signing in (contract) | Until you delete your account |
| LLM API keys you save in Settings (encrypted with AES-256-GCM) | Forwarding your requests (contract) | Until you remove them or delete your account |
| IP address and time of sign-up and of your latest sign-in, and when you last used your proxy | Security, abuse prevention and handling payment disputes (legitimate interests) | Until you delete your account |
| Number of scored thoughts per month, plan and subscription status | Plan limits and billing (contract) | Until you delete your account; billing records as the law requires |
| Your prompts, the model's answers and thinking | Forwarding to your LLM and scoring the thinking (contract) | Passed through; thinking is held in memory only (your last 40 calls) for your dashboard and is never written to disk |
| Which dashboard design you saw and basic clicks on it | Improving the product (legitimate interests) | Up to 12 months |
Who we share it with
- Your chosen LLM provider receives your requests, as you instruct.
- TypeSafe (the Jev scoring model) receives each sentence of the model's thinking to score it. If you use your own Jev key, this is under your own TypeSafe account.
- Stripe processes payments; we never see your full card number.
- Amazon Web Services hosts the service in Stockholm (eu-north-1) and sends our account emails.
- Cloudflare runs the "I am human" check on sign-up, if enabled.
Some of these providers may process data outside the UK; where they do, they rely on UK-approved safeguards such as the International Data Transfer Addendum or adequacy regulations. We don't sell your data or use it for advertising.
Cookies
We use one cookie to keep you signed in and one to remember a dashboard design you chose. Both are strictly necessary for the service, so we don't ask for cookie consent. We use no tracking or advertising cookies.
Your rights
You can ask for a copy of your data, to correct it, to delete it, to restrict or object to processing, or to move it. You can delete your account yourself in Settings. Email adi.carlisle@ghostcompany.co.uk for anything else; we reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).
Self-hosting
If you run BigThought yourself with Docker, none of your data comes to us.