Last updated: 31 August 2026
Thingway is made by one person in Glasgow. This policy is short because Thingway collects very little — that is a design decision, not an oversight.
The short version. Your writing stays on your device and in whatever cloud folder you choose. It never passes through a server of ours, because we do not run one. If you join the waitlist we hold your email address. If you buy a licence we hold your email address and an order reference. That is all.
The data controller is [YOUR LEGAL NAME OR COMPANY], based in Scotland, United Kingdom. You can reach us at [YOUR EMAIL] about anything on this page.
Thingway stores your documents as files, in a folder you choose on your own device. We have no access to them, no copy of them, and no ability to read them.
If you use sync, it runs through your own cloud storage or local network. There is no Thingway server in between. We cannot see what you sync, when you sync, or how much of it there is.
If you enter your email address on this site, we store it with our email provider so we can tell you when Thingway launches, and send occasional updates.
Every email we send includes an unsubscribe link. One click and you are off the list for good.
When Thingway goes on sale, payments will be handled by a third-party payment provider acting as merchant of record. We never see or store your card details. They are handled entirely by the payment provider.
What we receive and keep is:
We keep this for as long as the licence is valid — which, for a perpetual desktop licence, means indefinitely, so that we can reissue your key if you lose it or reinstall years later. Our lawful basis is performance of a contract with you.
Purchases made inside the mobile app are processed by Apple or Google, and by RevenueCat, who manage subscription state on our behalf. RevenueCat receives a device identifier and purchase history so the app knows what you are entitled to. It does not receive your writing.
This site is hosted on Cloudflare Pages. It sets no advertising or tracking cookies, and we do not run analytics on it. Cloudflare processes standard server request data (such as IP address) as part of delivering and protecting the site.
The waitlist form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than an automated script. It runs invisibly — there is nothing for you to click.
To do this, Turnstile collects some information about your browser and your interaction with the page. It is used only to tell humans from bots, and Cloudflare states that it is not used to build an advertising profile of you. Cloudflare's handling of that data is covered by the Cloudflare Turnstile Privacy Addendum.
We chose Turnstile specifically because it does not track people across the web the way a conventional CAPTCHA does.
Under UK GDPR you can ask us to show you what we hold about you, correct it, delete it, or stop using it. Email [YOUR EMAIL] and we will deal with it within one month.
If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can fix it.
If this policy changes in a way that matters, we will say so on this page and, where the change is significant, email people on the list.