Privacy

Your ideas are your business

Last updated 22 September 2026.

This page says what First Thought keeps, where it keeps it, and what never leaves your device. It is written to be read, not skimmed past; the same four places are named, in the same words, under Settings › Your data.

Who runs First Thought

First Thought is made and operated by CraftCore Works LLC, a Georgia limited liability company. That company is answerable for everything described on this page.

What First Thought keeps

• Your library. The ideas and thoughts you write, the links between them, checklists, briefs, and the filing decisions you make.
• Your account. An email address, held by Supabase, the account service the app uses. There is no password: signing in is a six-digit code sent to that address, and the code is used once and kept nowhere.
• Device settings. How ideas are displayed, whether the welcome card is shown, and similar preferences. These stay on the device and are never part of what syncs.

Where it lives

• This phone. A complete copy of your library, so the app works with the radio off.
• The cloud copy. When you are signed in, everything that is not marked Local only is kept in your account's cloud copy, held by Supabase, so your other devices can catch up. It is your copy: signing out everywhere and deleting the cloud copy are both under Settings › Your data.
• Local only. Anything you mark Local only stays on the device it was written on. It is never synced, never backed up to the cloud, and never sent to any AI service. A backup file you take yourself is the only other copy there can be.
• A computer, if you use one. Opening First Thought in a browser on a computer shows the same library, from the same cloud copy, under the same account. Anything marked Local only is not there: it stays on the device it was written on.

The sorter

The sorter is off until you turn it on — the app asks once, and Settings › Your data changes it. When it is on, and you are signed in and online, each new capture is sent once to an AI service, which answers whether it is an idea, a thought or a to-do, which of your ideas it belongs to, which shelf it goes on, what to call it, and whether it holds several separate things. So that it can tell which idea a thought belongs to, the service receives the words of that capture together with the names, shelves and one-line descriptions of your ideas (the hundred you have touched most recently). It does not receive your thoughts, checklists or briefs, your name, your email, or anything marked Local only. The receipt says when the sorter decided, and you can move or undo anything it filed with one tap. With the radio off, when the day's allowance is used up, or for a capture marked Local only, the same sorting is worked out on the phone alone, from your own words.

What never happens on the phone

• No AI service reads your thoughts. Search, connections and every other offer the app makes are worked out on the phone; what leaves it is only what the sorter reads, described above, and only if you turned it on.
• No analytics, no advertising, no tracking of what you do, and no third party receives your library.
• Nothing is sent anywhere until you sign in, and Local only material is never sent at all.

On a computer

First Thought on a computer is the same app, opened in a browser. It signs in to the same account, reads the same cloud copy, and follows every rule on this page. There is nothing extra to install and nothing different to agree to.

Who else touches it

The companies behind First Thought are named here, and only here. Each one receives only what is said beside its name, and each is bound by its own terms.

• Supabase holds your account and your cloud copy. It receives your email address, and the library material that is not marked Local only.
• Cloudflare serves the app itself. It receives the ordinary record of a web request — the address your device connects from, and which files it asked for. It never receives your library.
• OpenAI runs the sorter. It receives the words of each capture the sorter reads and the names, shelves and descriptions of your ideas described above, and nothing else. It never learns who you are: requests carry a one-way code in place of your account, never your email. It does not use what it receives to train its models, and may hold a request for up to thirty days to detect misuse before deleting it.
• Google, only if you choose Continue with Google. It learns that you signed in to First Thought with your Google account, and hands the app the email address on that account. It never receives your library, and the app never receives your Google password.
• Apple, only if you choose Continue with Apple. It learns that you signed in to First Thought with your Apple ID, and hands the app the email address on that account — or, if you chose Hide My Email, a relay address that Apple forwards to you. It never receives your library, and the app never receives your Apple password.

How long it is kept

Your cloud copy is kept for as long as your account exists. Nothing is deleted because time has passed, and nothing is held back after you delete it. Deleting the cloud copy removes your library from Supabase; deleting your account removes the account along with it. Neither one reaches the copy on your own device, which stays yours until you remove the app or delete it yourself.

Your controls

Settings › Your data on the phone lets you take a backup file, read one back, sign out on this phone or everywhere, and delete the cloud copy of your library. Deleting the cloud copy removes it from the account service; a computer that holds its own copy keeps it and asks you whether to keep it.

Deleting your account

First Thought is made by CraftCore Works LLC. You can delete your account and everything in its cloud copy yourself, from inside the app, without asking anyone.

1. Open Settings › Your data.
2. Choose Delete account.
3. Confirm when asked. A code is emailed to your address to prove the request is yours.

If you cannot reach the app, write to [email protected] from the address the account uses and we will delete it for you.

What deletion removes. Your account and everything belonging to it — every idea, thought, link, checklist, brief and sync record — are removed from the account service in a single step, and the app reads the tables back afterwards to confirm nothing is left. Your sign-in is removed with them, so no device can sign in again. Nothing is kept back.

What it does not reach. The copy on your own device is yours, not ours: it stays until you remove the app or delete it yourself. A backup file you have taken is likewise yours alone. Anything you marked Local only was never in the cloud, so there is nothing there to delete.

One honest detail about backups. The account service takes a daily backup of its database and keeps each one for seven days. A backup made before you deleted your account still contains what it contained at the time, and ages out on its own within a week. Those backups exist only to restore the service after a failure; nothing is read out of them for any other purpose.

Questions

If anything here is unclear, or you want your account and its cloud copy removed, write to [email protected]. A person reads it.