Last updated: 2026-10-01T00:00:00.000Z
Privacy Policy
Draft pending legal review. Prepared in-house against the Singapore Personal Data Protection Act (PDPA) and reviewed by AI on 2026-08-26. That is not a substitute for a Singapore-qualified lawyer, and checkout does not open until this review is complete. Not legal advice.
Live purchases and Sandbox test orders are separate. Billing records link the requested plan and quantities to your account and selected workspace; signed payment events are used to apply renewals, cancellation and completed refunds. Sandbox checkout is a test environment and does not grant paid Live access.
This policy explains how JOYFULAI TECHNOLOGY PTE. LTD. (UEN 202347972H) handles personal data. It is written to meet the obligations of the Singapore Personal Data Protection Act 2012.
The short version
Thorp stores local environments on your computer, in %APPDATA%\Thorp and your selected browser data directories. Optional cloud sync uploads encrypted browser archives. These archives can include cookies, session data and website storage supported by that browser. Account, workspace, membership and environment metadata are processed separately and are not all encrypted with your cloud key.
PIN recovery and verified team sharing currently run on software beta security nodes. The ordinary account and billing services do not receive your PIN or plaintext cloud decryption keys through these protocols. This is not a claim that the beta is protected against administrators controlling the nodes or client software; independently protected production hardware has not been deployed. Use test data during this beta.
For an existing paid licence file, including a Founding Pilot licence, Thorp attempts a background licence heartbeat on startup and roughly every 24 hours until one attempt succeeds in that ISO week; after a success it stops until the next week. A stored record contains an opaque licence ID, the ISO week, the total number of local browser environments, and the time our server received it. It does not contain your name, email, order number, browsing activity or profile contents. An installation without a paid licence file sends no licence-file heartbeat. Cloud subscriptions use the separate account and entitlement service requests described below.
The licence-file heartbeat is separate from cloud membership. Signing in, checking entitlements, inviting teammates and syncing generate service requests even when no licence heartbeat is sent.
What we do collect
| What | Why | Kept for |
|---|---|---|
| Account email and identifier, authentication/session records, and relevant sign-in-provider information | Sign-in, account security and account support | While needed to provide the account and address security, legal or deletion requests |
| Workspace and team names, member and invitee emails, roles, category/environment metadata, device and lease records, storage usage, order identifiers, selected plan and quantities, policy acceptance versions, payment-event status, subscription and administrator-grant history | Show your directory, apply permissions and entitlements, coordinate sync and provide upgrade records | While needed to provide the service, resolve disputes and meet applicable recordkeeping obligations |
| Encrypted browser archives and their versions; public identity keys, signed sharing permissions and state records; recovery protocol records handled by the security nodes | Recover your cloud identity, sync and verify access to shared categories | While required for the cloud service and recovery; see deletion and retention below |
| Website and API operational logs processed by Cloudflare, which may include IP address, request URL, timestamp, headers, response information and security metadata | Hosting, security, abuse prevention and fault diagnosis | Up to 7 days |
| Cloudflare Web Analytics, a cookie-free measurement script Cloudflare injects into our website pages. It reports the page URL, referrer, browser and device type, country and page-load timings to Cloudflare. It does not use cookies and does not follow you across other sites | To see which pages people read, so we know what to write next | Held by Cloudflare under its own retention policy; we see only aggregate reports |
| Your email address and message, if you write to support | To answer you | 24 months after the last message |
| Buyer records available from Paddle: name, address, email address, purchase history and transaction analytics. We access only what fulfilment, licence administration, support, refund and fraud handling and our records reasonably need | To issue and validate a licence, answer support, handle refunds, and meet tax record obligations | As required by law |
| Paid-licence heartbeat: an opaque licence ID, the ISO week, the total environment count, and our server’s receipt time. Attempted on startup and roughly every 24 hours until one attempt succeeds in that ISO week | To administer paid licences and to measure active paid installations | One stored row per licence per week, deleted automatically 12 months after collection by a scheduled job that runs daily |
| A diagnostic bundle, only when you choose to upload one | To diagnose the problem you reported | 90 days |
We do not describe our website logs as anonymous. Hosting and security metadata may sometimes allow requests or visits to be correlated, so an absolute claim would not be supportable.
We do not receive or store your full card number, CVV or payment credentials. Depending on Paddle’s dashboard and API, we may be able to access limited payment-method metadata such as card brand, the last four digits, expiry and cardholder name. We do not use that information to charge you.
Browser content, encryption and connected Agents
We do not upload the contents of a local-only browser environment as product analytics. Enabling cloud sync is a separate choice: the client encrypts supported archive contents before upload, and your authorized devices decrypt them. Directory metadata, account authentication and billing records remain available to the services that provide those functions.
Your PIN is used by the client in the recovery protocol with the security nodes, separately from ordinary account authentication. The nodes retain protocol records and state needed for recovery and attempt controls. Team sharing uses verified identities, signed permissions and encrypted key grants. A team administrator can manage membership and see team metadata; authorized recipients can read shared content. Revoking access cannot erase a copy someone already downloaded.
If you connect an AI client or other automation client, the tools you authorize can return page URLs, text, screenshots and other browser data to that client. The selected client and its service provider may then process that data under their own terms. Thorp does not supply the AI subscription. Mailbox access can expose verification messages and account-recovery links; limit it to accounts and tasks you authorize. A browser sign-in does not itself authorize every subsequent action.
The websites you visit, your selected browser, proxy and extensions also process data under their own terms. Website analytics on thorp.run, voluntary support attachments and enabled cloud sync are separate from data sent to your chosen automation provider.
Purpose and consent
We collect, use and disclose personal data only for the notified purposes, and only where we have consent, deemed consent, another basis authorised by the PDPA, or an obligation under other written law. Processing that is reasonably necessary to complete and fulfil a purchase you request is not consent to unrelated analytics or marketing.
Sending a support message or a diagnostic bundle is voluntary, and it authorises us to use its contents to investigate and answer that request. We will not use it for an unrelated purpose without a separate legal basis and notification.
You may withdraw consent on reasonable notice. We will explain the likely consequences and cease the affected processing, including by relevant processors, unless continued processing is authorised or required by law.
We use the email associated with a licence for fulfilment, product, security, legal and support messages. We do not use personal data received from Paddle for direct marketing unless you have separately opted in, and every marketing email carries an effective unsubscribe method.
We do not conduct outbound telemarketing. We will not send marketing calls, SMS or messages to a Singapore telephone number unless the communication is permitted both by the PDPA’s Do Not Call provisions and by our agreement with Paddle.
Disclosure
Paddle is the independent seller, Merchant of Record and data controller for the transaction. Paddle collects and processes checkout, billing, tax, fraud, payment and refund data under Paddle’s own Privacy Notice, and makes buyer records available to us. When Paddle shares buyer records with us, Paddle and JOYFULAI each act as independent controllers for their respective processing: Paddle for its transaction services, and JOYFULAI for software fulfilment, entitlement administration, support and its own records. Requests concerning Paddle’s independent processing should be directed to Paddle; requests concerning our processing go to the contact below.
Brevo sends transactional messages, including team invitations, and receives the recipient’s email address and message contents. Cloudflare hosts our website and API, routes inbound mail, and provides the website measurement described above. Supabase provides cloud account authentication, database and encrypted archive storage. Our software beta security nodes run on Alibaba Cloud and Google Cloud infrastructure in Singapore, Japan and the United States. Hosting providers process the data and operational metadata needed to deliver these services.
We do not sell personal data, and we do not share it for advertising.
We may disclose personal data where required by law or a valid order of a Singapore court or authority.
Transfers outside Singapore
Some providers and security nodes operate outside Singapore, including in Japan and the United States. Cloudflare, Supabase, Brevo and the node infrastructure providers process service data under their applicable data processing terms; Paddle acts as an independent controller under its own terms. Your chosen AI client may send browser data to additional destinations according to its own configuration and terms.
Transfers of personal data outside Singapore require a standard of protection comparable to the PDPA. We are responsible for taking the required steps, including appropriate due diligence and legally enforceable obligations where required. A provider’s location or the fact that data is encrypted does not by itself satisfy this requirement.
Protection and retention
We keep the data listed above in access-controlled systems. Transaction and accounting records needed for tax or accounting obligations are retained for at least five years from the relevant Year of Assessment. Other licence and support records are retained for the specific periods in the table above. When the stated purpose and every lawful legal or business need have ended, we delete the record or irreversibly de-identify it. Paddle applies its own retention policy as an independent controller.
Heartbeat rows are deleted by a scheduled job that runs once a day. We say this only because the job exists — publishing a retention period we do not enforce would be worse than publishing none.
Signing out, uninstalling the app or allowing membership to expire does not itself delete local environments, cloud archives or all account records. To request cloud/account deletion, contact the address below; we verify the request and identify records that must be retained. Older encrypted versions and recovery records may remain while needed for recovery or an applicable legal or business purpose. The beta does not promise that every historical copy is erased immediately after a directory change. Local copies and copies already received by teammates or an external AI provider are controlled separately.
We notify the Personal Data Protection Commission when a data breach is either likely to cause significant harm or of significant scale, within the period the PDPA requires after determining that it is notifiable. We notify affected individuals where the significant-harm test and the statutory notification requirements apply.
Your rights
Subject to the exceptions the PDPA allows, you may:
- ask for a copy of the personal data about you that is under our control, together with information about how it was used or disclosed during the preceding year;
- ask us to correct it. Where required, we will send the correction on to organisations we disclosed the data to during the preceding year;
- ask us to delete it, subject to retention that law or a legitimate business need requires.
Write to the address below. We respond as soon as reasonably possible; if we cannot respond within 30 days, we will tell you when we expect to.
Complaints
If you are unhappy with how we handled your personal data, write to support@thorp.run with the subject “Privacy complaint”. The Data Protection Officer acknowledges it, investigates, and normally responds within 30 days, or explains why more time is needed. You may also complain to the Personal Data Protection Commission.
Data Protection Officer
As required by section 11(3) of the PDPA, we have designated an individual to be responsible for data protection. Public enquiries and requests reach that individual through the business contact information below; the PDPA does not require us to publish their name.
Data Protection Officer, JOYFULAI TECHNOLOGY PTE. LTD., 60 Paya Lebar Road #13-04, Paya Lebar Square, Singapore 409051 Email: support@thorp.run
Changes
If this policy changes, the date at the top of this page changes, and material changes are sent to the email associated with any active licence.