Privacy Policy

Last updated: September 22, 2026 · v2.0

ThinShot is committed to protecting your privacy. This policy explains exactly what data we collect, why we collect it, and how we protect it.

1. Who We Are

ThinShot is operated by J.T. Estates LLC, a company based in New York, USA.
Contact: hello@thinshot.app · Privacy: privacy@thinshot.app

2. What Data We Collect

We collect the following categories of data when you use ThinShot:

Personal Identifiers

  • • Full name and email address
  • • Account credentials (managed by our authentication provider)

Health & Medical Information

  • • GLP-1 medication name and dosage
  • • Injection dates, times, and injection site locations
  • • Body weight (current and historical)
  • • Weight loss goal and starting weight
  • • Protein, calorie, and macronutrient intake
  • • Daily wellness check-ins (mood, energy, nausea, side effects)
  • • Progress photos
  • • Journal entries
  • • Body measurements (waist, hips, etc.)

Usage Data

  • • Pages visited, features used, time in app
  • • Device type, browser type, IP address
  • • Log timestamps

3. How We Use Your Data

  • • To provide the ThinShot tracking service
  • • To power Sage AI insights (your data is processed to generate personalized wellness guidance)
  • • To send email reminders you have configured
  • • To calculate your progress statistics
  • • To improve the app (aggregated, anonymized usage analytics only)
  • • We do NOT sell your personal health data to any third party
  • • We do NOT share your health data with advertisers

4. Health Data Special Notice

ThinShot collects information about your medications and health metrics. This information is stored securely and is used solely to provide you with the ThinShot service.

ThinShot is NOT a covered entity under HIPAA (we are a personal tracking tool, not a healthcare provider).

5. AI Processing (Sage)

Our AI assistant Sage processes your health data to generate personalized wellness insights. Your data may be processed by our AI provider (OpenAI). We have a data processing agreement in place to ensure your data is not used to train AI models without consent. Sage's responses are for informational purposes only and do not constitute medical advice.

6. Data Sharing — Third Parties

We share minimal data with the following third parties, only as necessary to provide the service:

Base44 (Authentication & Infrastructure)

Purpose: Account management, data storage, app hosting

Data shared: Account data, health data (encrypted at rest)

Their Privacy Policy →

Stripe

Purpose: Payment processing

Data shared: Billing information only — NO health data is ever shared with Stripe

Their Privacy Policy →

OpenAI

Purpose: Sage AI wellness insights

Data shared: Health context you share in Sage conversations

Their Privacy Policy →

7. Data Retention

  • • Active accounts: Data retained for the duration of your account
  • • After deletion request: All personal data deleted within 30 days
  • • Backups: Purged from backups within 90 days
  • • Anonymized/aggregated data: May be retained indefinitely (cannot identify you)

8. Your Rights

Regardless of your location, you have the following rights:

  • • Right to Access: Request a copy of all your data
  • • Right to Correction: Update inaccurate data (directly in Settings)
  • • Right to Deletion: Delete your account and all associated data
  • • Right to Portability: Download your data in machine-readable format (Settings → Download My Data)
  • • Right to Opt Out: Opt out of any non-essential data processing
  • • Right to Know: Know what data we collect and how we use it (this policy)

To exercise your rights: Email privacy@thinshot.app. We will respond within 30 days.

9. Children's Privacy (COPPA)

ThinShot is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us at hello@thinshot.app and we will delete the account immediately.

10. Security

We use industry-standard encryption (TLS/SSL) for all data in transit. Health data is encrypted at rest. We conduct regular security reviews. In the event of a data breach affecting your information, we will notify you within 72 hours by email.

11. Cookies

We use essential authentication cookies only (required for login — cannot be opted out without breaking functionality). We do not use advertising cookies or third-party tracking cookies. See our Cookie Policy for details.

12. Changes to This Policy

We may update this Privacy Policy. We will notify you by email and display a banner in the app at least 14 days before material changes take effect. The current version and date are always displayed at the top of this page. Continued use after the effective date constitutes acceptance.

13. Contact

Privacy questions: privacy@thinshot.app
General: hello@thinshot.app
Operator: J.T. Estates LLC, New York, USA

Cookie Consent

We use essential cookies to ensure the app functions properly. We also use analytics cookies to understand how you use ThinShot, which helps us improve the experience. You can choose to accept or decline non-essential cookies.