Privacy policy
Last updated
This privacy policy (Datenschutzerklärung) explains how we process personal data when you use Plus for Things 3: the website at things3.plus, the sign-up, the Cloud MCP connector that links your AI app to Things, the account page and our emails. It is based on the EU General Data Protection Regulation (GDPR, in German DSGVO) and the German Federal Data Protection Act (BDSG). It covers the service we host; if you run the public source code yourself, section 22 explains what applies.
1. Who is responsible
The controller (Verantwortlicher) is:
Grzzly Enterprises UG (haftungsbeschränkt)
c/o Tobias Pörtner
Winsstr. 23
10405 Berlin
Germany
Managing director (Geschäftsführer): Tobias Pörtner
Email: support@things3.plus
More company details are in the imprint. We are not required to appoint a data protection officer and have not appointed one. Please send every privacy question or request to the email address above.
2. In short
- Your Things password is used once to connect and is never stored.
- We keep a working copy of your Things data so that your assistant gets fast answers and makes only checked changes. It is encrypted with a key that belongs to your account alone, and it is deleted when you disconnect.
- Our servers run in the EU (Netherlands).
- No advertising, no tracking cookies, no sale of data. We do not use your Things data to train AI models.
- We send product news only if you ask for it and confirm by email.
- You can delete everything yourself on the account page at any time.
- If you run our public source code yourself, we receive no data from your instance.
3. Visiting our website
When you open one of our pages, your browser sends technical data: your IP address, the date and time, the page requested, the page you came from, and your browser’s identification (user agent). Cloudflare, which sits in front of our server, and Railway, which hosts it, need this data to deliver the page and to protect the service against attacks and abuse. Our own server does not store your IP address. Cloudflare also tells our server which country your IP address belongs to; we use it only to show prices and charge in euros or US dollars, and we do not store it. Railway keeps request traces (which route was called and how long it took) for 30 days; they contain no personal data.
Our status page at /status is delivered by Cloudflare directly and processes the same technical data.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is delivering the website securely and reliably.
Web analytics
On our public pages (not on the sign-up, sign-in, loading, billing or account pages) we use Cloudflare Web Analytics. It counts page views, referring pages, countries, device types and loading times in aggregate. It sets no cookies, uses no local storage and does not follow you across other websites, and we cannot identify you from it.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is knowing which pages are useful and whether they load quickly, using a tool that does not track individuals.
4. Your account: signing in with Things
You create your account in one of two ways. Both collect the same data:
- On our website: “Get started” asks for the email address and password of your Things Cloud account and your agreement to our terms, and offers product news (section 10). You then choose how to start: the free trial or a plan.
- From an AI app: when you connect an AI app, you sign in on our page with the same details and then choose how to start.
This sign-in creates your account with us; there is no separate registration. We start loading your Things history right after it (section 5). If you do not choose a plan, we delete the account with all its data after 24 hours.
- Your password reaches our server over an encrypted connection and is used exactly once, in that same request, to ask Things Cloud for your account’s access key (the “history key”). We then discard it. It is never written to our database, our logs or our backups, and it is sent nowhere except to Cultured Code’s Things Cloud. The same applies when you sign in on the account page. More on this on our security page.
- The history key lets us read and change your Things data. We store it encrypted with your account’s own data key (section 5).
- Account details: your Things email address; your Mail to Things address, if you have turned on that Things feature (Things Cloud sends it to us together with the history key); your time zone (your browser fills it in); when you accepted our terms; your plan and trial dates; whether read-only mode is on; and when you last used the service.
To revoke our access at any time, change your Things Cloud password: the history key we hold stops working immediately, and we ask you to sign in again the next time your assistant uses Things. You can also disconnect on the account page (section 17).
Legal basis: Art. 6(1)(b) GDPR. We need this data to provide the service you ask for.
5. Your encrypted working copy of your Things data
What it is. We keep a copy of your Things history as Things Cloud stores it (every change, in order) and of the current state built from it: tasks, projects, areas, headings, tags, notes, checklists, dates, deadlines and items in the trash.
Why it exists.
- Fast answers: your assistant’s questions are answered from the copy in a fraction of a second, instead of downloading your data from Things Cloud each time.
- Checked changes: every change your assistant asks for is validated against the copy before it is sent to Things Cloud, so malformed changes do not reach your devices.
- Receipts and undo: the copy lets us show what a change did and reverse it (section 6).
- Fewer requests to Things Cloud: we only ask Things Cloud for what has changed since the last time.
When it is created. We start loading your Things history right after you sign in with Things, on our website or from your AI app, before you choose a plan, so that your data is ready when you start. Until you choose a plan, loading runs only when no one else is waiting. If you never choose a plan, we delete your account together with all its data after 24 hours.
How it is protected. Everything we store from your Things data, and the history key itself, is encrypted (AES-256-GCM) with a data key that belongs to your account alone. That data key is in turn encrypted with a master key that is kept separately from the database and never included in backups. A copy of our database alone does not reveal your tasks.
When it is deleted. When you disconnect, we destroy your data key, which makes the copy unreadable at once, and delete your history, the copy and the change journal from our database. “Delete everything” does the same and also deletes your account (section 17).
What it may contain. Your notes can contain anything you have typed into Things, including sensitive information such as health appointments. We do not analyse, categorise or look through this content; it is used only to answer your own requests.
Legal basis: Art. 6(1)(b) GDPR, including steps taken at your request before a contract is concluded (loading your history before you choose a plan).
6. Changes your assistant makes: journal, receipts and undo
For every change your assistant makes, we record which tool ran, the values before and after, the change sent to Things Cloud, the time and the outcome. This journal is encrypted with your data key. It lets you get a receipt and undo a change, and it lets us explain and repair a change that went wrong. Journal entries are deleted after 30 days.
If Things Cloud sends data in a form we do not recognise yet, we record the kind of data and counts, without its content, so that we can support it. These diagnostic records are deleted after 90 days.
Legal basis: Art. 6(1)(b) GDPR (receipts and undo are part of the service) and Art. 6(1)(f) GDPR (our legitimate interest in explaining and repairing changes we made to your data and in keeping up with changes to Things Cloud).
7. What your AI app receives
When you ask your assistant something, it requests the data it needs through our connector, and we send that data to the AI app you connected, for example Claude (Anthropic), ChatGPT (OpenAI) or Cursor (Anysphere). This can include task titles, notes, dates, tags and the names of projects and areas. From then on, the provider’s own terms and privacy policy apply: whether the data is stored, for how long, and whether it is used to improve their models depends on your account and settings with that provider. We have no control over it.
For every AI app you connect, we store its name and web address, the permissions you granted, and hashes of the access and refresh tokens we issued (never the tokens themselves), with their times. Access tokens are valid for one hour; refresh tokens expire after 60 days without use. Apps that register themselves with us are removed after 90 days without use; for those, we keep a keyed hash of the IP address they registered from, to limit abuse.
Legal basis: Art. 6(1)(b) GDPR (passing your data to the app you chose is the service you ask for) and Art. 6(1)(f) GDPR (our legitimate interest in keeping connections secure and being able to revoke them).
8. Free trial, plans and payments (Stripe)
Stripe manages trials, plans, payments, tax and invoices for us.
- Free trial. When you click “Start free trial”, we create a customer record at Stripe with your email address and a free trial subscription that never charges. No card is needed.
- One trial per person. So that the free trial can be used only once, we keep a keyed hash (HMAC) of your normalised email address (for example ignoring “+” tags and, for Gmail, dots). The hash cannot be turned back into your address. We keep it after you delete your account, for as long as we offer a free trial.
- Paying. You pay on Stripe’s checkout page. Your payment details go directly to Stripe; we never see or store card numbers. Stripe also collects your name, billing address or country and, if you enter one, your VAT ID, to calculate VAT and issue invoices.
- What we store. Your Stripe customer ID, your plan and its status, and the relevant dates (trial end, renewal, cancellation). Stripe informs us about changes (webhooks); we keep these notifications for 30 days.
- After you delete your account, your customer record at Stripe remains for tax purposes, without payment methods. Stripe keeps invoices and payment records for as long as tax and commercial law require (up to 10 years).
The recipient is Stripe Payments Europe, Limited (Ireland). For some purposes, such as fraud prevention and meeting financial regulation, Stripe acts as a separate controller; see Stripe’s privacy policy.
Legal basis: Art. 6(1)(b) GDPR for trials, plans and payments; Art. 6(1)(c) GDPR together with § 147 AO and § 257 HGB for keeping invoices; Art. 6(1)(f) GDPR for the trial record (our legitimate interest in offering a free trial only once per person).
9. Emails about your account
We send service emails about your account: a welcome when your trial starts; before and when your trial ends; when a plan starts, is canceled or a payment fails, and before a grace period ends; when your data has finished loading after you left the loading page; when you disconnect or delete your account; the confirmation for product news; and when a change at Things Cloud affects your account. Service emails contain no advertising.
- We first put each email into a queue in our own database. Once it is sent (or can finally not be sent), we remove the address and content from the queue entry, and we delete the entry itself after 30 days.
- We send the emails through Loops. Loops receives your email address and what the message needs (for example your plan, dates and links). Service emails do not add you to any contact list at Loops. Loops keeps a record of sent emails for delivery and abuse handling.
- We track opens and clicks only for product news (section 10), not for service emails.
Legal basis: Art. 6(1)(b) GDPR.
10. Product news (only with your consent)
We send product news (updates, new features and relevant information) only if you ask for it and confirm by email (double opt-in). You can ask for it with the box on the sign-up page (“Get started”) or the sign-in page, on the account page, or with the form on our website. We then send one confirmation email; only when you click “Confirm” on the page it links to do we add you to our product-news audience at Loops.
- Consent record. When you confirm, we record the time, where you signed up, a hash of the wording you agreed to, and a keyed hash of your IP address and browser identification. It proves your consent without storing your IP address itself. If you have an account, the record is stored with your account and deleted with it. If you sign up on the website without an account, we store nothing about you ourselves: Loops holds your address together with the wording, the times of your request and confirmation, and a keyed proof that our confirmation page created the entry.
- What Loops holds. Your email address and, if you have an account, your account status, plan and trial end date, so that the news fits your situation.
- Opens and clicks. For product news, Loops records whether you open an email and which links you click. This shows us which topics are useful.
- Unsubscribing. Every product-news email has an unsubscribe link, and you can turn product news off on the account page. Loops then keeps your address marked as unsubscribed so that you receive no further product news. “Delete everything” also deletes your contact at Loops; if you signed up on the website only, email us and we delete it.
- Protection against abuse. The website form limits how often it can be used per IP address and per email address. We use your IP address for this only in memory, briefly, and do not store it.
Legal basis: Art. 6(1)(a) GDPR (your consent). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). We keep the consent record on the basis of Art. 6(1)(f) GDPR: our legitimate interest in being able to prove your consent (Art. 7(1) GDPR).
11. Fair use and daily usage counts
For each account we count per day how many requests your assistant makes, how many changes it makes and how often your data is loaded from Things Cloud. These are numbers only, without content. We use them to apply the daily fair-use limits described in our terms and to plan capacity. The counts are deleted after 90 days.
Legal basis: Art. 6(1)(b) GDPR (fair use is part of our terms) and Art. 6(1)(f) GDPR (our legitimate interest in keeping the service reliable for everyone).
12. Security, error reports and fixing problems
- Security logs. Our server logs sign-ins, refused requests, rate limits and similar events with a pseudonymous account ID (a random identifier, not your email address). The logs never contain passwords, access keys, tokens, task content, email addresses or IP addresses. They are kept at Railway for up to 30 days.
- Error reports. When an error occurs, our server sends a technical report to Sentry: the error message, where in our code it happened, the route, the app version and a pseudonymous account ID. Error reports contain no names, email addresses, IP addresses or task content. Sentry stores them in its EU region for up to 90 days.
- AI coding assistants. When we work on a problem, AI coding assistants (Claude, by Anthropic) help us find its cause and fix it. They read the problem’s ticket, error reports and server logs, with pseudonymous account IDs only, never your task content, and they make no decisions about you.
- Status page and problem reports. Our status page shows whether each part of the service works, with short notes on known problems; it contains no personal data. You can report a problem by email or as an issue on GitHub. A GitHub issue is only a way to tell us: we copy each one into a problem ticket (below) and track and fix the problem there. Your GitHub issue is public, and GitHub’s terms and privacy statement apply; please do not include personal data in it.
- Problem tickets. We track and work on every problem in Linear (Linear Orbit, Inc., USA), whether our monitoring found it or someone reported it. A ticket can contain an alert from our monitoring with technical details, scrubbed of personal data, and pseudonymous account IDs; excerpts of error reports from Sentry; and a copy of a problem report you posted on GitHub, with your GitHub username. Apart from what you write in a GitHub report yourself, tickets contain no names, task content, email addresses or IP addresses. We keep a ticket as long as we need it to fix the problem and to recognise the problem if it comes back.
- Linear’s AI agent. Linear’s built-in AI agent reads these tickets to sort and summarise them and to help find the causes of problems. For this, Linear passes ticket content to the companies it lists as its subprocessors for artificial intelligence: Anthropic, PBC; OpenAI OpCo, LLC; Google LLC; Amazon Web Services, Inc.; Cohere Inc.; Fireworks AI, Inc.; TypeSafe AI, Inc.; and Braintrust Data Inc. They process it in the USA, and some of them also in the EU. Linear does not use the tickets to train AI models and does not allow these companies to train on them. To find a cause, the agent can also look at our error reports at Sentry, our source code and its changes on GitHub, and, for a problem with a plan or a payment, the related records at Stripe (your plan, subscription, invoices and payment status, which include your email address and billing details). It reads only what the problem needs and never writes names, email addresses or payment details into a ticket. The agent makes no decisions about you.
- Backups. We keep encrypted backups of our database: a nightly copy in Cloudflare R2 (stored in the EU) and Railway’s point-in-time recovery. Backups are kept for up to 35 days. Your task content stays encrypted with your data key inside them, and the master key is never part of a backup. Data you delete disappears from backups when they expire. We use backups only to recover from failures; if we ever restore one, we delete again whatever was deleted after it was made.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is keeping the service secure, finding and fixing errors and reported problems quickly and being able to recover from failures (see also Art. 32 GDPR).
13. When you email us
If you email us, we process your message, your email address and any details you include in order to answer you. We delete support emails once your request has been dealt with, unless the law requires us to keep them (for example as business correspondence).
Legal basis: Art. 6(1)(b) GDPR if your message concerns your account or a contract with us; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering your questions).
14. Cookies
We use only cookies that are strictly necessary for a service you asked for, so we do not need your consent for them (§ 25 (2) No. 2 TDDDG) and we show no cookie banner. We use no tracking, advertising or analytics cookies.
| Cookie | Where | Purpose | Lifetime |
|---|---|---|---|
__Host-tac_account |
sign-up on our website, account page | keeps you signed in while you choose how to start and on the account page | 15 minutes |
__Host-tac_csrf |
sign-up on our website, account page | protects the sign-up and sign-in forms against forged requests from other sites | 30 minutes |
Both cookies are sent only over encrypted connections and only to our own site, and scripts cannot read them. The sign-in page you see when connecting an AI app sets no cookies.
Cloudflare may set a strictly necessary security cookie, for example after a check that protects the service against automated attacks.
15. Who receives data
We work with the following service providers. Where they process personal data for us, they do so as processors under a data processing agreement (Art. 28 GDPR).
| Recipient | What for | What they receive | Where |
|---|---|---|---|
| Railway | hosting of our server and database | everything we store (your Things data encrypted), security logs, request traces | EU region europe-west4 (Netherlands); a US company |
| Cloudflare | proxy and protection against attacks, cookieless web analytics, our status page, encrypted backup copies (R2) | IP addresses and request data; encrypted backups | global network, backups stored in the EU; a US company |
| Stripe | trials, plans, payments, tax calculation and invoices | email address, billing details, payment details | Ireland (EU), with group companies in the USA |
| Loops | service emails; product news with your consent | email address, email content; for product news also plan details, opens and clicks | USA |
| Sentry | error reports | technical error data with a pseudonymous account ID | EU region; a US company |
| Anthropic | AI coding assistants that help us find and fix problems | problem tickets, error reports and logs with pseudonymous account IDs | USA |
| Linear | problem tickets, sorted and summarised by Linear’s AI agent | alerts and error report excerpts with pseudonymous account IDs; copies of problem reports posted on GitHub, with the GitHub username; for a billing problem, the related records at Stripe that its AI agent reads (plan, invoices and payment status, with your email address and billing details) | USA; its AI subprocessors are named in section 12 |
| GitHub | hosting our public source code; a place where you can report a problem | no personal data from us; your own reports, if you post there | USA |
These are not our processors:
- Cultured Code GmbH & Co. KG (Germany) provides your Things Cloud account under its own terms and privacy policy. We connect to it on your behalf. Cultured Code sees the requests our server makes for you: the sign-in, reads of your history and the changes you ask for.
- Your AI provider receives the data your assistant requests (section 7).
Beyond this, we disclose personal data only where the law requires it (Art. 6(1)(c) GDPR).
16. Transfers outside the EU
Some of our providers are US companies or use their own service providers outside the EU. Where personal data is transferred to, or can be accessed from, a country without an adequacy decision of the European Commission, the transfer is based on the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise, or in addition, on the EU standard contractual clauses (Art. 46(2)(c) GDPR). For Linear, the transfer is based on the EU standard contractual clauses (module two, controller to processor) in Linear’s data processing agreement; Linear binds its own subprocessors, including the AI subprocessors named in section 12, to comparable data protection obligations. Your Things data is encrypted in our database and in our backups.
17. How long we keep data
| Data | How long |
|---|---|
| Account details | until you delete your account; the account record is removed within 7 days of “delete everything” |
| Accounts that never choose a plan | deleted with all their data after 24 hours |
| History key, working copy and Things history | until you disconnect or delete your account |
| Change journal | 30 days |
| Diagnostic records about unknown Things data | 90 days |
| Connected AI apps | access tokens 1 hour; refresh tokens 60 days after last use; unused app registrations 90 days |
| Daily usage counts | 90 days |
| Email queue | address and content removed once sent; entries deleted after 30 days |
| Product-news consent record | until you delete your account |
| Product-news contact at Loops | until you delete your account or ask us to delete it; after unsubscribing, kept as unsubscribed |
| Trial record (keyed hash of your email address) | after deletion of your account, for as long as we offer a free trial |
| Stripe notifications on our side | 30 days |
| Invoices and payment records at Stripe | as long as tax and commercial law require (up to 10 years) |
| Security logs | up to 30 days |
| Request traces | 30 days |
| Error reports | up to 90 days |
| Problem tickets at Linear | as long as we need them to fix the problem and to recognise it if it comes back |
| Backups | up to 35 days |
| Support emails | until your request is dealt with, unless the law requires longer |
Disconnect (on the account page) deletes the history key, the working copy, your Things history and the change journal. Your account, plan and trial stay, and you can reconnect at any time.
Delete everything (on the account page) does the same, cancels any running subscription, deletes your contact at Loops and deletes your account. Nothing in Things itself is touched: your tasks in Things are not affected.
18. Your rights
You have the right to:
- access the personal data we hold about you (Art. 15 GDPR);
- rectification of inaccurate data (Art. 16 GDPR); task content is corrected in Things itself, and our copy follows;
- erasure (Art. 17 GDPR), unless we must keep data by law (for example invoices);
- restriction of processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- object to processing based on legitimate interests (Art. 21 GDPR; section 19);
- withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).
To use these rights, email support@things3.plus, ideally from the address of your account. If we cannot identify you from your request, we may ask for more information. We answer within one month, free of charge.
Much of this you can do yourself: “Delete everything” and the product-news switch are on the account page, every product-news email has an unsubscribe link, and all your Things data is always available in your Things apps.
19. Your right to object
Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An informal email is enough.
20. Your right to complain
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).
21. No automated decision-making
We do not make decisions about you based solely on automated processing, including profiling, that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). The fair-use limits apply equally to every account, and the AI analysis of error reports and problem tickets makes no decisions about you.
22. Self-hosted instances
Our source code is public, and you may run an instance of Plus for Things 3 yourself, for your own personal use (see section 21 of our terms). Such an instance is run by you, not by us:
- We receive no data from a self-hosted instance: no Things data, account details, logs, error reports, usage counts or emails. It does not use our payment, email or error-reporting services.
- It connects directly to Cultured Code’s Things Cloud and to the AI apps you connect to it. What those providers do with your data is governed by their own terms and privacy policies.
- This privacy policy covers the service we host and our website. It does not describe what a self-hosted instance does with data; that depends on how you run it.
23. Do you have to provide your data?
You need to provide your Things Cloud email address and, once, your password to use the service; without them we cannot connect to your Things data. To buy a plan you need to provide payment details to Stripe. There is no legal obligation to provide any of this, but without it you cannot use the service. Product news is entirely optional.
24. Changes to this policy
We update this policy when the service or the law changes, for example when we add or replace a service provider. The current version, with the date of its last update, is always on this page. If a change materially affects you, we tell you by email before it takes effect.
25. Contact
For any privacy question, email support@things3.plus or write to Grzzly Enterprises UG (haftungsbeschränkt), c/o Tobias Pörtner, Winsstr. 23, 10405 Berlin, Germany.