Dr. Thoughts Privacy Policy

Effective date: 22 October 2026 Last updated: 23 October 2026

Dr. Thoughts is operated by ZBLIFESTYLE - FZCO, licence no. 34293, Dubai Integrated Economic Zones Authority, Premises 34293-001, IFZA Business Park, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

Dr. Thoughts was previously called Thoughtz; only the name has changed.

This Privacy Policy explains how we collect, use, disclose, protect and retain personal data when you use the Dr. Thoughts website, Android application and related services.

1. Important information about Dr. Thoughts

Dr. Thoughts is an AI self-reflection service for adults. It is not a person, medical device, healthcare provider, therapist, counsellor or emergency service. It does not diagnose, treat, cure or prevent any medical or mental-health condition.

Your conversations may contain sensitive information. We treat chat content, mood information, inferred patterns and safety information as sensitive even where local law does not create a separate sensitive-data category.

2. Personal data we collect

2.1 Information you provide

We may collect:

Chat messages, check-in responses, notes, vents, decisions and saved reflections;
Mood, feeling, trigger and feedback selections;
Reports about an AI reply;
Date of birth or age-assurance result;
Country and optional profile information, including languages, gender and communication preferences;
Email address and authentication information;
Reminder instructions and notification choices;
Information sent to customer support; and
Subscription status and purchase identifiers received from an app store.

Please avoid entering another person's sensitive information unless it is reasonably necessary for your own reflection.

2.2 Information Dr. Thoughts creates

Based on what you provide, Dr. Thoughts may create:

AI replies;
Insight cards, patterns, recaps and albums;
Memories and contextual summaries;
Names of people you mention and records of events, calls, visits or meetings you describe;
Reminders inferred from dates or commitments in a conversation;
Safety classifications used to decide whether to show support resources; and
Aggregate statistics about the use of features.

You can review and remove remembered information through the account controls.

2.3 Technical information

We may collect:

IP address for security, rate limiting and approximate country determination;
Browser, device, operating system and app version;
Error and diagnostic information configured not to contain chat text;
Push-notification token;
A device key used to enforce guest-message limits;
Google Play Integrity results on supported Android devices;
Consent, authentication, security and administrative logs; and
Server-side page and campaign counts for public content pages.

We do not use advertising trackers or session-replay tools inside the private Dr. Thoughts service.

2.4 Voice input

Where supported, speech is converted to text on the device. If on-device conversion is unavailable, the browser or operating-system speech provider may process audio to produce text. Dr. Thoughts receives the resulting text and does not intentionally store the audio. The external speech provider's processing is governed by its own terms and privacy practices.

2.5 Information stored on your device

The app or browser may cache recently opened screens, including your words, on your device to improve speed and offline continuity. The cache is cleared on sign-out, account deletion or when another account signs in. Device-level storage is not a substitute for securing your phone. Use the history lock and generic notifications if another person may access your device.

3. How we use personal data

We use personal data to:

Provide AI chat and self-reflection features;
Run safety checks and display crisis, abuse or coercion resources;
Remember context and create the insights, albums and reminders you request;
Authenticate accounts and synchronise information across devices;
Send generic notifications and, only if separately enabled, personalised notification previews;
Enforce free-message limits and protect against abuse;
Process and verify subscriptions;
Respond to support and rights requests;
Investigate reported AI output;
Maintain security, prevent fraud and comply with law; and
Improve Dr. Thoughts using aggregate usage information and, only with separate consent, chats a user chooses to share.

We do not use chat content for targeted advertising or sell personal data.

4. AI processing

Dr. Thoughts uses contracted AI and cloud providers. Depending on the feature and production configuration:

Google Cloud Vertex AI/Gemini may generate chat responses, create text embeddings or perform related AI processing;
Anthropic Claude may generate chat responses and performs safety-related processing;
Google Cloud and Firebase host application services, store data and deliver notifications.

We configure our commercial AI services so that Dr. Thoughts user content is not used to train general-purpose AI models. Providers may process or retain limited information to provide, secure and prevent abuse of their services under their contracts and configured retention controls. We do not describe a provider as having zero retention unless that status has been confirmed for the production project. Zero retention is not currently in place: Anthropic keeps inputs and outputs for up to 30 days and may access them for safety and security purposes, and does not use them to train its models.

AI processing may occur outside your country, including in India, the European Union and the United States, depending on the service and feature used.

5. Notifications

Generic notifications are the default. They do not include chat details or sensitive subjects.

If you separately enable personalised previews, a notification may contain a limited detail from a reminder or chat. Such information may appear on a lock screen and be visible to another person. Personalised previews are automatically suppressed where the history lock is enabled, where coercion or abuse is detected, in connection with crisis content and for 14 days following a crisis event.

You can turn notifications or personalised previews off at any time.

6. Who receives personal data

We disclose personal data only as necessary to operate and protect Dr. Thoughts, including to:

Google Cloud, Firebase and Vertex AI;
Anthropic;
Email-delivery providers used for account and reminder messages;
Error-monitoring providers configured to exclude chat text;
App stores and payment processors for subscriptions;
Bot-protection and security providers; and
Professional advisers, authorities or acquirers where legally required or reasonably necessary.

These providers may only process personal data for the contracted service, subject to applicable agreements. We do not disclose chat content to advertisers or data brokers.

7. Staff access

Authorised staff cannot routinely browse private chats. Limited access may occur where:

A safety system flags a possible risk and the configured review process permits an authorised person to review the relevant excerpt;
You report an AI reply, in which case the reported reply and immediately preceding message may be reviewed;
You separately choose to share a chat to help improve Dr. Thoughts;
You request support that requires access and authorise it; or
Access is legally required.

Access is restricted, logged and reviewed. Dr. Thoughts is not monitored in real time.

8. Legal grounds

Depending on applicable law, we process personal data based on:

Your consent, including consent to AI processing, sensitive reflections and optional features;
Performance of the service you request;
Legitimate interests in security, fraud prevention, service measurement and improvement using data that does not include chat text;
Protection of life or safety in exceptional circumstances; and
Compliance with legal obligations.

You may withdraw consent through the app or by contacting us. Withdrawal does not affect processing already lawfully completed.

9. International transfers

ZBLIFESTYLE - FZCO is established in the United Arab Emirates. Depending on the user and feature, data may be stored or processed in India, the European Union, the United States and other locations used by contracted providers.

We use contractual and organisational safeguards for international transfers. Where express transfer consent is required, it is obtained separately. Dr. Thoughts must not be made available to UAE users unless the company has implemented a legally approved UAE data-residency arrangement or received written legal confirmation that the existing architecture is permitted.

10. Security

We use encryption in transit, encryption at rest, account-specific encryption controls, access restrictions, multifactor authentication for administrators, logging, testing and incident-response procedures.

Dr. Thoughts is not uniformly end-to-end encrypted. Certain authorised safety and support processes may access limited content under controlled and logged conditions. No online service is completely secure.

11. Retention

We apply an internal retention schedule. In summary, guest content is deleted within 7 days of last use; account content is kept until deletion or 24 months of inactivity (we try to notify you through each available channel first, and inaccessible accounts may be deleted after the stated period, 30 days after the attempt); safety and report excerpts are kept for up to 90 days; and account deletion is completed from active systems within 30 days, subject to limited legal, security and payment records. We keep daily backups of our databases for up to 14 days, and point-in-time recovery lets us restore them to any moment in the last 7 days; both are encrypted. When you delete your account, its encryption key is destroyed at deletion; any copy of your data in a backup expires within 14 days, and if a backup is ever restored we first delete again every account deleted since it was taken.

12. Your rights

Depending on your location, you may have the right to:

Know whether we process your data;
Access and export it;
Correct inaccurate information;
Delete chats, memories or your account;
Withdraw consent;
Object to or restrict certain processing;
Receive information about processors or recipients;
Nominate another person where local law permits; and
Complain to or appeal before a regulator.

Use the in-app controls or email info@zoby.tech. We will verify requests and respond within the period required by applicable law.

13. Adults only

Dr. Thoughts is for adults aged 18 and older. Users who do not meet the age requirement cannot use AI chat. Information entered before an under-18 determination is deleted within 24 hours.

14. Crisis situations

Dr. Thoughts is not an emergency service. It may display local support resources if a safety system detects possible serious harm, but the system may be wrong or fail. Dr. Thoughts does not promise to contact emergency services, family members or another person. If you or another person is in immediate danger, contact the local emergency service directly.

15. Changes

We will update the date of this policy when it changes. We will provide advance notice of material changes and request renewed consent where required.

16. Contact

ZBLIFESTYLE - FZCO Premises 34293-001, IFZA Business Park, Building A1 Dubai Digital Park, Dubai Silicon Oasis Dubai, United Arab Emirates Email: info@zoby.tech

Privacy officer and data protection contact: Avneesh Chhabra, ZBLIFESTYLE - FZCO, Premises 34293-001, IFZA Business Park, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, info@zoby.tech.

India: Grievance Officer (privacy, and consumer complaints under the Consumer Protection (E-Commerce) Rules): Avneesh Chhabra, ZBLIFESTYLE - FZCO, Premises 34293-001, IFZA Business Park, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, info@zoby.tech. We acknowledge complaints within 24 hours and resolve them within 7 days as the IT Rules require. You may also contact the Data Protection Board of India once it is operating.