Privacy Notice

Effective date: 4 October 2026 · Version: 2026-10-04

Maverick Bits S.R.L., CUI 46518982 (“we”, “us” or “our”) is the controller of the personal data described in this notice. We explain below what Thryve processes, why, who receives it and how you can exercise your rights. Our contact details are in section 11.

This Privacy Notice explains how we process your personal data and the legal grounds for doing so. Where consent is required, we ask for it separately.

1. Scope

This notice covers the Thryve mobile app, getthryve.app and related services (the “Service”), including guest use, accounts, Personal Mix, subscriptions, reminders and support. Apple, Google and other external services also have their own notices for activities for which they act as independent controllers.

2. Data We Process and Where It Comes From

We do not obtain contact lists, microphone recordings or precise GPS coordinates for Personal Mix. A timezone or approximate location derived by a provider from an IP address is different from precise GPS location.

Personal Mix processing

Personal Mix context is intended for everyday goals and challenges. Do not include illnesses, symptoms, diagnoses, disabilities, treatment, medication or other physical or mental health details. Automated checks are designed to reject this information even when you request only encouragement. Some explicit health references are rejected before draft storage or provider screening; other submissions can be stored temporarily and sent to AWS for screening. When a request is rejected or generation fails, normal cleanup removes the context from the temporary draft. If processing is interrupted, removal may be delayed until subsequent cleanup or expiry-based deletion. Request and safety metadata may remain for the periods in section 5. Screening can miss information and does not guarantee that sensitive data is never received or processed. These restrictions do not automatically erase previously saved context or generated content.

Preference-based selection ranks the catalogue against your chosen goals, tone and wording exclusions. If you request AI personalisation, our backend processes the context and preferences and sends the relevant information and catalogue candidates to Amazon Bedrock, using Anthropic Claude Haiku 4.5. AWS safety screening receives the context before model generation. We do not deliberately include your account email, display name, push token or payment details in the model prompt. Information you type can nevertheless identify you; safety filters do not guarantee anonymisation.

A preview is processed on the server before you save it. Saving stores the accepted context and content with your mix. Reminders use the saved content or applicable curated fallback; they do not trigger a new AI call for every delivery. A changed preference can deactivate generated content while retaining the saved prompt. Removing the prompt, deleting the mix or requesting erasure are separate actions.

This selection and generation can constitute profiling because it evaluates preferences and relevance to your circumstances. It does not determine credit, employment, insurance, eligibility for healthcare or other decisions with legal or similarly significant effects under Article 22 GDPR. Automated subscription, quota and safety checks can deny a feature request; you can contact us to question an error. There is no implemented continuous mood monitoring or learning from your interactions to retrain your mix.

We do not use personal-context inputs or outputs to train AI models. AWS states that Bedrock inputs and outputs are not used to train its or third-party models and are not shared with model providers. That statement concerns Bedrock model processing; it does not mean Thryve's saved prompts, temporary drafts or any customer-configured logs do not exist.

3. Recipients and Service Providers

Your mixes and prompts are not publicly listed or shared with other users through the Service. Delivery providers receive the message text, not just a push token. That text may reveal something about your circumstances and may be visible to anyone who can see your lock screen or connected device. Device notification settings let you limit previews.

Sharing free-text context is optional. You can use a preference-based mix without it. When you request a context-based preview, we process the necessary ordinary personal data to provide that feature; we do not treat submitting context as blanket GDPR consent. The health-information restriction in section 2 applies. Do not submit other people's sensitive information, identification numbers, passwords or financial credentials.

To stop using saved context, use the available context-removal or mix-deletion controls, or email contact@getthryve.app for help. Removing saved context also removes the associated personalised thoughts from that mix, which then uses curated content. This does not automatically remove the mix's name or preferences, or messages you separately saved to favourites or custom categories. You can remove those items separately or request deletion of context and associated generated content across your account without deleting the account itself. Sections 5 and 10 explain retention and deletion limits.

Cookies, device storage and analytics choices

The App uses local storage for account/onboarding state, settings, guest identity, authentication information and push-device association. Personal Mix editing state and server-query caches are held in app memory in the reviewed implementation; saved mixes are stored on the backend. Storage strictly necessary for a feature you request does not require optional analytics consent.

Firebase Analytics is deactivated in the updated App, including automatic collection. Older installed versions may continue collecting until updated, and the change does not delete historical data. The website separately uses Google Analytics for usage measurement and may store cookies or similar identifiers. Website analytics stays off until you choose “Allow analytics”. You can change or withdraw this choice at any time through “Cookie settings” at the bottom of any page. Choosing “No thanks” stops further analytics collection and removes this website’s analytics cookies. Your choice is stored locally in this browser; clearing browser storage resets it. Accepting the Terms is not analytics consent. The App does not enable session replay.

The website also processes connection information to serve the pages you request and protect availability, on our legitimate interests under Article 6(1)(f). Any optional device storage/access remains subject to the consent rule above. External font delivery requires its own necessity and rights assessment; it is not covered by accepting the Terms.

5. Retention

The technical, analytics, hosting, support and feedback records above may remain after automatic App account deletion. You can contact us to request their erasure or information about records relating to you, as explained in sections 9 and 10. Legal limits on retaining personal data and your applicable erasure rights continue to apply, including to records without automatic expiry.

We do not maintain separate manually created backups. The reminder database is configured for AWS point-in-time recovery, which maintains automatic recovery copies for a rolling 35-day period under its default setting. Deleting active data does not immediately remove it from that recovery history. Providers may also hold residual copies subject to their applicable deletion arrangements. Section 10 explains how to request deletion.

6. Hosting and International Transfers

Our application hosting is in the European Union. Personal Mix AI uses an EU processing profile that can route requests to AWS regions in Germany, Sweden, Italy, Spain, Ireland and France.

The providers listed in section 3 may also process data or allow access from outside the European Economic Area. Where this constitutes an international transfer, GDPR safeguards are required, such as an applicable adequacy decision or Standard Contractual Clauses with any necessary additional measures. You can contact us for information about the arrangements applicable to your data and a copy of the relevant safeguards.

7. Security

We use account and guest access controls, checks that data belongs to the requesting user, encrypted connections and server-side access and usage limits. AI draft records are encrypted at rest. Operational AI logs use selected technical information rather than intentionally recording raw context.

The Service is not end-to-end encrypted: our backend and the providers carrying out the relevant operation process readable content. No system can guarantee absolute security.

8. Children

Thryve is intended for users aged 13 and above, subject to any higher minimum age required by applicable law. Where optional data processing requires consent, parental consent or authorisation may be required depending on the user’s age and applicable law.

If you believe a child is using Thryve without meeting the applicable requirements, please contact us at contact@getthryve.app. We will assess the situation and stop or erase unlawful processing as required. Any identity or parental-authorisation checks will be proportionate; we do not routinely require copies of identity documents.

9. Your Rights

Subject to the conditions in the GDPR, you may request access and a copy of your data, rectification, erasure, restriction and portability. For contract- or consent-based automated processing, portability covers the data you provided where Article 20 applies; it does not necessarily cover every inference or generated item. Other access rights may still apply to those items.

You may object, on grounds relating to your situation, to processing based on legitimate interests. We must stop unless we establish overriding compelling legitimate grounds or processing is necessary for legal claims. If direct marketing is introduced, you have an unconditional right to object to that use; consent for it cannot be inferred from enabling reminders.

Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Section 4 explains analytics choices and, separately, how to remove Personal Mix context. To exercise rights, email us or use the deletion contact route. We may ask for only the information reasonably needed to verify identity and locate data; for guest use, retaining access to the original device can help. We respond without undue delay and ordinarily within one month of receiving the request. Where GDPR permits an extension of up to two further months, we will explain the extension and reasons within the first month. Requests are ordinarily free of charge, subject to the narrow statutory exceptions.

You may complain to the Romanian Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) at dataprotection.ro, or to the competent supervisory authority in particular where you live, work or consider an infringement occurred. You also retain judicial remedies.

10. Account and Data Deletion

You can use account deletion in the App, our deletion page, or email contact@getthryve.app. Guests can delete their mixes and reminders and contact us for help locating other data linked to their guest identity.

Account deletion is processed on our servers and can resume after an interruption without requiring the App to remain open. It removes reminders, push-device associations, favourites, all custom categories and their saved items, saved mixes, temporary AI drafts, and the application and sign-in account records. This includes generated messages you separately saved in favourites or custom categories.

Other records, including provider logs, support correspondence and feedback, are handled separately under sections 5 and 9. An account-wide erasure request also covers relevant personal data in those records, subject to lawful retention exceptions. We remain responsible for handling the request, including any necessary instructions to providers acting on our behalf. Contact us if deletion fails or appears incomplete.

Deleting your account does not cancel an Apple or Google subscription or retract notifications already delivered to your devices. Notifications already handed to a delivery provider may still arrive; we cannot recall them from the provider or your device. Uninstalling the App or signing out does not erase server data.

Some temporary records remain for the periods in section 5. Specific legal obligations or claims may justify limited further retention. Apple and Google may separately retain store records for their own legal obligations. Removing one mix's context does not automatically delete the rest of your account; you may also request deletion of context and associated generated content across your account, or deletion of the account itself.

11. Contact

Maverick Bits S.R.L. · CUI 46518982
Email: contact@getthryve.app
Registered office: Slatinei Street 21, building PB47, apartment 16, Oradea, Bihor County, 410297, Romania.

12. Changes to This Notice

We will keep this notice and its version/effective date up to date. Material changes will be brought to your attention in the App or through an appropriate service communication and on the website, normally at least 30 days in advance. Where the law requires earlier information, we will provide it before the relevant new processing begins. We will seek fresh consent if a change requires it. Continued use does not constitute consent to a new purpose.