Privacy

Updated 10 October 2026

When you share a project from Thraft, the Thraft app on your Mac sends it to the Thraft server at thraft.app, which older versions of the app reach as plano.sh. The app also sends the server a few anonymous usage counts when they change, a few times a day at most, which you can turn off. When you visit this website, the server keeps one line about each request your browser makes, with no IP address and no cookie. This page says what that server keeps, where, for how long, who can read it, and how you delete it. Apart from those counts, everything you don't share stays on your Mac.

What the server stores

Four things, and nothing else:

• Your account. Your GitHub user ID, login, display name, and avatar address, as GitHub reports them when you sign in. For each Mac you sign in from, the server keeps the Mac's name and a one-way hash of the token it gave that Mac. The token itself is never stored, and neither is your GitHub token.
• The projects you share. The plans, their blocks and revisions, the board, and the records, as the app sends them. Each project is its own file.
• Daily usage counts. One row a day for each install of Thraft. A row holds a random ID the app made for that install, the Thraft and macOS versions, how many days after the install that day was, which milestones the install had reached by that day, such as marking a plan ready or completing one, whether the install marked itself as one of Thraft's own, and how many times it did each of a few things that day, such as landing an agent turn or creating a plan. The app sends a day again when its counts change, and the server replaces that day's row. A row from an older version of Thraft holds which first-run steps the install had reached, in place of the milestones. To limit how often an install sends, the server also keeps how many times each install sent today, and drops that number the next day. A row never holds your name, your login, a project, a plan's title or number, a folder path, your IP address, or anything you wrote, and it is never joined to your account. To stop sending the counts, turn off Send anonymous usage counts on the Settings page in Thraft.
• The site log. One line for each request to this website. A line holds the time, the method, the path of the page, the status of the answer, the browser's user agent, and the name of the site the visit came from, such as example.com, and never the page on that site or its query string. From the page's own address, a line keeps the source tag that a shared link carries, and no other part of the query string. A line holds no IP address and no cookie, so the log can't tell one visitor from another. The site sets no cookie and runs no script to count visits. What the Thraft app sends to the server isn't in this log.

The server's logs record what kind of request came in, which project and account it was for, its size, how long it took, and how it ended. They never record a token, a login, a display name, or anything you wrote.

The waitlist

When you join the waitlist at thraft.app/waitlist, the form sends your GitHub username, your email, your team's size, and your role to Tally, the form service that holds the form. Your answers are kept by Tally, not on the Thraft server. Tally's own privacy policy covers how it stores them. Miguel Carvalho and Pedro Gonçalves read them to send invites, and nobody else does.

Where it is stored

On one server in Hetzner's data center in Falkenstein, Germany. Your account, the projects you share, and the usage counts are on an encrypted disk on that server. The bucket's backups are copies of those three, kept in one encrypted storage bucket in the same location. The site log and the server's logs are on the server's own disk, outside the encrypted disk, and aren't in that bucket. Hetzner also makes disk backups, which are copies of the whole server and aren't in the bucket either.

How long it is kept

A project stays on the server until its owner deletes it. After that, copies remain in the bucket's backups for up to thirty days and are then removed for good.

A usage row is kept for one year and then deleted. Copies remain in the bucket's backups for up to thirty days after that.

A line of the site log, and a line of the server's logs, is kept at most two weeks on the server. A disk backup holds a copy of both logs as they were on its day, and each disk backup is kept for seven days.

Who can read it

The members of a project, and the two people who look after the server: Miguel Carvalho, who runs it, and Pedro Gonçalves, who can open it when Miguel can't. Nobody else. The server doesn't sell or share your data. The usage counts are read only as totals over a week or over four weeks, such as how many installs wrote to a plan that week. The server also counts activity in workspaces, from the projects it already stores, as weekly totals: how many workspaces a member wrote in, how many two or more members wrote in, how many documents two or more members wrote, how many asks were filed, and how many cases were settled. These totals name no workspace, no project, and no person. The same two people read the site log, as daily counts: page views, views of the waitlist, the sites visits came from, and the tags shared links carried.

How deletion works

When the owner deletes a project in Thraft, the server removes it at once. The bucket's backups age out within thirty days and the disk backups within seven days, after which no copy remains.