Ultrathink runs on Google Cloud, through Firebase. This page sets out how your account and what you save are looked after. The privacy policy covers what we keep and who else handles it.
Where your data lives
- Firestore holds your entries and settings.
- Firebase Storage holds your screenshots, files and recordings.
- Cloud Functions run the AI, search and saving.
- Firebase Authentication handles signing in.
- Firebase Hosting serves the website and the web app.
Google Cloud encrypts data at rest with AES-256, and every connection between your browser, the extension, the desktop app and our servers uses TLS. Firebase is covered by Google Cloud’s SOC 1, SOC 2 and ISO 27001 certifications.
Signing in
You sign in with your email address and a password. Passwords are never stored as plain text.
Passwords need:
- at least 8 characters
- an upper case letter, a lower case letter and a number
The sign-up form shows how strong your password is as you type, and turns away passwords on a list of over 100 common ones, such as “password123”.
New accounts confirm their email address before they can use the app. Forgotten your password? Use the link on the sign-in page and we’ll email you a reset link.
Limits on repeated attempts
- Sign in: 10 failed attempts in 15 minutes, then a 30 minute wait.
- Sign up: 5 attempts an hour, then a 2 hour wait.
- Password reset: 5 attempts in 15 minutes, then a 30 minute wait.
Saving, searching and the AI have their own per-minute limits, and so do the API and the MCP server. reCAPTCHA v3 runs quietly in the background when you sign in, sign up or reset your password, to turn away bots.
Who can see your entries
- Your entries are private to your account unless you share them.
- An entry has one owner, and that never changes.
- If you join an organisation, you can share work entries with its members. They can read a shared entry but not edit it. You can make it private again at any time.
- I run Ultrathink, and I can open an account when that’s needed to give support.
Device keys
The browser extension, the desktop app, the MCP server and the API connect with a device key instead of your password.
- Each key is 32 random bytes, made in Settings, Device keys, and shown once.
- We store only a hash of each key. Settings lists your keys by name, never the key itself.
- Revoking a key stops it working straight away. Keys are revoked rather than deleted, so there’s a record of each one.
- API access is off until you switch it on for a key, and a read only key can’t save anything.
- The extension keeps its key in the browser’s extension storage. The desktop app keeps its key in your computer’s app data folder, so it isn’t copied to OneDrive or iCloud.
Your own OpenAI key
On the Free plan you can add your own OpenAI key. It’s checked with OpenAI before it’s saved, then kept on our server. It never reaches your browser: Settings shows only its last few characters.
When you sign out
Signing out clears what the app keeps on your device: your entries, settings and work plan, and anything cached. So the next person to use that browser sees nothing of yours.
Safe content
- Notes can hold formatting. Before a note is shown, anything that could run code, such as scripts, is stripped out.
- Everything you save is checked on the server first, with limits on length: 500 characters for a title, 50,000 for notes and for content, and 2,000 for a web address.
Payments
Stripe handles payments. Ultrathink never sees or stores your card number. Stripe’s keys are kept in Google’s Secret Manager, and every message from Stripe is checked to make sure it really came from Stripe.
Report a problem
To ask about security or report a vulnerability, email me@cmw.email.