WorldThought
Effective August 18, 2026
WorldThought (operated by Mebley, Inc., "we," "us," or "our") is built with privacy as a core principle. Thoughts are displayed anonymously - your name and email are never shown next to content you post. This policy explains what data we collect, why, and how we protect it.
We collect the following: • Email address - used only for authentication via one-time code. Stored securely by our authentication provider (Supabase). • Display name - chosen by you during sign-up. Visible only in your Settings profile, never on your posts. • Thought & reply content - the text you post, stored in association with your user ID but displayed without any identifying information. • Country of posting - the country name derived from your location at the time of posting, verified on your device and independently re-verified by our server. Your precise coordinates are transmitted for that one-time verification but are never stored - only the resulting country name is.
Location permission is requested only when you initiate a post. Your device takes a one-time GPS fix and reverse-geocodes it to a country name locally, which is used to enable the post button. Before your post is saved, our server independently re-verifies your location: your coordinates are sent to our backend and reverse-geocoded again there (via the third-party service described below) to confirm they actually fall inside the country you're posting to. This server-side check exists so a modified app can't bypass the on-device check and post claiming to be somewhere it isn't. Your coordinates are used only for that one verification and are discarded immediately after - only the resulting country name is stored. Location data is not used for advertising, analytics, or any purpose beyond this verification.
Your data is used to: • Authenticate your identity via email OTP. • Associate your posts with your account for moderation purposes. • Display your name to you in the Settings screen. • Enforce the one-thought-per-country-per-window system. We do not sell your data. We do not use your data for advertising targeting. We do not build behavioral profiles.
Your data is stored on Supabase infrastructure, which is hosted on AWS. Data at rest is encrypted. Data in transit uses TLS. We apply row-level security policies in our database to ensure users can only access data they are permitted to see.
Our infrastructure may process and store your data in a country other than the one you're in. Where required by law, we rely on appropriate safeguards, such as Standard Contractual Clauses, for any international transfer of personal data.
Thoughts and replies are retained for as long as the service is active. When a thought's 8-hour window expires, it is no longer visible in the app, but may remain in our database for safety and moderation purposes. You may request deletion of your account and all associated data by contacting us at hello@worldthought.app.
Depending on your jurisdiction, you may have rights over the personal data we hold about you, including the right to access, correct, delete, restrict, or receive a copy of your data (data portability), and the right to object to certain processing. To exercise any of these rights, email us at hello@worldthought.app. We will respond within 30 days. If you are in the EU, EEA, or UK, you also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data properly.
WorldThought's website and web viewer do not set cookies or local storage of their own beyond what's needed for the page to function. Where PostHog analytics is active (see Third-Party Services below), it sets its own cookies and browser local storage to distinguish visitors and sessions. You can clear cookies and local storage through your browser settings at any time. The iOS and Android apps do not use cookies.
WorldThought uses the following third-party services: • Supabase - database, authentication, and storage. Their privacy policy is available at supabase.com/privacy. • Your device's system location services - used for the initial on-device check before you're allowed to post (Apple's CLGeocoder on iOS, Android's Geocoder API on Android). This relies on your device's own location backend, which on some devices may involve its manufacturer (e.g. Google on Android) under their own privacy policy, not ours. • Nominatim (OpenStreetMap) - used server-side to independently re-verify your location at the moment you post. Your coordinates are sent to Nominatim only for that one lookup and are not stored by us afterward. Their privacy policy is available at osmfoundation.org/wiki/Privacy_Policy. • PostHog - product analytics, used only on our website (worldthought.app) and web viewer (the browser-based globe) to understand how those pages are used, such as page views and general engagement. This may include your approximate location (derived from IP address), device and browser type, and pages visited. Their privacy policy is available at posthog.com/privacy. PostHog is not integrated into the iOS or Android apps. The apps themselves do not include any analytics or tracking SDKs, and we do not use third-party advertising SDKs anywhere.
WorldThought is not directed at children under 13 (or under 16 in applicable jurisdictions). We do not knowingly collect personal data from children below the minimum age. If you believe a child has provided us their data, contact us immediately and we will delete it.
We may update this Privacy Policy from time to time. The effective date at the top of this document will reflect when the latest version was published. We encourage you to review this policy periodically.
Questions? Reach us at hello@worldthought.app