Last updated 30 July 2026
This service ("Think 2 Win Performance", "we", "us") is operated by Think 2 Win Performance Ltd, a company registered in England and Wales (company number 14954303), registered address 167 - 169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom. We are the data controller for individuals who subscribe directly. Where your access is provided by your university, school, club, or employer, that institution is the data controller and we act as their processor.
ICO registration number: ZC186928. Privacy contact: privacy@think2win.co.uk.
We store: your email; your name (if you give it); an encrypted password (handled by our authentication provider, we never see it); your access/entitlement and subscription status; billing identifiers from our payment provider (we never store your card details); and standard technical logs including your IP address.
Device limit. To stop an account being shared beyond the devices a subscription or seat allows, we keep a small record for each device you sign in on: a random identifier we generate (not a hardware id), the date it was last active, and your browser and device type. We use this only to enforce the device limit. You can sign a device out at any time, and the record is deleted when you do or when your account closes.
We do not store your written work. The answers you type into worksheets and reflection boxes, and the record of which steps you have completed, are saved only on your own device. The one exception is any text you choose to submit to an optional AI feature, which is sent to our AI provider to generate that response (see below). We use no advertising trackers and no third-party analytics.
Notifications are the one exception, and only if you turn them on (available on eligible adult accounts, never on under-18 or school-provisioned seats). While notifications are on we hold a minimal reminder record, a device subscription plus a streak count, your last active day, any upcoming event date, and your timezone, so we can time a nudge. It holds no answers, scores, or event names, and it is deleted the moment you turn notifications off. To deliver a reminder it is encrypted and passed to your browser's push service (Apple, Google or Mozilla), which relays it without being able to read it.
Opt-in AI features are the exception. Some tools can send a small amount of what you are working on to an AI provider to generate a response, but only when you choose to use them (you tap a button each time, and you can always ignore them):
This text is processed to give you an answer and is not stored by us: we do not keep your reframes, reflections, goals, plans or profiles. Under our agreements with these providers, your inputs are not used to train their AI models. Every one of these features is optional; if you never use them, nothing you write ever leaves your device.
We use trusted providers who process data on our behalf under contract. Supabase (accounts and database). Provided by Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, with Supabase, Inc. of the United States in the same group. Stripe (payments). Provided by Stripe Payments Europe, Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, D01 C4E0, Ireland, with Stripe Payments UK Ltd, 9th Floor, 107 Cheapside, London EC2V 6DN, as an additional party for regulated payment services, and Stripe, LLC of the United States in the same group. Cloudflare Pages (hosting). Provided by Cloudflare, Inc, 101 Townsend Street, San Francisco, California 94107, United States. If you use the optional AI features described in section 2, Anthropic (the Claude AI) processes the specific text you send to generate a response. Provided by Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, with Anthropic PBC of San Francisco in the same group. ElevenLabs processes the few words needed for the See It natural voice. Provided by Eleven Labs Inc, 169 Madison Avenue #2484, New York, New York 10016, United States. Both act as our processors and neither is used unless you choose the feature. If you choose to book a 1:1 session, Calendly handles the scheduling and any booking payment; the details you enter to book go to Calendly and to us, and are not stored by the app itself. Provided by Calendly LLC, 115 East Main Street, Suite A1B, Buford, Georgia 30518, United States. If you turn on notifications, your browser's push service (Apple, Google or Mozilla) receives an encrypted message for delivery to your browser and is not given an account, a name, or any content. The fonts and code libraries the app needs are served from our own site, so no third-party content-delivery network receives your data. If you contact us through the website enquiry form, we process the name, email and message you provide in order to reply, on the basis of our legitimate interest in responding to enquiries, and we keep it for up to 12 months. We do not sell your data.
Supabase stores your account data in the United Kingdom, but we contract with Supabase through a Singapore company that has a group company in the United States, so access from outside the United Kingdom is itself a transfer. For that reason our agreement with Supabase is made under the European Standard Contractual Clauses as modified by the United Kingdom International Data Transfer Addendum, and storing the data here does not by itself remove the transfer, so we rely on those clauses rather than on the storage location. Some of our other providers also operate outside the United Kingdom. Stripe and Anthropic contract with us through Irish companies, so those are not transfers to the United States at the contracting layer, and both are covered by the European Standard Contractual Clauses as modified by the United Kingdom International Data Transfer Addendum. Cloudflare and Calendly are United States companies covered by those same clauses, and both are also certified under the United Kingdom extension to the EU to US Data Privacy Framework. ElevenLabs is a United States company covered by those clauses only, and is not certified under the Data Privacy Framework. Where you turn notifications on, the message is delivered by the push service built into your browser, run by Apple, Google or Mozilla depending on the browser you use, and only the generic text described above is sent. The contracting entity and registered address for each provider is listed with that provider above.
Account data: while your account is active, then deleted within 90 days of closure. Billing/tax records: 6 years. Logs: a short period for security. AI feature inputs (section 2): processed to generate your response and not retained by us; our providers may hold them briefly for security under their own terms. Push subscription and nudge state (if you enable notifications): kept only while notifications are on, and deleted when you turn them off. On-device answers: controlled entirely by you, and you can clear them any time in your browser.
You can access, correct, delete, restrict, or object to our use of your data, ask for portability, and withdraw consent. Contact privacy@think2win.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk). If your access was provided by an institution, please direct requests to them as the controller.
Your account is protected by your password and industry-standard authentication. Our database enforces per-user isolation so you can only reach your own records. Payment data is handled solely by Stripe.
The Executive Space is for adults. The Athlete Space is intended for people aged 13 and over, and is not intended for children under 13. It may be provided to pupils aged 13 to 18 through their school, in which case the school is the controller and handles the appropriate consents. It may also be set up by a parent or guardian for an athlete aged 13 to 17: in that case the parent or guardian is the account holder and provides consent on the child's behalf. As with every account, the athlete's worksheet answers and reflections are stored on their own device, not on our systems. The optional AI features are available on these accounts: if the athlete chooses to use one, the specific text they submit is sent to our AI provider for that request, as described above. A school can ask us in writing to turn the AI features off for its group, including all users under 18. Notifications are not offered to under-18 accounts or to school-provisioned seats at all, so no device token or reminder record is ever held for a child.
We may update this policy; the "last updated" date shows when. Material changes will be notified in the app.