What we can see, and what we cannot.

Last updated 7 October 2026

The short version

You run Thoria on your own servers, from a container image we publish. The work it captures, the questions it puts to your people, the answers they give and the records it seals stay on your infrastructure and never reach us. To judge that work and write its questions, your deployment sends the relevant excerpts to the model provider your organization has chosen, through your organization’s own cloud inference plan or enterprise subscription. We could not produce any of it if we were asked to, because we do not hold it.

There is no telemetry, no analytics on this site, and no account to create. The only personal information we hold is what you send us yourself, by writing to us or by requesting access.

What stays on your infrastructure

Everything the product exists to handle. Document content and revision history from the surfaces you connect. Agent transcripts and tool calls. The questions Thoria puts to a person about an agent’s execution, and the answers they give. The judgement of those answers. The sealed record itself, including the identity of the person who owns the work. Your users, your teams, your access controls.

None of this is transmitted to Thoria, Inc. There is no channel that carries it, no backup that reaches us, and no support mechanism by which we can request it. If you want our help diagnosing something, you decide what to send and you send it deliberately.

Model inference

To recognise which parts of the work are consequential, and to write the questions it puts to your people, Thoria uses a large language model. Your deployment calls that model through your organization’s own cloud inference plan or enterprise inference subscription, configured by your administrator. The excerpts it sends, the parts of the work being judged, go to that provider under your organization’s agreement with it, and that agreement governs how they are retained and whether they may be used for training. They do not pass through Thoria, Inc., and we have no access to them.

The browser extension

The extension watches Google Docs, Sheets and Slides, and the Artificial Intelligence assistants ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity and Grok, together with any address your organization adds through browser policy, an internal assistant, for instance. It does nothing on any other site.

What it reads depends on the surface. On document surfaces it reads no content at all: it reports only which document is open, and the Thoria server your organization runs retrieves the content itself through that platform’s own API, using the access your organization has already granted. On Artificial Intelligence chat surfaces there is no such API, so the page is the only place the exchange exists. There, the extension reads what you asked, the assistant’s answer, the reasoning steps the assistant displays, the web searches it ran and the pages it cited. It does not read an assistant’s own tools on your account, such as its memory of you or its record of your past conversations.

On chat surfaces, nothing you typed or read leaves your computer until you say it is work. Until you answer, the extension tells your server only that a conversation has begun on a given assistant, so that you can be asked; the conversation itself is held on your device, in the browser’s storage for the extension. If you say it is work, it is sent to your organization’s Thoria server. If you say it is not, it is deleted from your device and never sent. Work you have confirmed waits on your device only until your server has received it.

The extension transmits only to the Thoria server your organization runs, at the address your administrator configures or that you connect it to. It does not transmit to Thoria, Inc., and it does not transmit to any third party.

We do not sell or transfer this data. We do not use it for advertising, for credit assessment, or for training models. We do not use it for any purpose unrelated to the extension’s single function, because we never receive it.

This website

thoria.io runs no analytics and sets no advertising or tracking cookies. There is no account, and nothing you read here is recorded against you. Our hosting provider keeps standard server request logs, which include IP addresses and the pages requested, as any web server does. The one place the site collects anything is the access request form, described below.

When you request access

If you complete the access request form, we collect your name, work email address, organization, the size band you select, and anything you write in the note. We use it to answer you and to decide whether Thoria suits your organization. We do not use it for advertising, we do not sell it, and we do not add you to a mailing list.

Submissions are stored in a database hosted by Supabase, in the United States, and are sent to us by email through Resend. Both act as processors on our behalf. We keep a request for as long as the conversation is live, and for up to two years afterwards so that we know who has approached us. Ask us and we will delete it sooner.

If you write to us

We keep what you send us for as long as it takes to deal with it, and longer only where we are required to. We do not add you to a mailing list you did not ask for.

Who else is involved

A hosting provider for this website, and a registry from which you pull the container image. Neither receives your work, because we do not have it to give them. The model provider your organization configures receives the excerpts described under Model inference, under your organization’s agreement with it; Thoria, Inc. is not a party to that agreement.

Thoria, Inc. also runs one instance of Thoria for its own demonstrations and testing. It is not offered to customers and holds no customer work.

What is not here yet

Thoria does not currently process payments, and the software makes no licence or version check against our systems. When either changes, this page will change with it before the feature ships, and current customers will be told directly rather than left to notice.

Your rights

Depending on where you are, you may have rights to access, correct, export or delete personal information we hold about you. In our case that is limited to correspondence. For anything inside your own Thoria deployment, your organization is the controller and the request goes to them.

Changes

If we change what we collect, we will change this page and update the date at the top.

Contact

Mark Kakoma, Chief Executive Officer — mkakoma@thoria.io
James Burnham, Chief Operating Officer — jburnham@thoria.io