TheoryOS Privacy Policy

Last updated: 16 October 2026

The short version

TheoryOS is a tool designed to help students, founders, and leaders build and pressure-test theories of value. To do that, we need to know who you are and we need to store what you write.

• Your name and email are held by our login provider, Clerk. Our own database never stores them — only an anonymous ID.
• The theory you write is stored so you can come back to it, and is sent to Anthropic's Claude when you ask for a suggestion or a stress test.
• If you're using TheoryOS for a course, your instructor can see the theories you tag to their assignments and when you submitted them, and whether you have used the other modules on them — how many Counter View sessions, whether a deck was built, how many pitches you practiced — but never what you wrote or said in them.
• Sign-in is email and password only. There is no social login, so no third-party account provider is told when or whether you use TheoryOS.
• Clerk records each sign-in — the IP address, the device, and the city and country associated with your IP address. This is security information, and it is the only record of your location information.
• In one course, a team can choose to record a conversation and get a written summary back. Nobody is identified in it, and neither the audio nor the transcript is kept — only the summary.
• If you build a deck in Presentation Prep, we keep the deck and up to five earlier versions of it, so building it again never loses the one before. You can bring an earlier version back; they go when the theory or your account is deleted.
• If you practice a pitch in Presentation Prep, we keep the written transcript and the feedback so you can compare one attempt to the next. The audio is not kept. Nobody else sees the transcript or the feedback — not your collaborators, not your instructor — and you can delete any attempt at any time. We don't read them except to run the feature or at your request.
• In the Strategic Leadership course, you can upload a presentation you made yourself. We store the file; you, anyone you have added to the theory, your course's faculty, and your cohort's client executive, if one is appointed, can open it. The client executive gets it without your name on the file or in its properties; anything written on the slides themselves is shown as written. Delete it whenever you like. Building a deck with Presentation Prep is available only where your instructor has switched it on for your section; uploading does not depend on that.
• We run no analytics, no advertising, and no tracking of our own. We don't sell your data.

1. Who we are

TheoryOS is operated by Theory First Group, LLC ("we", "us").

For privacy questions, contact hello@theoryfirstgroup.com.

If you're using TheoryOS as part of a course at a university or other institution, please see Section 10 — your institution has its own responsibilities for your data, alongside ours.

2. What we collect

Information you give us

Your account. When you sign up, our login provider Clerk collects your name and email address, and you choose a password. Email and password is the only way to sign in — there is no "sign in with Google" or other social login, so no third-party account provider is involved and none receives your data.

Our own database stores only the anonymous user ID that Clerk issues — a string like user_2abc.... Your name, email, and password are not copied into it.

What you write. Everything you enter while building a theory: your business idea, your contrarian belief, common beliefs, your core problem, sub-problems, your theory of value, and your planned actions. Plus the theory's title, and anything you write in Counter View or the Theory Tracker — notes, dates, outcomes, and the confidence scores you give a subproblem, which we keep as a history so you can see how they moved. On a theory you share, each person's confidence scores are shown with their name to the other people on that theory. Each revision of your theory's sentence made from the tracker, and each time it is marked as reviewed, is kept with who did it and the reason they gave. The customer evidence you record in the tracker — interviews, observations, data points, in your own words — is kept with who recorded it and shown to the other people on that theory. When you invite someone to a theory by email, we keep their address with the invitation until it is accepted, revoked, or expires after 30 days, and we send them one email saying who invited them and to what.

Tracker reminders. If you give an action a due date, or ask to be reminded to review your theory every week, two weeks or month, we email a daily digest of what is due to you and to the theory's editors; people you added as viewers get it only if they switch it on. Every reminder says how to switch it off, for one theory or for your whole account. We keep a record of which reminder went to whom, so we never send the same one twice; it is deleted with the theory or your account.

Feedback you give. If someone invites you to review their theory, what you write is stored with your name and shown to everyone who has access to that theory — its owner and anyone they have added. Feedback others give on your theory is shown to you the same way.

Course activity. If you join a course: which course and section, your role, which assignments you tagged theories to, the content of your submissions, the time of submission, whether it was late, and any extension your instructor granted. A course can have more than one instructor — the person who set it up and any colleague they add — and each of them sees the same. We also show your instructor whether you have used the other modules on a theory — how many Counter View sessions, whether a deck was built, how many pitches you practiced — but never what you wrote or said in them.

Access codes. If your institution or organization gives you an access code, we record which code you redeemed and when, and which organization's license it belongs to, so that your account holds the plan it paid for, for as long as it paid. We tell that organization how many of its codes have been redeemed — not who redeemed them. The record is deleted with your account.

In the Strategic Leadership course, the organization sponsoring your cohort may appoint a client executive. Where it does, that person can read what the cohort writes in the course — the problems identified, the problem chosen, whether you marked it as the organization's problem or one within your own work, the day the theory was started (the day only, never the time), the subproblems and conditions, the theory, the actions, the summaries of recorded discussions, and any presentation built with Presentation Prep or uploaded for the theory — but never your name or email, and never which pieces of work belong to the same person. Each theory is shown under a neutral letter once at least one problem has been named for it. A built deck is shown as its slides, without the cover that carries the presenter's name. An uploaded file is handed over under a plain file name with the author removed from the file's properties, where the file's format lets us; what you wrote on the slides themselves is shown as written, so a slide that names you names you to them. The course tells you on screen when a client executive has been appointed. In a small cohort, what you write may still be recognisable to someone who knows your work; write with that in mind.

Presentation Prep in the Strategic Leadership course. Building a deck and a script from your theory with Presentation Prep is available only where your instructor has switched it on for your section. It is off by default. When it is on, the text of your theory is sent to Claude to lay out the deck and write the script, as Section 4 describes; when it is off, nothing from your theory is sent anywhere for this purpose.

Presentations you upload. In the Strategic Leadership course, you can upload a presentation you made yourself — a PowerPoint or a PDF, up to 25 MB — instead of, or as well as, building one with Presentation Prep. Uploading does not depend on whether your instructor has switched the builder on. We store the file and the name you gave it. It can be opened by you, by anyone you have added to the theory, by the faculty of your course, and, where your cohort has a client executive, by that person, who gets it without your name on the file or in its properties; it is not sent to Claude or to any other provider. We don't open it except to run the feature or at your request. Delete it from the theory's summary or from Presentation Prep whenever you like; it also goes when the theory or your account is deleted.

Newsletter. If you sign up for the newsletter on our public site, we collect your email address and note which page you signed up from.

Information collected automatically

AI usage records. Each time you use AI Assist or a stress test we record which kind of assist it was, which step you were on, which model answered, how many tokens were used, and when. We do not store the text of the request or the response.

Sign-in records. Clerk, our login provider, keeps a record of each session: the IP address you connected from, your browser and device type, and the city and country it derives from your IP address.

Our own database does not store the IP address, browser and device type, or city name. The administrators' view of your account shows the connection country only, which we use to understand roughly where our users are; the fuller record, IP address included, lives in Clerk's own dashboard, which our administrators can also reach.

Discussion recordings. In the Strategic Leadership course, and only where the instructor has switched it on for the section, a team can opt in to record their discussion around problem identification and receive an AI summary of the problems they discussed. This feature is off by default, and a team chooses to press record each time, with the consent of everyone participating.

What happens to the recording: the audio is placed in private storage of ours for the minutes it takes to transcribe, from where AssemblyAI, a transcription service, reads it with speaker identification switched off, so the transcript does not say who said what. We delete the audio from our storage as soon as the transcript is back, and in any case within an hour. Our AssemblyAI account is opted out of their model-improvement program, so recordings are not used to train their models. Anthropic's Claude then writes the summary from the transcript: a short statement of each problem the team discussed, up to five, with a few lines of background on each. Anthropic does not use data submitted through its API to train its models. It does hold that text briefly: Anthropic deletes API inputs and outputs within 30 days, keeping them longer only where its usage policy or the law requires. As soon as the summary exists, we delete the transcript and the audio at AssemblyAI; we never store the transcript, and the audio is gone from our storage by then. The summary is all that is kept. Each problem it names is also added to your team's problem list, where you can edit it, rank it, or remove it like any problem you typed yourselves; from then on it is part of your theory and is kept with it.

If you are in a conversation that is being recorded, the person who started the recording has seen a summary of these terms on screen and has confirmed that everyone agreed before pressing the button. If you would rather not be recorded, please do not give your consent.

Pitch practice recordings. In Presentation Prep, you can record yourself giving your pitch and get written feedback on it. You are the only speaker, you opt in to recording each time, and a summary of the following terms appears on the screen above the button.

The audio is placed in private storage of ours for the minutes it takes to transcribe, from where AssemblyAI reads it with speaker identification switched off; we delete it from our storage as soon as the transcript is back, and in any case within an hour, and we delete their copy of the audio and the transcript as soon as we have the text. We then keep the transcript and the feedback so that you can compare your pitch attempts. Claude reads the transcript alongside your theory to write the feedback. Nobody else can see either: not people you share the theory with, not faculty, not an instructor. Your instructor can see that you practiced, and how many times, but not what you said. Delete any recording from that page whenever you like.

Server logs. Our host, Vercel, records standard request logs — IP address, browser type, pages requested, timestamps — for security and debugging.

We do not run analytics. No Google Analytics, no advertising pixels, no session recording, no cookies of our own beyond what login requires.

3. Why we use it, and our legal basis

4. Who we share it with

We don't sell your data and we don't share it for advertising. We use the following service providers, each of which processes data on our instructions:

About AssemblyAI. Used for the two recorders described in Section 2 — the discussion recorder and pitch practice. Speaker identification is switched off for both, so a transcript cannot attribute words to a person. For both, we delete the uploaded audio and AssemblyAI's copy of the transcript as soon as we have the text, rather than leaving them to AssemblyAI's default retention. What differs is only what we then keep: for a discussion, the summary and nothing else; for a practice pitch, the transcript and the feedback, visible to you alone. Our AssemblyAI account is opted out of their model-improvement program, so recordings are not used to train their models.

About Anthropic. When you use AI features, the text of your theory is sent to Claude. Your name, email, and account ID are not sent — the request carries the theory content and nothing that identifies you. Anthropic does not use data submitted through its API to train its models. It does hold that text briefly: Anthropic deletes API inputs and outputs within 30 days, keeping them longer only where its usage policy or the law requires.

About video. Lesson videos are embedded from Vimeo (and in some cases YouTube). When a page with a video loads, that provider receives your IP address and may set its own cookies. See Section 8. These are the only third parties that learn anything from your use of the product beyond the processors listed above.

Other disclosures. We may disclose information if the law requires it, or to protect our rights or someone's safety. If the business is ever sold or transferred, data would move with it, and we'd tell you first.

5. Where your data is stored

TheoryOS runs on infrastructure in the United States. Your coursework — the theories you write, your submissions, and your course enrollments — is stored in a database hosted in Oregon, United States. Our other providers (Clerk, Anthropic, Resend, Vercel) are also US-based.

If you're in the UK, the EU, or anywhere else outside the US, this means your personal data is transferred to and processed in the United States.

Every provider we use offers Standard Contractual Clauses (SCCs), which is the baseline safeguard for all of these transfers. Several are additionally certified under the EU–US Data Privacy Framework (DPF):

Read from each provider's published Data Processing Addendum in August 2026. Certifications can lapse, so this table is a point-in-time statement rather than a permanent one.

6. How long we keep it

• Your account and theories — until you delete them (including your Theory Tracker notes, confidence history and customer evidence, the theory's revision history, your reminder settings and the record of reminders sent, and any feedback written on the theory), or ask us to delete your account.
• Course records (enrollments, submissions, timestamps) — for the duration of the course and for as long as your institution's records policy requires. Your institution sets that period.
• AI usage records — 12 months from the date of the request. This is our own log that a request happened — which step, which model, how many tokens — not the text of it.
• Theory text sent to Claude — deleted by Anthropic within 30 days. We don't control that period; it is Anthropic's standard API retention, and it is separate from how long we keep your theory, which is until you delete it.
• Sign-in records — held by Clerk under its own retention policy and never copied into our database. Clerk prunes old sessions automatically; we do not set or control that period.
• Discussion recordings — the audio and transcript are deleted at AssemblyAI as soon as the summary is written, and are never stored by us. The summary, and the problems it names once they are in your problem list, are kept with the theory until the theory is deleted.
• Pitch practice recordings — the audio is never stored by us and is deleted at AssemblyAI as soon as the transcript exists. The transcript and the feedback are kept for twelve months, or until you delete the recording, the theory, or your account — whichever comes first. A daily job removes anything past twelve months.
• Uploaded presentations — until you delete the file, the theory, or your account, whichever comes first. Nothing deletes them by age. A daily job removes any file whose theory or account has already gone.
• Server logs — as retained by Vercel under its standard policy.
• Newsletter — we keep your email until you unsubscribe.

You can delete an individual theory yourself at any time. Deleting a theory that has already been submitted to your instructor does not withdraw the submission your instructor already holds.

7. Your rights

If you're in the UK or EEA you have the right to: get a copy of your data; correct it; have it deleted; restrict or object to how we use it; receive it in a portable format; and withdraw consent where consent is the basis.

Exercise any of these rights by emailing hello@theoryfirstgroup.com. We'll respond within one month.

If you're unhappy with our response, you can complain to your national data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk).

If your instructor holds a submission as part of your academic record, we may not be able to delete it at your request alone, and may need your institution’s permission. Please see Section 10 for further details.

8. Cookies

Essential cookies. Clerk sets cookies to keep you logged in. Without them, you can't use the product. These are strictly necessary and don't require consent.

Video. Lesson videos are embedded in each provider's no-tracking mode — Vimeo with Do Not Track enabled, YouTube via youtube-nocookie.com. Neither sets the cookies it would otherwise use to recognize you across sites.

Loading a video still reveals your IP address to the provider, and each may set a strictly-necessary cookie for security and bot protection.

We set no analytics or advertising cookies.

9. User Age Policy

TheoryOS is intended for university students and adult professionals. It is not directed at children, and we don't knowingly collect data from anyone under the age of 18. If you're under 18, please do not create an account.

10. Student Usage

When your institution enrolls you in a course on TheoryOS, the following two points apply:

• Your coursework and submissions may form part of your academic record. Your institution decides how long they're kept, who inside the institution can see them, and whether they can be deleted on request. In data protection terms, your institution is the controller for that material, and we act on the institution’s instructions. If you would like your coursework removed, please speak with your institution first — we'll act on their instruction.
• Your account itself — the fact that you have a TheoryOS login, and any theory you build outside a course — remains yours.

We also report to your institution how many people have joined each of its courses and, on request, who: your name, email, course, section and when you joined. This is so your institution can be invoiced for what it used and reconcile that against its own records. That report never includes the content of your theories or submissions; what your instructor sees of those is described in Section 2.

11. Changes

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. If we make material changes, we will notify you by updating the date at the top of this Policy and, where required by law, by providing additional notice (e.g., via email). We encourage you to review this Policy periodically.

12. Contact

If you have questions about this Privacy Policy, please contact us at hello@theoryfirstgroup.com.