TheoryOS Privacy Policy
Last updated: 20 August 2026
The short version
TheoryOS is a tool for building and pressure-testing a business theory. To do that we need to know who you are and to store what you write.
- Your name and email are held by our login provider, Clerk. Our own database never stores them — only an anonymous ID.
- The theory you write is stored so you can come back to it, and is sent to Anthropic's Claude when you ask for a suggestion or a stress test.
- If you're using TheoryOS for a course, your instructor can see the theories you tag to their assignments and when you submitted them.
- Sign-in is email and password only. There is no social login, so no third-party account provider is told when or whether you use TheoryOS.
- We run no analytics, no advertising, and no tracking of our own. We don't sell your data. There is nobody to sell it to.
The rest of this page is the detail.
1. Who we are
TheoryOS is operated by Theory First Group, LLC ("we", "us").
Registered agent and address for legal correspondence:
Republic Registered Agent LLC 898 South State St, Ste 310 Orem, UT 84097 United States
For privacy questions, contact theoryfirstgroup@gmail.com.
If you're using TheoryOS as part of a course at a university or other institution, see section 10 — your institution has its own responsibilities for your data, alongside ours.
2. What we collect
Information you give us
Your account. When you sign up, our login provider Clerk collects your name and email address, and you choose a password. Email and password is the only way to sign in — there is no "sign in with Google" or other social login, so no third-party account provider is involved and none receives your data.
Worth being precise about: our own database stores only the anonymous user ID
that Clerk issues — a string like user_2abc.... Your name and email are not
copied into it.
What you write. Everything you enter while building a theory: your business idea, your contrarian belief, common beliefs, your core problem, sub-problems, your theory of value, and your planned actions. Plus the theory's title, and anything you write in Counter View.
Course activity. If you join a course: which course and section, your role, which assignments you tagged theories to, the exact content of each submission at the moment you submitted it, when you submitted, whether it was late, and any extension your instructor granted.
Newsletter. If you sign up for the newsletter on our public site, we collect your email address and which page you signed up from.
Information collected automatically
AI usage records. Each time you use AI Assist or a stress test we record which kind of assist it was, which step you were on, which model answered, how many tokens were used, and when. We deliberately do not store the text of the request or the response.
Server logs. Our host, Vercel, records standard request logs — IP address, browser type, pages requested, timestamps — for security and debugging.
We do not run analytics. No Google Analytics, no advertising pixels, no session recording, no cookies of our own beyond what login requires.
3. Why we use it, and our legal basis
| What we do | Why | Legal basis (UK/EU GDPR) |
|---|---|---|
| Run your account and save your theories | So the product works at all | Performance of a contract |
| Send your theory text to Claude for suggestions | It's the feature you asked for, at the moment you ask for it | Performance of a contract |
| Show your instructor your submissions | The course requires it, and you chose to join | Performance of a contract |
| Send transactional email (welcome, assignment, receipt) | To tell you things you need to know | Performance of a contract |
| Keep AI usage counts | Fair use limits and cost control | Legitimate interests |
| Keep server logs | Security, fraud prevention, debugging | Legitimate interests |
| Send the newsletter | You asked for it | Consent — withdraw any time |
4. Who we share it with
We don't sell your data and we don't share it for advertising. We use the following service providers, each of which processes data on our instructions:
| Provider | What it handles | Where |
|---|---|---|
| Clerk | Login; your name and email | United States |
| Supabase | The database: your theories, courses, submissions | United States (Oregon) |
| Anthropic | Claude — receives the theory text you ask it to work on | United States |
| Resend | Transactional email (welcome, assignments, receipts) | United States |
| Loops | Newsletter only — not used for course email | United States |
| Vercel | Hosting and server logs | United States |
| Vimeo / YouTube | Lesson video playback | United States |
About Anthropic. When you use AI Assist or a stress test, the text of your theory is sent to Claude. Your name, email and account ID are not sent — the request carries the theory content and nothing that identifies you. Anthropic does not use data submitted through its API to train its models.
About video. Lesson videos are embedded from Vimeo (and in some cases YouTube). When a page with a video loads, that provider receives your IP address and may set its own cookies. See section 8. These are the only third parties that learn anything from your use of the product beyond the processors listed above.
Other disclosures. We may disclose information if the law requires it, or to protect our rights or someone's safety. If the business is ever sold or transferred, data would move with it, and we'd tell you first.
5. Where your data is stored
TheoryOS runs on infrastructure in the United States. Your coursework — the theories you write, your submissions, and your course enrolments — is stored in a database hosted in Oregon, United States. Our other providers (Clerk, Anthropic, Resend, Vercel) are also US-based.
If you're in the UK, the EU, or anywhere else outside the US, this means your personal data is transferred to and processed in the United States.
Every provider we use offers Standard Contractual Clauses (SCCs), which is the baseline safeguard for all of these transfers. Several are additionally certified under the EU–US Data Privacy Framework (DPF):
| Provider | Transfer mechanism |
|---|---|
| Clerk | DPF, with SCCs as the fallback if DPF ceases to be valid |
| Supabase | SCCs |
| Anthropic | SCCs (Modules 2 and 3, plus UK and Swiss addenda) |
| Resend | SCCs, and DPF-certified |
| Vercel | SCCs, plus the UK International Data Transfer Addendum |
| Vimeo | DPF, reverting to SCCs if that certification lapses |
| Loops (newsletter only) | SCCs, and DPF-certified |
Read from each provider's published Data Processing Addendum in August 2026. Certifications can lapse, so this table is a point-in-time statement rather than a permanent one.
6. How long we keep it
- Your account and theories — until you delete them, or ask us to delete your account.
- Course records (enrolments, submissions, timestamps) — for the duration of the course and for as long as your institution's records policy requires. Your institution, not us, sets that period.
- AI usage records — 12 months from the date of the request.
- Server logs — as retained by Vercel under its standard policy.
- Newsletter — until you unsubscribe.
You can delete an individual theory yourself at any time. Deleting a theory that has already been submitted does not withdraw the submission your instructor already holds.
7. Your rights
If you're in the UK or EEA you have the right to: get a copy of your data; correct it; have it deleted; restrict or object to how we use it; receive it in a portable format; and withdraw consent where consent is the basis.
Exercise any of these by emailing theoryfirstgroup@gmail.com. We'll respond within one month.
If you're unhappy with our response you can complain to your national data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk).
One limit worth stating plainly: if your instructor holds a submission as part of your academic record, we may not be able to delete it at your request alone. That's a decision for your institution. See section 10.
8. Cookies
Essential cookies. Clerk sets cookies to keep you logged in. Without them you can't use the product. These are strictly necessary and don't require consent.
Video. Lesson videos are embedded in each provider's no-tracking mode —
Vimeo with Do Not Track enabled, YouTube via youtube-nocookie.com. Neither
sets the cookies it would otherwise use to recognise you across sites.
Loading a video still reveals your IP address to the provider, and each may set a strictly-necessary cookie for security and bot protection.
We set no analytics or advertising cookies.
9. Children
TheoryOS is intended for university students and adult professionals. It is not directed at children, and we don't knowingly collect data from anyone under 18. If you're under 18, please don't create an account.
10. If you're using TheoryOS through your university
When your institution enrols you in a course on TheoryOS, two things are true at once:
- Your coursework and submissions form part of your academic record. Your institution decides how long they're kept, who inside the institution can see them, and whether they can be deleted on request. In data protection terms your institution is the controller for that material and we act on its instructions.
- Your account itself — the fact that you have a TheoryOS login, and any theory you build outside a course — remains yours, and we're the controller for that.
For US institutions: submissions and grades are likely "education records" under FERPA. We handle them as a school official with a legitimate educational interest, under the institution's direction.
If you want your coursework removed, talk to your institution first — we'll act on their instruction.
11. Changes
If we make a material change we'll update the date at the top and, where the change matters, tell you by email.
12. Contact
theoryfirstgroup@gmail.com — or write to us at:
Theory First Group, LLC c/o Republic Registered Agent LLC 898 South State St, Ste 310 Orem, UT 84097 United States