Policy Update History | Vesperion Gate

This page records material policy revisions. Subscribe by email below, or to the feed, to be notified of changes, including notice of new or replacement subprocessors under the Data Processing Addendum. Where the law requires a specific notice or fresh consent, we provide it separately.

October 29, 2026

Removed Expo from the provider register. We deleted the update service that the retired 1.x Thicket iOS app checked, so Expo no longer provides a service for any of our products.
Archived the preceding provider register below.

October 23, 2026

Clarified the Privacy Policy's AI-training commitment: it concerns our use of Thicket content and providers processing it for us. Assistants customers connect remain governed by their own provider agreements and settings.
Corrected deletion wording to reflect that some content can be permanently deleted without a Trash recovery period. Simplified the connection and permission explanation, clarified that duplicate-action records can contain saved results, and linked backup retention to the provider register. These edits do not change product behavior, data collection or retention periods.
Clarified the provider register's distinction between providers acting for us and apps customers connect. No provider was added or removed.
Archived the preceding Privacy Policy and provider register below.

October 22, 2026

Rewrote the Privacy Policy into a shorter shape: what we collect and why, when we access or disclose your information (including apps and AI assistants you connect through OAuth, an API token or the command-line tool, the Read-only or Full access you approve, and what revoking does), artificial intelligence, your rights, security, deletion, retention, location and transfers. Nothing changed in what we collect, who receives it or how long we keep it.
Revised the Terms of Service: account responsibility now names agents and bots; the API, command-line tool and connector terms are shorter; the terms link the new status page, Security Response and Copyright Infringement Claims pages. The rule against card data, health records, government identifiers and secrets in connector content moved to Thicket's connection help; it remains in the Data Processing Addendum's Annex A.
The provider register now shows the country of each provider we contract with, and lists Anthropic and OpenAI as the AI assistant tools our staff use. Customer content, support correspondence and production records stay out of those tools, as before.
The Data Processing Addendum is available as a PDF and as Markdown, and subprocessor notices now reach subscribers by email or feed.
New pages: Security Response, Copyright Infringement Claims and the status page. Policy updates can be followed by email from this page.
Reworded the Thicket examples in the Refund Policy and the ownership rules in the Account Ownership Policy; what we refund, and who owns an account, did not change.
Archived the preceding Privacy Policy, Terms, Data Processing Addendum, provider register, Refund Policy and Account Ownership Policy below.

October 19, 2026

Thicket no longer sends push notifications through Expo. Notifications to the Thicket iPhone app now go directly through Apple Push Notification service, already listed with Apple in the provider register. Expo stays listed only for the update checks of the retired 1.x Thicket iOS app, which receive technical request information and no push tokens or notification content.
Archived the preceding provider register below.

September 28, 2026

Notice of a new subprocessor: LensCherry may use OpenAI's API for image generation and editing, alongside or instead of Google's Gemini API. OpenAI is added to the provider register as announced and not yet in use, and LensCherry will send it no customer content before October 14, 2026. Under the Data Processing Addendum, you may object by writing to [email protected] within ten business days of this notice. The Privacy Policy now describes the planned use and OpenAI's training and retention terms.
Archived the preceding Privacy Policy and provider register below.

September 9, 2026

Added Plausible Insights OÜ to the provider register before enabling public website analytics for Thicket. The Privacy Policy now describes the public page and signup-page measurements, EU processing, and the exclusion of private workspace data, account identities, form contents and customer conversion events.
Archived the preceding Privacy Policy and provider register below.

September 8, 2026

Updated the Data Processing Addendum's subprocessor process: current providers are listed in the provider register, notice of a new or replacement provider is posted here before it processes customer data, subscribers to the policy updates feed are notified, an objection may be raised within ten business days, and if the concern cannot be resolved within thirty days the affected service may be ended with a refund of prepaid fees for the remainder of the term.
Revised the Terms of Service liability section while preserving rights the law does not allow us to exclude.
Replaced the account-email notice wording in the Privacy Policy and Terms with the update history and feed, and added the feed.
Thicket and LensCherry signup alerts to our operations chat no longer include any personal information: only the sign-in method, the time and a link to our administration console. The Telegram disclosure added on September 4 is retired from the Privacy Policy and the provider register.
Named the AI assistant tools our staff use (Anthropic's Claude, OpenAI's ChatGPT and Codex), how training on our conversations is disabled and the providers' exceptions, and why these tools are not subprocessors: customer content and personal data stay out of them.
Archived the September 4 Data Processing Addendum and Terms text below.

September 4, 2026

Explained data shared with customer-selected AI tools through APIs, CLI tools, MCP, and agent members, including current access boundaries and the limits of disconnecting.
Separated customer-selected tools, LensCherry's built-in AI processing, and the approval requirements for staff AI use.
Added a provider register and Data Processing Addendum.
Corrected an omission in the provider register: existing Thicket and LensCherry signup alerts send contact details to a private Telegram operations chat. Disclosed the information sent and that account closure does not automatically remove those messages. This is a correction to the description of existing processing.
Corrected storage locations following the completed move to US object storage and backups. Removed the monthly and annual database tier, shortened ordinary customer-content recovery backups to 28 days, and aligned operations with deletion from ordinary recovery backups within 60 days of account closure.
Disclosed MCP audit and duplicate-action records, provider retention, and the distinction between account-content deletion and other necessary records.
Allowed supported automation explicitly. Limited LensCherry image terms to the relevant features and replaced the perpetual promotional content license with permissions needed to provide the service.
Updated LensCherry billing descriptions for one-time credit packs while preserving the earlier subscription guarantee. Clarified account ownership and separate provider billing.

Current documents: Privacy, Terms, Data Processing Addendum, Service Providers and Subprocessors, Cancellation, Refunds, Account Ownership, and Copyright Infringement Claims.

Previous published versions

These archived text copies preserve the policy wording that preceded this revision. They contain historical information and are not the current policies.

Questions about a revision or a notice: [email protected].