Last reviewed September 4, 2026

Trust and security

When you put your work or your photos in our care, you should know where they go. Here is where we keep your data, how we protect it, and how to reach us with a concern.

Thicket

Thicket stores project content such as messages, to-dos, documents, files, schedule items, board cards, and chat messages.

Application and database: Dedicated infrastructure in Ashburn, Virginia, United States
Uploaded files: Cloudflare R2 in the United States, encrypted at rest
Backups: Automated daily backups stored separately in the United States
Access: HTTPS in transit; 2FA available; organizations can require 2FA
AI connections: Customer-selected tools can receive content through the API, CLI, or MCP under their own terms and settings. Read-only access also shares data
Model training: We do not use private Thicket customer content to train general-purpose AI models
Isolation: PostgreSQL Row Level Security supplements application-level authorization
Deletion: Active removal is scheduled after 30-day recovery; ordinary customer-content backups use a 28-day maximum window with no monthly or annual tier, and are scheduled for deletion within 60 days of closure

Other work

LensCherry

LensCherry processes reference photos to generate images requested by the account holder.

Reference and generated photos: Stored in Cloudflare R2 in the United States, with offsite file backups in Backblaze B2 in the United States
AI processing: Google Gemini API for requested generation, editing, and prompt assistance; Google Cloud Vision for image safety screening. Provider safety logs have separate retention
Model training: Vesperion Gate does not use uploaded photos or generated content to train general-purpose AI models
Deletion: Active removal is scheduled after 30-day recovery; ordinary customer-content backups use a 28-day maximum window with no monthly or annual tier, and are scheduled for deletion within 60 days of closure

How we protect both products

Encrypted connections

Public product traffic uses HTTPS. Uploaded files are stored with encryption at rest.

Restricted administration

Administrative access uses keys and a private network. Password login to servers is disabled.

Network protection

Cloudflare fronts public traffic. Firewalls deny connections that have not been explicitly allowed.

Data access

We access account content when needed to provide the service, address a support request, protect the service, or meet a legal obligation.

Privacy and reporting

We do not sell personal information. Product revenue, not advertising or data brokerage, funds the company.

See the provider register and Data Processing Addendum. For retention details and legal rights, read the Privacy Policy. To report a security issue, email [email protected].