Privacy policy

Who controls your information

The operator of Thumbnail Gods controls personal information processed for the website, accounts, subscriptions, product operations, and support. A workspace customer may separately control content it submits about other people.

Information we process

We process account and profile details; workspace membership and permissions; prompts, source links, uploads, likenesses, brand assets, generated media, editable documents, comments, and review activity; support messages; connected-integration data; product events; credit usage; billing records; device and browser information; approximate location from an IP address; logs; error reports; session data; and security signals. Stripe collects payment-card details rather than Thumbnail Gods storing them.

How and why we use information

We use information to provide requested workflows, authenticate users, administer workspaces, process payments, meter credits, deliver support, communicate service messages, maintain security, prevent fraud, diagnose errors, comply with law, and understand and improve product performance. We do not sell submitted media as personal information.

Legal bases

Where data-protection law requires a legal basis, we rely on performance of our contract to operate accounts and paid features; legitimate interests to secure, support, and improve the service; legal obligations for tax, accounting, fraud, and compliance records; and consent where required for optional technologies or communications.

Processors and integrations

We disclose only the information reasonably needed to providers supporting our operations, including Convex, OpenRouter and underlying model providers, Google, Supadata, Stripe, Resend, Vercel, Cloudflare, FingerprintJS, Bouncer, Sentry, Plausible, and integrations you choose to connect. Some providers may process information outside your country. Where required, we use recognized safeguards for international transfers.

Signup fraud prevention

At signup we process the network IP address and country supplied by Vercel, a browser-device identifier from the open-source FingerprintJS library, Cloudflare Turnstile results, and Bouncer email-deliverability signals to prevent automated registrations and repeated free-trial abuse. Raw signup IP and country remain with the account; keyed anti-abuse identity hashes may be retained without the account reference for 180 days after deletion.

Automated abuse controls

Automated signals may flag or restrict a signup, free trial, or suspicious request. These controls protect the service and do not make decisions about employment, credit, insurance, or similarly significant matters. You may contact support if you believe a restriction was applied incorrectly.

Retention and control

Raw source media becomes inaccessible after 30 days and is scheduled for deletion. Extracted frames, editable documents, and generated outputs in workspaces you own remain while your account is active, including in archived projects, and are removed through account deletion. Content you contributed to another owner's shared workspace remains with that workspace; your login and profile details are removed, and retained attribution is replaced with a generic deleted-user identity. Billing and security records may be retained where legally required.

Security

Private assets use short-lived signed access, integration tokens are encrypted, API keys are stored as hashes, and workspace roles limit access. No Internet service can guarantee absolute security.

Cookies and analytics

We use essential storage for authentication, security, billing, and locale preferences. We also use privacy-focused analytics to understand aggregate site and product use. Where consent is required, optional technologies are used only after consent is obtained.

Your rights and choices

Depending on where you live, you may request access, correction, deletion, restriction, objection, or portability of your personal information and may withdraw consent. Account settings let you revoke connected accounts, API keys, and review links, export supported account data, archive projects, and request account deletion. You may also complain to your local data-protection authority.

Children and changes

Thumbnail Gods is not directed to children who cannot legally consent to the processing of their information. We may update this Privacy Policy as the service or legal requirements change and will provide additional notice when a change materially affects how personal information is used.

Contact

Privacy questions can be sent to privacy@thumbnailgods.com.