Privacy Policy

This Privacy Policy explains how we collect, use, and share information when you use Thumbformance (the “Service”).

Operator: Individual (Germany)

Contact: support@thumbformance.com

1. Information We Collect

A. Account Information

• Email address
• Name and profile image (if provided through Google sign-in)
• Authentication/session information needed to keep you signed in

B. User Content (Private by Default)

• Images, thumbnails, uploads, assets
• Editor projects and saved designs
• Text you provide in tools (titles, scripts, hooks, descriptions, tags, keywords, prompts, notes)

We treat uploads and projects as private by default and do not publicly display them unless you choose to share them through features we provide.

C. Usage and Analytics

We collect usage signals to operate and improve the Service, such as:

• feature usage, clicks, impressions, saves, searches, and similar events,
• basic log data (timestamps, IP address, device/browser info) for security and reliability.

D. Billing

If you subscribe, we store billing metadata such as:

• Stripe customer ID, subscription ID, plan/price identifiers,
• subscription status and renewal dates.

We do not store full payment card details. Payments are processed by Stripe.

E. Connected YouTube Channel Data

If you choose to connect your YouTube channel, we access and store data from YouTube API Services to power channel insights, including:

• channel and video details and statistics (such as titles, descriptions, view counts, and publish dates),
• channel analytics such as views, watch time, impressions, click-through rate, traffic sources, and the search terms viewers used to find your content,
• the OAuth access and refresh tokens needed to keep the connection active until you disconnect.

Section 6 explains how we handle YouTube and Google data.

2. How We Use Information

We use information to:

• provide the Service and its features,
• save and restore your projects and preferences,
• process requests you make (including generation features),
• manage credits, subscriptions, and account access,
• monitor for fraud, abuse, and security issues,
• improve performance, reliability, and user experience,
• provide support and communicate about the Service.

3. Legal Bases (GDPR)

If you are in the EEA/UK, we process personal data under:

• Contract (to provide the Service),
• Legitimate interests (security, analytics, improvement, fraud prevention),
• Consent (where required for non-essential cookies or similar tech),
• Legal obligation (tax/accounting/compliance where applicable).

4. Cookies and Similar Technologies

We use cookies and similar technologies in three categories:

• Strictly necessary — required to run the Service, so they are always active. These include your authentication and session cookies, a cookie that stores your cookie choices, a cookie that remembers UI preferences, and, if you arrive through a referral link, a referral-attribution cookie.
• Analytics (consent required) — help us understand how the Service is used so we can improve it.
• Marketing (consent required) — used to attribute referrals and affiliate sign-ups.

Analytics and marketing cookies are not set until you consent through our cookie banner. You can change or withdraw your choice at any time using the “Cookie settings” link in the footer.

5. Sharing and Service Providers

We share information only as needed to run the Service, with the following categories of service providers (sub-processors):

• Google LLC — sign-in and YouTube API Services (see section 6),
• Stripe — payments and subscription billing,
• MongoDB Atlas and our hosting provider — database and infrastructure,
• Resend — transactional email (sign-in links and service emails),
• UploadThing — file upload and storage,
• DataFast — privacy-oriented usage analytics,
• FirstPromoter — affiliate and referral attribution,
• Google (Gemini) and DeepSeek — AI generation and analysis, only when you use those features (see section 7),
• external data providers used for keyword and research features.

We do not sell your personal information.

6. YouTube API Services and Google

Thumbformance uses YouTube API Services. Certain features — such as connecting your channel and viewing performance insights — rely on these services.

What you authorize

When you connect your channel, Google asks you to grant read-only access to your YouTube data and analytics (the youtube.readonly and yt-analytics.readonly scopes). We do not request access to upload, edit, delete, or monetize your content.

What we access and store

Channel and video metadata and statistics; channel analytics (including views, watch time, impressions, click-through rate, traffic sources, and viewer search terms); and the OAuth access and refresh tokens required to keep the connection active. This data is used only to provide the features you request.

Google’s terms and privacy

By using these features you also agree to the YouTube Terms of Service. Google’s handling of your information is described in the Google Privacy Policy.

Limited Use

Thumbformance’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access

You can disconnect your channel in Thumbformance at any time, and you can revoke access directly from your Google account permissions. When you disconnect, we delete the stored tokens and connected channel data, subject to legal retention requirements.

7. AI and Automated Processing

When you use generation, editing, or analysis features, the inputs you provide — which may include titles, descriptions, transcripts, images, or other video content — are sent to third-party AI providers (Google Gemini and DeepSeek) to produce the output you requested. We send only what is needed to provide the feature.

Outputs may be generated by automated systems and may not be accurate. You control what you choose to publish or use.

8. Data Retention

We keep information as long as needed to:

• provide your account and saved projects,
• maintain service logs and security,
• comply with legal obligations.

You can request deletion of your account and associated content by contacting support@thumbformance.com, subject to legal retention requirements.

9. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export your data, and to object to or restrict certain processing. You may also withdraw consent where processing is based on consent.

To exercise rights, contact: support@thumbformance.com

10. Security

We use reasonable safeguards designed to protect data. No system can be guaranteed 100% secure.

11. International Use and Transfers

We operate from Germany and may use service providers that process data in other countries. Where required, we rely on appropriate safeguards for international transfers.

12. Children

The Service is not intended for children under 13 (or the minimum age required in your country). Do not use the Service if you do not meet the minimum age requirements.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date and may provide additional notice if changes are significant.