Privacy Policy

This policy explains how ThumbMagic.app (“ThumbMagic”, “we”, “us”) handles personal data when you visit thumbmagic.app or use our service. We collect only what we need to run ThumbMagic, keep it secure and never sell it.

What we collect

• Account data: your email address, name and profile picture from sign-up or Google sign-in.
• Content: prompts, uploaded images (such as photos of your face or reference images) and the thumbnails you create.
• Billing data: subscription status and invoices. Card details are handled by our payment provider and never stored by us.
• Security data: IP address, approximate location (country, region, city) and browser type at sign-up and while you are signed in, used to prevent fraud and abuse of free credits.
• Usage data: pages visited, buttons clicked and how you found us (for example a search engine or an AI assistant). Identifiers such as an anonymous ID are only stored if you accept analytics cookies.

How we use it

• To provide the service: generate, edit, store and export your thumbnails.
• To manage your account, credits, trials and subscriptions.
• To keep ThumbMagic secure and prevent fraud and abuse.
• To understand which pages and features help creators, so we can improve them.
• To answer your messages and send essential service emails.

Our legal bases are the performance of our contract with you, our legitimate interest in running a secure service, your consent for analytics cookies, and legal obligations such as bookkeeping.

AI processing

To create and edit thumbnails, your prompts and the images you choose to use are sent to our AI provider (OpenAI) through its API. Data sent through the API is not used to train OpenAI's models. We do not use your uploads or thumbnails to train AI models either.

Service providers

We share data only with providers that help us run ThumbMagic, under data processing agreements:

• Clerk — sign-in and account management
• Supabase — database and file storage (United States)
• Vercel — hosting and content delivery
• OpenAI — image generation
• Stripe — payments and subscriptions

Some providers process data outside the EU/EEA. Where they do, transfers are protected by the EU Standard Contractual Clauses or an equivalent safeguard.

Cookies

• Necessary: sign-in session cookies set by Clerk, and tm_consent to remember your cookie choice.
• Analytics (only with consent): tm_aid, an anonymous ID (12 months), and tm_ft, how you first found us (90 days).

You can change your choice at any time by clearing cookies for thumbmagic.app in your browser.

How long we keep data

We keep account data and content for as long as your account exists. When you delete your account, we delete your content and personal data within 30 days, except where we must keep records such as invoices by law. Security and usage logs are kept for up to 12 months.

Your rights

You can ask to access, correct, export or delete your personal data, object to or restrict processing, and withdraw consent at any time. You can also lodge a complaint with your local data protection authority (in Sweden, IMY). To exercise your rights, contact us.

Children

ThumbMagic is not intended for children under 16, and we do not knowingly collect their data.

Changes

If we make important changes to this policy, we will update the date above and tell you in the app or by email.