Privacy Policy

Account information. Your name, email address and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name, email address and profile photo from Google — never your Google password.

Content you add. Prompts and chat messages, images you upload (including photos of people you add as characters), reference images, buckets, AI agents you build, YouTube links you share, transcripts you import, and the thumbnails we generate for you.

Payment information. Payments are processed by Stripe. We receive your billing status, plan, amounts and the last details Stripe shares with us (such as card brand and last four digits); we never see or store your full card number.

API keys. On the Lifetime plan you may add your own AI provider keys. They are encrypted at rest (AES-256-GCM), used only to run your own requests, and never shown back in full.

Usage and device information. Pages and features used, credits spent, generation history, IP address, browser and device type, and similar technical data, collected through cookies and product analytics.

Communications. Messages you send us and your email preferences.

• To provide ThumbSpark: run your chats and generations, store your projects, and show your history.
• To manage your account, plan, credits and payments, and to prevent fraud and abuse.
• To send service emails — account confirmation, password resets, receipts and important changes.
• To send product updates or offers, which you can unsubscribe from at any time.
• To understand how the product is used and improve it.
• To keep the service secure and comply with legal obligations.

To generate text and images, your prompts, messages, and the images and transcripts involved in a request are sent to the AI provider that performs it (see section 4). On the Credits plan this happens under our accounts with those providers; on the Lifetime plan, under your own keys.

We do not use your uploads or generations to train our own AI models, and we do not sell them. The providers process them to return results under their own terms and privacy policies.

We share information only with service providers that help us run ThumbSpark, and only as needed for their part:

• Supabase — database and authentication.
• Cloudflare — hosting, content delivery and file storage.
• Stripe — payment processing.
• Anthropic, OpenAI and kie.ai — AI text and image generation.
• Apify — fetching transcripts of YouTube videos you choose to import.
• Google — sign-in with Google, when you use it.
• Resend — sending emails.
• PostHog — product analytics.

We may also disclose information if required by law, to protect the rights and safety of our users or ThumbSpark, or as part of a merger or sale of the business. We do not sell your personal information.

When you share a YouTube channel or video link, ThumbSpark fetches that video's or channel's public information (such as its title, description, thumbnails and, when you import it, its transcript). This works only for public or unlisted videos. We use it solely to help with your thumbnails and store it with your project.

We use cookies that are necessary to keep you signed in and secure, cookies that remember your preferences, and analytics cookies that help us understand how the product is used. You can block or delete cookies in your browser, but some parts of ThumbSpark may stop working.

We keep your account information and content for as long as your account is active. When you delete your account, we delete your content and uploaded files, except where we must keep certain records (such as payment and tax records) for legal reasons, and except for backups, which are overwritten on a regular cycle.

We use encryption in transit (HTTPS), encrypted storage of API keys, access controls that limit who can see data, and providers with strong security practices. No system is completely secure, so we can't guarantee absolute security — please use a strong, unique password.

Depending on where you live, you may have the right to access, correct, download or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update most details in Settings, and unsubscribe from marketing emails using the link in any email.

To make any other request, or to delete your account, email hello@thumbspark.co. We'll respond within a reasonable time and may need to verify your identity.

Our providers may process information in countries other than yours, including the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

ThumbSpark is not intended for anyone under 13 (or the minimum age in their country). We do not knowingly collect information from children. If you believe a child has given us information, contact us and we'll delete it.

We may update this policy as ThumbSpark changes. We'll post the new version here with a new “Last updated” date and, for significant changes, let you know by email or in the app.

Questions about privacy? Email hello@thumbspark.co.