Privacy Policy

The controller of personal data processed in connection with ThumbnailUp (“the Service”) is Trebuh, a private individual based in Poland. You can reach the controller at trebuhdev@gmail.com.

This policy explains what personal data the Service collects, why we collect it, who we share it with, how long we keep it, and what rights you have under the EU General Data Protection Regulation (GDPR) and Polish law.

Visiting the Service. When you load pages, our hosting infrastructure receives standard request metadata: IP address, user agent, referring URL, and timestamp. This is used to keep the Service running and to detect abuse. We do not use it to send marketing emails.

Optional analytics. If you accept analytics cookies, Google Analytics for Firebase records pages viewed, feature usage, device and browser information, approximate location, and a random analytics identifier. We do not send the text you enter into search fields, review titles or descriptions, uploaded images, filenames, passwords, or agent credentials to Google Analytics. When you are signed in, we use your internal account ID and plan to connect your activity across visits.

Advertising measurement.If you accept optional cookies, the X (Twitter) pixel runs in your browser. It records the pages you visit and their full web addresses (including any search terms in them), the X ad click identifier in the link you followed, the text of buttons you click, device and browser information including your IP address, and whether you sign up, start checkout or start a Premium trial. When X’s Conversion API is enabled, our server also tells X when you start a trial or make your first payment, together with the ad click identifier, a one-way SHA-256 hash of your account email, the amount paid and the time. X uses this to measure and optimize our ad campaigns. We do not send X your email in plain text, your password, uploaded thumbnails, review content or payment details.

Earlier newsletter signups. We retain email addresses and signup timestamps previously submitted to the newsletter. New newsletter enrollment is no longer offered.

Your account. Signup collects your email address, a hashed password and an optional name. We store your account creation date and a session record to keep you signed in. A session cookie is required to access the app. Creating an account does not subscribe you to marketing emails.

Thumbnail reviews. Submitting a review sends your thumbnail, title, description and comparison images to Google Gemini. Completed reviews are saved in your account history with the feedback, title, description and a normalized copy of your uploaded thumbnail. The original upload file is not retained. Library comparison images remain links to YouTube rather than saved image files.

Subscriptions. When you start a subscription, we send your account identifier and email address to Stripe to create your billing account. Stripe collects payment details through its hosted checkout and customer portal. We store Stripe customer, subscription and checkout identifiers, subscription status and billing period dates, and webhook event identifiers and processing timestamps to keep your plan accurate and prevent duplicate processing. We do not store your full card details.

Future generator features. When AI thumbnail generation is introduced, we will additionally collect the prompts you submit, the images generated from them, and the cost of each generation. This policy will be updated before that release.

To run the Service — request metadata is processed based on our legitimate interest (Article 6(1)(f) GDPR) in operating, securing, and debugging the Service.

To send you the newsletter — your email is processed based on your consent (Article 6(1)(a) GDPR) given at the moment of signup. You can withdraw consent at any time by clicking the unsubscribe link in any email or by contacting us.

To understand use of the Service and measure our advertising — optional analytics and advertising measurement are processed only with your consent (Article 6(1)(a) GDPR). Rejecting them does not limit the Service.

To comply with legal obligations — for example, responding to lawful requests from authorities, or to copyright takedown notices (Article 6(1)(c) GDPR).

We share personal data only with the following categories of processors, each acting on our instructions:

• Hosting provider — runs the servers that store the database and serve the Service. Hosted in the European Union.
• Cloudflare (R2 storage) — stores off-server copies of our database backups so the Service can be restored after a failure. See the Cloudflare Privacy Policy.
• Email delivery service — used to send the newsletter once a real email provider is wired in (until then, newsletter signups are stored but no emails are sent).
• YouTube (Google LLC)— your browser loads thumbnail images directly from YouTube’s CDN (i.ytimg.com). YouTube may receive your IP address and user agent as part of those requests, governed by the Google Privacy Policy.
• Google Analytics for Firebase (Google LLC) — if you consent, processes analytics events and device information so we can understand how the Service is used. See the Google Privacy Policy.
• X Corp. — if you consent, receives the advertising measurement data described above through the X pixel and the X Conversion API. See the X Privacy Policy.
• Google Gemini receives thumbnail images, titles, descriptions and comparison context to produce requested reviews.
• Stripe — processes payments, subscription management and invoices through hosted checkout and the customer portal. See the Stripe Privacy Policy.
• Future processors — an AI generation provider (e.g. OpenAI) may be added when generation features are released.

We do not sell personal data. We share advertising measurement data with X only if you accept optional cookies, and you can withdraw that choice at any time.

Some of our processors may be based outside the European Economic Area (notably Google, X, Stripe, Cloudflare, and in the future OpenAI). Where this is the case, transfers are made under the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism described in Chapter V of the GDPR.

• Newsletter signups — kept until you unsubscribe or ask us to delete the record.
• Server request logs — kept for up to 30 days for security and debugging, then deleted or aggregated.
• Google Analytics data — retained according to the shortest practical retention setting available in the linked Google Analytics property, then deleted or retained only in aggregated reports.
• Advertising measurement — the stored X ad click identifier expires in your browser after 90 days. Our server keeps it until you withdraw consent or close your account, and keeps a record of which trial and payment events were reported to X with your account. X retains data under its own policy.
• Database backups — rotated on a schedule. Data you delete, or that we delete after account closure, can remain in existing backups until they rotate out.
• Review history is kept with your account. Deleting your account also removes its stored drafts and feedback.
• Account data — kept for as long as your account is active, then deleted within 30 days of account closure (longer if we are required by law to keep records, e.g. for invoicing).

We use an HttpOnly session cookie to keep you signed in. Signing out revokes that session. We also store your cookie choice in your browser. If you accept optional cookies, Google Analytics may set first-party cookies beginning with_ga, and the X pixel may set the first-party cookies _twclid, _twsid and _twpid, plus cookies on X’s own domains. We also keep the X ad click identifier in local storage. None of these are loaded or stored when you reject optional cookies. You can change or withdraw your choice at any time using the Cookies link in the Service footer.

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted (the “right to be forgotten”) where we no longer have a lawful basis to keep it;
• restrict or object to certain processing;
• receive a portable copy of data you provided to us in a machine-readable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (UODO), at uodo.gov.pl.

To exercise any of these rights, write to trebuhdev@gmail.com. We will respond within 30 days.

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, contact trebuhdev@gmail.com and we will delete it.

We apply reasonable technical and organisational measures to protect personal data — encryption in transit (HTTPS), access controls on the database, and password hashing for any account credentials. No system is perfectly secure; if a data breach materially affects you, we will notify you and the supervisory authority as required by Article 33–34 GDPR.

We may update this policy as the Service evolves (especially when accounts, payments, or AI generation are added). The “Last updated” date at the top reflects the most recent version. Material changes will be communicated through the Service.

Questions, requests, or complaints about how we handle your data: write to trebuhdev@gmail.com.