Last updated: October 4, 2026
This policy explains how Thumbrix processes information when you use our website and creative tools. Thumbrix is operated by an individual based in mainland China. For privacy questions and requests, contact contact@thumbrix.com. Our payment account location does not change the identity or location of the operator.
中文版.
Information we collect
We collect information you submit, information needed to operate your account, and limited technical information about your use of the service.
| Category | Examples and purpose |
|---|---|
| Account | Name, email, profile image, sign-in identifiers and sessions, to provide access and save your work. |
| Creative inputs | Prompts, headlines, reference photos, style references and editing instructions, to perform the operation you request. |
| Files and results | Generated images, project versions, workspace conversations and plans, and task status, so you can return to your work. |
| Purchases | Order and checkout identifiers, billing email, payment status, credit transactions and refund records, to fulfill purchases and maintain balances. Full card details are handled by the checkout provider, not stored in our application database. |
| Support | Your email and the content or attachments you choose to send, to investigate and respond. |
| Technical information | Network address, browser information, locale, referral or campaign source, request and error information, to deliver the service, prevent abuse and diagnose problems. |
Please submit only content you own or have permission to process. Photos may contain faces or other personal information about you or other people.
How we use information
We use this information to sign you in; plan, generate and edit thumbnails; save projects; process purchases and refunds; communicate about the service; investigate errors; and protect accounts and free-use limits. We keep a record of key actions in the product, such as signing up, sending a request, a generation succeeding or failing, a download and a payment, together with your account or guest session, so we can run the service, see where people get stuck and find the cause of failures. Optional analytics helps us understand how visitors use the website.
Where applicable law requires a legal basis, we rely on the basis appropriate to the purpose, such as providing the service you request, consent for optional uses, complying with legal obligations, or legitimate interests in security and service operation where permitted. A use that requires consent is not authorized merely because this policy describes it.
AI processing and service providers
Your chosen feature determines which provider receives your data. Generating an image can send prompts and reference images to an image provider; planning in the workspace can send your messages and attached images to a language-model provider.
| Provider or service | What it processes |
|---|---|
| Cloudflare | Website delivery, request security, application databases and file storage. |
| Google sign-in | Authentication and the basic identity information you authorize. |
| KIE | Image-generation and editing prompts and supplied reference images, including processing through the models used by that service. |
| DeepSeek | Workspace messages, project context and attached images needed to plan your request, including reference images the assistant analyzes. |
| Checkout provider | Payment information necessary to complete your purchase. The provider used is identified at checkout; available integrations include Stripe, PayPal and Creem. |
| Email delivery provider | Recipient and message information for service emails when email delivery is enabled. |
| Google Analytics | Website measurement information as described under Cookies and browser storage. |
| Microsoft Clarity | Website session recordings and heatmaps as described under Cookies and browser storage. |
These providers process information under their own terms and policies. We do not promise that every AI provider has the same retention or model-training practices. Review the provider's current terms before submitting sensitive material. Relevant notices include Cloudflare privacy, Google privacy, KIE privacy, DeepSeek privacy and the policy shown by your checkout provider.
We do not sell your personal information. We disclose information to service providers as needed for these purposes, or where necessary to comply with lawful requests, protect rights or address fraud and security incidents. Our current analytics configuration does not enable advertising personalization.
Google sign-in and YouTube features
Thumbrix uses YouTube API Services to retrieve public channel and video information, including identifiers, titles, publication dates, thumbnail URLs and available statistics. This supports public-video research. Google sign-in is for your Thumbrix account; it does not give Thumbrix access to private YouTube Analytics, your watch history or permission to publish on your channel.
Current public-statistics responses are cached for up to one hour. A cached thumbnail URL refers to an image hosted by its source; it does not transfer ownership or permission to reuse the image. Data practices for any future library or history feature will be described before that feature is introduced.
You can review or revoke your Google connection in Google account permissions. Revoking access does not automatically delete information already stored by Thumbrix; contact us to request deletion. See also the Google Privacy Policy and YouTube Terms of Service.
Creative files
Generated images, prompts, reference files, style snapshots and task records may be saved with your projects so you can revisit, edit or compare results. Removing a reference from a current form does not necessarily delete a copy already submitted with a saved task. Contact us for deletion of saved material that has no removal control in the product.
Public gallery and Minecraft skins
New Minecraft generations are public by default. Their final image and prompt may appear in a curated gallery, where visitors can reuse the prompt. Uploaded reference files are not published. Authors appear as “Community creator” unless a public credit is agreed. Eligible paid users can choose a private generation before submitting. Private work and existing YouTube and Roblox generations are excluded from this gallery. Contact us to request removal of featured work.
Choosing Load skin sends a Java username to Mojang to resolve a player ID and sends that ID to Crafatar to obtain the character render. If you then generate using that render, it is sent to the image provider as a reference. These services may cache skin data. Your background and visibility choices are stored in browser session storage.
Cookies and browser storage
Essential cookies support sign-in sessions and guest trials. A first-party cookie keeps the page you first arrived on, its campaign tags and the referring site's address (not the full referring page), so a new account can record where it came from. The application uses short-lived salted network-address hashes for abuse prevention and rate limits; infrastructure may separately process connection addresses.
The website may store text drafts in session storage and a reference photo in IndexedDB to preserve your work through sign-in or checkout. Local storage retains settings such as your theme and analytics choice. Use the form's removal controls or clear site data in your browser to remove local drafts. Clearing browser data does not delete saved server-side projects or account records.
We use Google Analytics 4 for page views and interactions such as button clicks. Analytics cookies are denied by default and enabled when you accept analytics in the banner. You can change that choice through Cookie Settings in the footer. With analytics cookies declined, Google may still receive cookieless measurement signals. Advertising storage, advertising user data and advertising personalization remain denied by this consent configuration. See Google's privacy policy.
We also use Microsoft Clarity to record website sessions and build click and scroll heatmaps, which helps us find pages where the product is confusing. Clarity runs for all visitors, and your consent choice controls its cookies rather than whether a session is recorded. Clarity cookies are denied by default and set only after you accept analytics in the banner; declining, or later withdrawing consent through Cookie Settings, removes them. Without those cookies Clarity cannot link your pageviews into a single session or recognise you on a later visit. Clarity masks text in form fields by default, but a recording still reflects what was visible on the page. See Microsoft's privacy statement.
How long information is kept
Retention depends on the information and the feature, rather than one period for everything:
- Public YouTube statistics: current response caches last up to one hour; this is not a permanent historical archive.
- Creative projects and account information: kept to provide your saved work and account, with deletion available through existing controls or a request to us.
- Payment, credit, support and security records: kept for as long as reasonably needed to fulfill the relevant purpose, resolve disputes, prevent fraud or meet applicable recordkeeping obligations.
- Local drafts and preferences: controlled through the product and browser storage settings.
If a deletion request affects records we must retain, we will explain the applicable limitation. Provider-controlled records follow the relevant provider's retention policy. We do not claim an automatic deletion deadline for every record type.
Your choices and privacy requests
Contact contact@thumbrix.com to request access, correction, deletion or a copy of your information, or to ask about a use you want to restrict. Depending on applicable law, you may also have rights to object to processing, withdraw consent, receive portable data or complain to a competent privacy authority.
Include the email associated with your account and describe the request or affected project. We may need to verify that the request comes from the account holder before disclosing or deleting information. Do not send passwords, payment-card details or identity documents unless an appropriate verification method is specifically agreed. We will respond within the period required by applicable law and explain any lawful exception.
You can also change available profile settings, change your cookie choice or clear local drafts.
International processing and security
Thumbrix's operator is based in mainland China, and the service uses international infrastructure and providers. Information may be processed outside your country or region, where data protection rules may differ. Requirements for notices, consent or other safeguards depend on the processing and applicable law. A payment account's location alone does not determine which privacy laws apply.
We use safeguards such as authenticated access, account-scoped storage access and encrypted transport to protect information. No internet service can guarantee absolute security. Contact us if you suspect unauthorized access to your account or content.
Children
Thumbrix is not directed to children under 13, or a higher minimum age where required by applicable law. If you believe a child has provided personal information without the necessary authorization, contact us so we can investigate and arrange appropriate removal.
Changes and contact
We will update the date on this page when this policy changes and provide additional notice or obtain consent where required for material changes. Questions about privacy, saved content, account deletion or these practices can be sent to contact@thumbrix.com.
For service and purchase conditions, see our Terms of Service.