Privacy Policy

Thumbalyze ("we," "us," or "our") provides an AI-powered SaaS platform for YouTube creators to analyze thumbnails, generate creative assets, edit images, write scripts, explore niches, and get coaching feedback. This Privacy Policy explains what information we collect, how we use it, and the choices you have when using thumbalyze.com.

We collect information in these categories:

• Account data: email address, password hash (if you register with email/password), display name, onboarding preferences, plan tier, and billing status. If you sign in with Google, we receive your name, email address, and profile image from Google.
• Usage data: tool runs (analyses, generations, image edits, scripts, niche searches, Coach chats), credit consumption, feature settings, and basic product analytics needed to operate the service.
• Content you submit: thumbnail images, titles, niches, scripts, chat messages to Coach, images you upload to the background remover or upscaler, thumbnails you save as custom templates, and other inputs you provide for AI processing.
• Photos of people:if you use AI Avatar features, the photos you upload of yourself or another person, the avatar images we extract from them, and an AI-generated text description of that person's appearance used to keep generated thumbnails consistent.
• Affiliate & Creator Rewards data: if you join these programs, your referral code, referral link clicks (with approximate country), referred signups and conversions, payout account status, payout method details you provide (such as a Cash App $cashtag), social media handles and profile links, links to videos you submit, analytics screenshots, reported view counts, and review notes.
• YouTube OAuth data: if you choose to connect YouTube, we receive channel identifiers, channel title, channel avatar, and OAuth tokens scoped to read-only YouTube access so we can show recent uploads and channel-aware context. We do not post to YouTube on your behalf.
• Payment data: subscriptions and checkout are handled by Stripe. We receive customer and subscription metadata from Stripe, not full card numbers. Affiliate payouts use Stripe Connect: Stripe collects the identity, tax, and bank details needed to pay you, and we receive only your connected account ID and its onboarding and payout status.
• Device & location data: your IP address, used temporarily for security, rate limiting, and fraud prevention, and the approximate country derived from it, which we store for aggregate analytics such as where our users are located. We do not store precise location.
• Cookies & session data: authentication cookies, session tokens, and similar technologies that keep you signed in and remember preferences such as theme. If you arrive through an affiliate link, we set a referral cookie for 30 days so the referral can be credited if you sign up.

• Provide, maintain, and improve Thumbalyze features.
• Run AI analysis, generation, scripting, niche discovery, and coaching using your submitted content.
• Authenticate accounts, enforce plan limits, and manage credits.
• Process subscriptions, invoices, discounts (such as a retention offer when you cancel), and affiliate or Creator Rewards payouts where applicable.
• Attribute referrals to affiliates, verify ownership of social accounts, and review Creator Rewards submissions.
• Understand aggregate product usage so we can improve the Service.
• Send service-related notices and respond to support requests.
• Detect abuse, fraud, and violations of our Terms of Service.

Thumbalyze uses third-party artificial intelligence providers, including OpenAI, to provide certain features such as thumbnail analysis, image generation, title suggestions, background removal, AI Avatars, custom templates, scripting, niche discovery, and AI coaching. Content and information you submit to these features — including YouTube thumbnails or other images, Thumbalyze- generated images you re-submit, titles, prompts, Coach messages, and related analysis inputs — may be processed by these providers so we can return the outputs you request.

What we send. Depending on the tool you use, this may include thumbnail or other images you upload or link; photos of people uploaded for AI Avatars; titles, prompts, niches, script briefs, and similar text inputs; Coach chat messages and related conversation context; and limited product metadata needed to complete the request (for example, selected quality mode or tool settings). We aim to send only the information reasonably necessary to provide the requested AI feature. Some tools, such as the upscaler, process images on our own servers and do not send them to an AI provider.

Why we send it. Content is transmitted so the provider can generate scores, feedback, images, scripts, niche suggestions, coaching replies, and other AI outputs that Thumbalyze then returns to you in the Service.

OpenAI Content Sharing / Development Purposes.For certain OpenAI services used by Thumbalyze, we have enabled OpenAI's Content Sharing arrangement. As a result, certain content submitted to applicable OpenAI-powered features may be designated for use by OpenAI for development purposes, including model training, research, development, evaluation, and testing ("Development Purposes").

This may include applicable inputs submitted to OpenAI and the corresponding outputs generated by OpenAI. For Development Purposes, OpenAI may process designated content as an independent data controller rather than solely as a processor acting on Thumbalyze's instructions.

You should not submit sensitive, confidential, proprietary, or other information that you do not want used for Development Purposes through applicable AI-powered features.

User Notice and Choices. Before submitting content to applicable AI-powered features, Thumbalyze presents an in-product notice regarding AI processing and OpenAI Content Sharing. Users should also review this Privacy Policy.

Do not submit information that you do not want used for Development Purposes, including sensitive, confidential, or proprietary information, or content that you are not authorized to provide.

Do not use Thumbalyze to process protected health information (PHI) regulated under HIPAA or personal data of children under 13 or below the applicable age of digital consent.

Retention and use by providers.OpenAI and other AI providers process data according to their own terms, privacy policies, and (where applicable) Content Sharing Agreement, which may include retention, abuse monitoring, and Development Purposes use as described above. Thumbalyze does not control OpenAI's independent retention or secondary use of designated content for Development Purposes. Our own retention of saved history and account data is described under Data Retention below.

We may use other third-party AI, hosting, storage, analytics, payment, authentication, and infrastructure providers to operate Thumbalyze. Depending on the feature, these providers may process information you submit to Thumbalyze. We require our service providers to process information as necessary to provide their services to us, subject to their applicable agreements and policies.

Where a provider processes information for its own independent purposes, including where applicable under OpenAI's Content Sharing arrangement, that provider may act as an independent data controller for those purposes.

Linking YouTube is optional. When connected, we use Google OAuth with the YouTube read-only scope to read channel metadata and recent uploads for dashboard and coaching context. You can unlink at any time from Settings. Unlinking revokes our use of stored tokens for that channel, subject to routine backup retention described below.

AI Avatar features are optional. When you create an avatar, we store the photos you upload, the avatar image we extract from them, and an AI-generated text description of the person's appearance. We use these only to place that person in the thumbnails you generate. We do not use them for facial recognition or to identify people.

Only upload photos of yourself or of people who have given you permission. You can delete an avatar and its photos at any time from the AI Avatar page.

We use PostHog to understand how the site is used: for example, which pages are visited, which features people click, and key steps such as signing up, finishing onboarding, running an analysis or generation, clicking upgrade, choosing a plan, or starting a subscription. PostHog runs in cookieless mode, so it does not set analytics cookies or store identifiers in your browser. Session recording is disabled, and we do not build individual analytics profiles. Events are sent through our own domain and may include the page URL, referring page, and general device and browser information.

When someone opens your referral link, we log the click with an approximate country (not their IP address) and set a 30-day referral cookie so a later signup can be credited to you. Affiliates can see aggregate referral and earnings stats; we do not show affiliates the names or email addresses of the people they refer.

Affiliate payouts are handled through Stripe Connect. Stripe collects and verifies your identity, tax, and banking information under its own privacy policy; Thumbalyze does not store your bank account or government ID details.

If you apply for Creator Rewards, we collect the social accounts you add, the video links and analytics screenshots you submit, the view counts you report, and your payout preference. Our team reviews this information manually, including by visiting your public profiles and videos to verify ownership and eligibility.

We do not sell your personal information. We may share information with:

• AI providers, including OpenAI: to provide AI-powered features such as thumbnail analysis, image generation, scripting, niche discovery, and Coach. As described above, certain content submitted through applicable OpenAI services may also be used by OpenAI for Development Purposes under our Content Sharing arrangement. For those purposes, OpenAI may act as an independent data controller.
• Stripe: to process payments, subscriptions, and related billing activities, and, through Stripe Connect, to onboard and pay affiliates.
• Google: when you sign in with Google or choose to connect your YouTube account through Google OAuth.
• PostHog: for cookieless product analytics as described above.
• Service providers: such as hosting, storage, security, analytics, and infrastructure providers that help us operate Thumbalyze.
• Authorities and other parties: when required by law or when reasonably necessary to protect our rights, users, safety, or the security of the Service.

We retain account and billing records while your account is active and for a reasonable period afterward to comply with legal, tax, and dispute obligations. Saved history (analyses, generations, scripts, chat threads), AI Avatars, and custom templates remain until you delete them or close your account. Images you run through the background remover or upscaler are processed to return your result and are not saved to your history. OAuth tokens are removed when you unlink a channel. Affiliate and Creator Rewards records, including submitted evidence and payout history, are kept as long as needed to calculate, pay, audit, and resolve disputes about rewards. We may retain aggregated or de-identified analytics that cannot reasonably identify you.

We use industry-standard measures including encrypted transport (HTTPS), access controls, and hashed credentials. No method of transmission or storage is completely secure; please use a strong, unique password and keep your login credentials confidential.

• Access and update profile information in Settings.
• Delete saved history from Settings where available.
• Delete AI Avatars and custom templates at any time.
• Unlink YouTube channels at any time.
• Cancel paid subscriptions through billing settings or Stripe customer portal.
• Request account deletion or a copy of your data by contacting us.

Depending on your location, you may have additional rights under applicable privacy laws (such as access, correction, deletion, or objection). We will honor valid requests as required by law.

Thumbalyze is not directed to children under 13 or below the applicable age of digital consent. We do not knowingly collect or process personal information from children below the applicable age of digital consent.

We do not permit users to submit personal data of children below the applicable age of digital consent to our AI-powered features. If you believe a child has provided us with personal information, please contact us so we can investigate and, where appropriate, delete the information.

If you access Thumbalyze from outside the United States, your information may be processed in the U.S. or other countries where our service providers operate.

We may update this Privacy Policy from time to time. We will revise the "Last updated" date and, for material changes, provide additional notice where appropriate (including in-product notices for AI processing changes). Continued use after changes means you accept the updated policy for future use of the Service. We do not treat prior use under an older policy as consent for newly disclosed Development Purposes practices for historical content without additional notice or choice where required.

Questions about privacy or data requests: