Last updated: April 5, 2026 · Effective: April 5, 2026
ThumbClick is an AI-powered YouTube thumbnail generator available at thumbclick.es. If you have questions about this policy, contact us at rodri@syncralabs.es.
Account data: When you register, we collect your email address and a hashed password. We do not store plain-text passwords.
Photos you upload: Photos you upload to generate thumbnails are processed by Google Gemini AI and may be temporarily stored in Supabase Storage associated with your account. Photos are also stored locally on your device using IndexedDB. You can delete them at any time from the gallery.
Generated thumbnails: Thumbnails you generate are stored in Supabase Storage so you can access your history. You can delete them at any time.
Usage data: We collect your generation count and credit balance to enforce subscription limits.
Payment data: Payment processing is handled by Stripe. We do not store card numbers or banking details. We store your Stripe customer ID and subscription ID to manage your plan.
Guest usage: For guests (non-logged-in users), we store a hashed version of your IP address only to enforce the free generation limit (2 per day). This data is automatically purged after 7 days.
Analytics & advertising data: We use the Meta (Facebook) Pixel, which collects data about your interactions with the Service, including page views, registrations, thumbnail generations, and checkout events. This data may include your IP address, browser type, operating system, and a cookie identifier. This information is used to measure advertising effectiveness and to serve you relevant ads on Meta platforms. You can opt out of this tracking via our cookie consent banner or your browser settings.
Device & browser data: Our hosting providers (Vercel) may automatically collect standard server logs including your IP address, browser type, referring URL, and pages visited. This data is used for security and performance monitoring.
We use the following sub-processors to deliver the service:
Your account data and thumbnails are retained as long as your account is active. If you delete your account, all associated data is permanently deleted within 30 days. Guest IP hashes are automatically purged after 7 days.
You have the right to:
To exercise these rights, email rodri@syncralabs.es.
Essential storage: We use browser localStorage to store your session token (for authentication), a guest generation counter, onboarding progress, and your cookie consent preference. We also use IndexedDB to store your uploaded photos locally on your device for performance.
Analytics & advertising cookies: When you consent via our cookie banner, the Meta (Facebook) Pixel sets cookies on your browser to track page views, conversions, and ad performance. These cookies are used by Meta to serve you targeted advertising on Facebook and Instagram. You can withdraw consent at any time by clearing your cookies or adjusting your preferences in the cookie banner.
No other tracking cookies: Beyond the Meta Pixel (which requires your consent), we do not use any additional third-party tracking cookies, Google Analytics, or advertising networks.
All data is transmitted over HTTPS. Passwords are hashed by Supabase using bcrypt. API keys are stored exclusively on server-side infrastructure and never exposed to the browser. Row-Level Security (RLS) policies in our database ensure users can only access their own data.
ThumbClick is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us to have it removed.
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional rights and disclosures apply to you under the General Data Protection Regulation (GDPR):
Legal bases for processing:
Your GDPR rights: In addition to the rights listed in Section 6, you have the right to:
Data transfers: Your data is processed on servers in the United States (AWS US-East via Supabase, Vercel). By using the Service, you acknowledge this transfer. We rely on the service providers' standard contractual clauses and data processing agreements to safeguard your data.
To exercise any of these rights, email rodri@syncralabs.es. We will respond within 30 days.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:
Categories of personal information we collect:
How we use this information: To provide the Service, process payments, improve the product, and measure advertising performance (see Sections 3 and 4).
Sale / sharing of personal information: We do not "sell" your personal information in the traditional sense. However, the Meta Pixel may constitute "sharing" of personal information for cross-context behavioral advertising under CCPA/CPRA. You can opt out of this sharing via the cookie consent banner or by emailing us.
Your CCPA rights:
To exercise these rights, email rodri@syncralabs.es. We will verify your identity and respond within 45 days.
We may update this policy from time to time. When we do, we will update the "Last updated" date above. Continued use of the service after changes constitutes acceptance of the updated policy.
Questions? Email us at rodri@syncralabs.es.