Privacy policy

Last updated: placeholder draft, not yet reviewed by a lawyer.

1. What this covers

This policy describes what thumbs.blog collects from Authors (people with a thumbs.blog account) and from Readers (anyone who visits a published Blog), and what we do with it.

2. Reader data

A published Blog carries no analytics script, no third-party embed, and no cookie. We count Reads on our own server, from the page request itself, and keep only counts. Nothing about Readers is sent to anyone else.

When a browser opens a published Post or a Blog’s home page, we count one Read. Known bots, link previews, prefetches and the Author’s own visits from their dashboard are not counted. From the request we work out, and keep as counts per Blog and per Post for each day (UTC):

• the number of Reads;
• an estimate of unique Readers that day;
• the country, from your IP address, using a database stored on our server (DB-IP’s free country database; no lookup leaves our server);
• the website that linked to the page (its host name only, such as news.example, never the full address), or “Direct”;
• a coarse browser family (such as Safari) and device type (such as mobile).

To estimate unique Readers we combine your IP address and browser identifier with the Blog and a random value that changes every day, and keep only a one-way, shortened fingerprint of the result. Fingerprints cannot be linked across days or across Blogs, and they are deleted within 48 hours. Your IP address, your full browser identifier and the full address of the page that linked to the Blog are never stored.

The daily counts and a Blog’s and a Post’s total number of Reads are kept until the Blog or Post is deleted; a deleted Post’s Reads stay in its Blog’s counts. How many Readers are on a Blog or Post right now is counted in our server’s memory for five minutes and never stored.

The Author of the Blog sees these counts for their own Blog. We do this on the basis of our legitimate interest, and the Author’s, in knowing how much a Blog is read, in a way that does not identify or follow Readers.

3. Product analytics, sent from our server

We use PostHog, hosted in the US, to see which features Authors use and where things break, so we can fix problems you run into. Our server sends PostHog a short record of what happened; no page, and never a Blog, loads anything from PostHog, and nothing is stored on your device for it.

What is sent, while you are signed in: the pages of the dashboard and the editor you open (their address, without anything after a ?), and actions such as signing in, creating a Blog, publishing or updating a Post, opening a Post’s settings, inserting an image or changing a cover, updating a Blog’s look, creating an API key, and what an agent you connect does through the MCP server (the tool’s name, whether it worked, and how long it took). Each record carries your account ID and the IDs of the Blog or Post involved, and PostHog is given your email address and your first Blog’s address so it can show us who did what. The words of your Posts and Drafts, your image descriptions and file names, and your Blog’s CSS are never sent.

A signed-out visit to the landing page or the sign-in page is sent as an anonymous page view, with no email address: the page, the site that linked to it, any campaign tags in its address, a coarse device type and browser family, and your IP address, which PostHog uses to estimate your location and is set to discard afterward. We never store it.

We do this on the basis of our legitimate interests in keeping the service working and learning which parts of it are used. You can object at any time: turn analytics off on the Account page, and from then on nothing about you is sent to PostHog.

4. Account data

We store your email address, the Blogs and Posts you create, any Media you upload, and the API keys and OAuth connections you create. Signing in by magic link or passkey creates a session tied to your browser, which you can review and revoke from the Account page at any time.

5. Where data lives

• Database: Author accounts, Blogs, and Posts are stored in Postgres, hosted by Supabase.
• Media: images and fonts you upload are stored with Cloudflare R2, our object storage provider, and served through Cloudflare.
• Application hosting: the dashboard, the Author API, and every Blog are served from Fly.io.
• Email: magic links and account notifications are sent through Postmark.
• Billing: if you’re on the paid plan, your subscription and payment details are handled by Polar; we receive only that a payment succeeded or failed, never your card number.

6. Third parties

We share data with the vendors named above only as needed to run the service (hosting, storage, email delivery, payment processing, and PostHog for product analytics, section 3). We do not sell your data or share it for advertising.

7. Your choices

You can review and revoke your Sessions, passkeys, API keys, and OAuth connections from the dashboard at any time. You can turn product analytics off on the Account page. You can close your account, which removes your Blogs and Media from public view.

8. Changes to this policy

We may update this policy as the product changes. Continued use of thumbs.blog after an update means you accept the new policy.

9. Contact

Questions about this policy can be sent to support@thumbs.blog.

This is placeholder text describing a plausible privacy policy for a small hosted blogging service, consistent with how thumbs.blog is actually built today (no tracking on Blogs, PostHog sent from the server only with an opt-out on Account, Postmark, Polar, Supabase, Cloudflare, and Fly). It deliberately does not promise Reader tracking will never exist, since an optional per-Blog analytics feature is a possible future addition (see Linear TMB-100). It has not been reviewed by a lawyer and must be replaced with real, reviewed text before thumbs.blog is launched publicly. Edit this file (priv/legal/privacy.md) directly — no code change is needed — and remove the placeholder comment and this notice once the real text is in place.