Who Is Responsible for Your Data

The data controller is the publisher of ThumbSignal, a private individual established in France, reachable at contact@thumbsignal.com. No data protection officer has been appointed, as none is required at this scale.

Data We Collect

ThumbSignal does not require an account. When you analyse a thumbnail while signed out, the image itself is never stored: it is sent to our AI provider to produce your result, then discarded. What we do keep is the written analysis the AI returns, which can quote your title and describe what your thumbnail shows. It is filed under a one-way fingerprint of the image and title, so that the same submission gets the same answer if it is made again; it records no IP address and no account, and is deleted 90 days after it was last used. If you are signed in, a small low-resolution preview of your thumbnail is also saved with the result in your private analysis history, and deleted automatically after 30 days.

We keep a count of the analyses you run so we can apply usage limits and prevent abuse. While you are signed out that count is tied to your IP address and holds no information about you beyond the IP address itself; while you are signed in it is tied to your account. Daily counts reset at midnight UTC and monthly counts at the start of the UTC month — not 24 hours after your first analysis.

If you write to us through the contact form, we store the name, email address, subject and message you submit, so that we can read your message and reply to it. The basis for this is our legitimate interest in answering people who contact us. It is never used for marketing and never shared. Contact messages are deleted automatically 90 days after they arrive. We do not send newsletters or marketing email.

Each analysis request is also written to a technical log: when it was made, the IP address it came from (and your account, if you are signed in), whether it was served or refused, and the score. We use it to enforce usage limits and investigate abuse, on the basis of our legitimate interest, and it is deleted automatically after 30 days. If you are signed in, your own entries are included when you download your data.

Our servers keep technical logs for 30 days to run and secure the site. The access log among them records which pages were requested, but not your IP address; the web server's error log records the IP address of a request only when that request fails. The web server's own full access log, which does record IP addresses, stays on the server and is deleted after at most 14 days.

Your Account

Creating an account is optional. You sign in with Google or GitHub: from that provider we receive your email address, your name and your profile picture, never your password, and your picture is displayed by loading it from the provider's own servers. Your account is stored by our database and authentication provider, Supabase, for as long as you keep it. From your account page you can download everything we hold about you, or delete your account and all of its data at once.

We also use your email address, rarely, to tell you about a change that affects your account or results you have already seen, such as a new way of calculating scores. These service messages are never marketing; the basis is our legitimate interest in informing the people who use the service. To write in your language, we guess it from the text of your saved analyses, and use English when we cannot. They are sent through Amazon Web Services in Ireland. To stop receiving them, reply to one or write to us through the contact form.

If you run a YouTube channel, we may write to you once about your latest public video, from the publisher's own mailbox, with one reminder at most. We use the business email address your channel shows publicly, copied by hand: never bought, never collected automatically, and not stored on this site. The private page the message links to holds only what YouTube shows publicly about the video, the checker's result and, if we used it, your first name; it is not listed or indexed, and it is deleted after 30 days, or at once with its "Delete it now" button. If you answer "No thanks", we keep your channel's name and the date for three years, only so that we do not write again. The basis is our legitimate interest in presenting the service to creators who may use it; you can object at any time, with that button or by replying.

Why We Are Allowed to Process Your Data

We analyse your thumbnail and title in order to provide the service you asked for. We count analyses — per IP address while you are signed out, and per account while you are signed in — on the basis of our legitimate interest in keeping the service available and preventing abuse. Advertising and analytics run only on your consent, which you may withdraw at any time via “Cookie settings” in the footer; withdrawing does not affect processing that already took place.

Third-Party Services

To analyse your thumbnail and title we rely on a specialist third-party AI provider, which acts only on our instructions and does not use your content to train its models. We do not sell your thumbnail or title, and we do not share them with anyone else. This processing takes place inside the European Economic Area, on servers located in Ireland.

The services that handle your data on our behalf are Amazon Web Services, which hosts the site, the AI model and our logs in Ireland; Supabase, which stores accounts, usage counts and saved analyses in Ireland; and Cloudflare, which protects the site against abuse. Google processes data for analytics and advertising only with your consent, and for YouTube links as described below.

YouTube Links

If you paste a YouTube link instead of uploading an image, your browser loads the video's preview image directly from YouTube, which receives your IP address as it does for any YouTube image. Our server then retrieves the video's public thumbnail and, where available, its title from YouTube, using YouTube API Services. YouTube's Terms of Service (https://www.youtube.com/t/terms) and Google's Privacy Policy (https://policies.google.com/privacy) apply to that part of the service.

Protection Against Abuse

The analysis tool and the contact form are protected by Cloudflare Turnstile, which checks that a request comes from a real browser rather than a bot. To do so, Cloudflare processes your IP address and technical characteristics of your browser and device, on our behalf and only for this check, and may do so outside the European Economic Area under the safeguards required by data protection law. The basis is our legitimate interest in keeping the service available and preventing abuse.

Advertising

ThumbSignal may display advertisements through Google AdSense. When it does, and only if you accept advertising cookies, Google and its partners use cookies to serve ads based on your prior visits to our website or other websites, and on your interests.

You may opt out of personalized advertising by visiting Google's Ads Settings at https://www.google.com/settings/ads. Alternatively, you can opt out of third-party vendor use of cookies for personalized advertising by visiting www.aboutads.info.

Analytics

With your consent, we use Google Analytics 4 to understand how the site is used — which pages are visited, and whether the tool works as expected. Google processes this data on our behalf and may transfer it outside the European Economic Area under the safeguards required by data protection law. Analytics does not run unless you accept it, and you can change your choice at any time via “Cookie settings” in the footer. With the same consent, we record the site language with your visits and, when you are signed in, your plan and a code derived from your account that contains neither your email, your name nor your account number, so that your visits on different devices count as one person.

Cookies and Tracking

We use cookies that are necessary for the site to work — for example, to keep you signed in and to apply usage limits. Google AdSense and its partners may also set cookies to show personalised advertising based on your browsing across the web. You can manage or block cookies in your browser settings.

When you choose a reading path on the blog index, your browser keeps which path, which step and how much of the article you have read as you go through it, in its local storage, so the blog index can offer to take you back there. Nothing is kept for an article you reach any other way. It stays on your device and is never sent to us. It is no longer used after 30 days without reading; the Clear link on the blog index, or clearing this site's data in your browser, deletes it.

The analyzer reads it too: after you test a second version of a thumbnail or title, it offers the article of your path to read next.

Your Rights

You have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to ask us to restrict or stop processing it, and to receive it in a portable format. Where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, contact us at the address below; we will respond within one month. If you believe we have handled your data improperly, you also have the right to lodge a complaint with your national data protection supervisory authority.

Contact

For privacy inquiries, contact us at contact@thumbsignal.com.