What we collect
Your email address and account status, so you can sign in and receive account messages.
The reference image, optional personal photo, and any extra images you upload; the text and instructions you provide; the generated thumbnail; and a record of each run and its status.
Everything in a support conversation, if you open one: the category you choose, the words you write, the words the operator writes back, and any screenshot you attach. We can open a file you attach to a support message. Your thumbnails and the images used to make them (the reference, your photos and any extra images) are opened only if you ask for support and give your permission, and every opening is recorded.
A salted hash of the network address a sign-up or a password attempt comes from, used to limit abuse such as mass sign-ups and password guessing. The address itself is not kept for this, and the hash is deleted once the limit's time window has passed.
When free credits are spent, a salted hash of the network address they are spent from is kept with the account until 30 days after the last run from that address, so that one connection is used for one account's free credits. If another account's free credits are refused on that connection, a record of the refusal, with that hash and both accounts, is kept until the refused account is deleted.
If you use Google sign-in, Google supplies your identity fields. The display name from your Google account is stored in your profile.
If you buy a plan, Dodo Payments, our merchant of record, tells us the status of your subscription, whether the credit rollover add-on is on it, a customer identifier, the email address you paid with and, if an affiliate referred you, their referral name. Your card goes to Dodo Payments and never to WThumb.
If you choose Allow cookies, WThumb's own limited first-party analytics stores the source, landing page, and the pages you open. It uses a random browser identifier and links that journey to your account only after you sign in. It does not store query strings, full referring URLs, IP addresses, prompts, photos, or text you enter.
When you create a WThumb account, we keep one word with it for how the visit that led to it began: an ad, a search engine, an AI assistant, social media, an email, another site, a tagged campaign link, directly, or unknown. Only that word is kept: the ad click identifier, the full address and the referring page are not, and nothing is stored on your device for it. If you sign in with Google, the word passes through Google on the way back to WThumb.
WThumb's own pages do not ask for a date of birth, postal address, or card details. What the checkout page asks for is collected by Dodo Payments under its own privacy policy.
Why we hold it
We hold your account data, inputs, instructions, results, and run records to provide the thumbnail service you request.
We keep a private usage ledger to grant and track the free credits a new account receives and a paid plan's monthly allowance, including anything the credit rollover add-on carries over, and to reserve, consume, or release a credit (1 credit makes 1 thumbnail) as each run changes state.
We use consented first-party acquisition and page-journey records to understand which pages bring people to WThumb, which visits become accounts, and how quickly an account reaches its first thumbnail. There is no marketing list or behavioural profiling, and these records are not shared with any advertising system.
We use the one word kept with a new account to count how many new accounts each kind of source brings, including whether our Google Ads campaign brings any, and it is shown on that account's record in WThumb's private admin panel. It is not given to any advertising system, and it is not used to choose ads.
The legal grounds for holding it are our agreement with you, for your account, your thumbnails, your plan and support; our legitimate interest in keeping WThumb secure and free of abuse and in knowing where new accounts come from; your consent, for the analytics, Microsoft Clarity and affiliate storage you allow; and the law, where it requires us to keep or disclose data.
Authentication protection
Cloudflare Turnstile helps protect sign-up, password sign-in, confirmation resend and password reset from automated abuse. It does not receive the images you use to make thumbnails.
Service providers
Supabase provides sign-in and the database that holds your account, credit balance and run records.
Cloudflare R2 stores image files, including anything you attach to a support conversation. Vercel hosts the website and counts page views and page speed for us: which pages were opened, from which referring site, from which country and on what kind of device, and how quickly each page painted. That count sets no cookie, is aggregated, and does not follow you to another site. The same counter also counts new accounts by the one word described under What we collect, with nothing that says whose account each one is. Resend delivers account email, which includes the note that a support reply is waiting; that note carries no message text, only the fact that there is one and where to read it. Google supplies identity fields when you choose Google OAuth.
Google Analytics helps us understand page visits and basic site usage, and which of our ads and campaigns bring visitors. It is not loaded until you choose Allow cookies: before that choice, and if you choose Only necessary, your browser sends nothing to Google Analytics. If you allow cookies, Google Analytics also receives the ad or campaign tags of the link you arrived on, such as a Google Ads click identifier or utm tags, with the first page it counts, including when you allow cookies after moving on from the page you arrived on. Until you choose, those tags are kept only in the open page, never saved on your device. If you choose Only necessary, they are never sent to Google Analytics and never saved on your device. Whether the link carried one can still decide the one word kept if you create an account, described under What we collect. Our Google Analytics property is linked to our Google Ads account, so Google Ads can measure which of our ads lead to visits, sign-ups and thumbnails. Google advertising storage, advertising user data, and advertising personalization remain denied. If you allow analytics, Google Analytics may set first-party analytics cookies and use them to distinguish visits. Your choice is stored in your browser and can be changed at any time through Cookie settings in the footer; withdrawing it stops Google Analytics from sending anything more.
If you choose Allow cookies, Microsoft Clarity also records how our pages are used, such as clicks, scrolling and other page interactions, as session replays and heatmaps that help us improve the site. Clarity does not record what you type into any form field, including your sign-in details, and the Studio and your account pages are masked as a whole, so the words shown there, such as your headlines, directions, descriptions and support messages, and your photographs and thumbnails are not recorded either. Withdrawing your consent through Cookie settings stops Clarity and clears its cookies. Microsoft's privacy statement explains how Microsoft handles this data.
WThumb runs an affiliate program on Rekomi: people who recommend WThumb share a link that carries their referral name, and they are paid a share of the purchases their link brings. If you arrive through a link that carries a referral name and choose Allow cookies, Rekomi's script keeps that referral name in your browser's storage for WThumb for up to 90 days, with an identifier Rekomi gives the visit and any channel tag the affiliate added to the link, and tells Rekomi about the visit: the referral name, the page that linked to WThumb and any campaign tags in the link. While it keeps the name, the script checks it with Rekomi each time a WThumb page loads, to look up the affiliate. The script is served from partners.wthumb.co, an address of WThumb's that Rekomi's servers answer, and everything it tells Rekomi goes to that address. Its reports can also carry the Google Analytics and Microsoft Clarity cookies your browser keeps for wthumb.co, and Rekomi's servers can leave two cookies of their own on that address holding the referral name for up to 60 days, which WThumb's pages cannot read or remove. Rekomi also runs our affiliate sign-up pages at that address, and a visit there carries those cookies to Rekomi as well. WThumb then also keeps the referral name of the link you arrived on in your browser's storage for up to 60 days, so that a purchase you make after signing in can still be credited. If you then buy a plan, your checkout carries the referral name to Dodo Payments, so the affiliate can be credited and paid for your purchase. The tags that the listing sites WThumb appears on add to their links are not treated as referral names: WThumb removes them from the address as the page opens, before Rekomi's script can read them. Until you choose, Rekomi's script is not loaded, and the referral name is kept only in the open page, never saved on your device. If you choose Only necessary, Rekomi's script is not loaded and your purchase is not credited to anyone. WThumb has not turned on Rekomi's email capture, so its script does not record what you type into the site's forms. Dodo Payments also sends Rekomi a record of each payment for our plans, including the email address you paid with, so Rekomi can find the purchases that carry a referral and work out what the affiliate is owed. Withdrawing your consent through Cookie settings removes the referral name, and what Rekomi's script kept with it, from your browser's storage. Rekomi's privacy policy explains how Rekomi handles this data.
WThumb's own limited first-party analytics begins only after you choose Allow cookies. It keeps the source, landing page and page paths in WThumb's own database. The one word kept when you create an account is separate from it and is kept whichever you choose. Google Analytics does not receive your WThumb account identifier.
To make a thumbnail, WThumb sends your reference image, photographs, extra images and instructions, together with its own instructions, to OpenAI, whose image model generates it.
Before a thumbnail is made, the text you type (your headline and the changes you describe) is checked by OpenAI's moderation service. Only that text is sent for this check.
Dodo Payments is the merchant of record for paid plans. Its checkout page collects your card and whatever its own checkout asks for, it charges you, issues invoices and processes refunds, and it sends WThumb signed messages about your subscription: its status, the plan and add-on on it, your Dodo customer identifier, the email address you paid with and, if an affiliate referred you, their referral name. Those messages are what turn a payment into an allowance. No card data is in them and none is stored by WThumb.
Several of these providers, including OpenAI, Vercel, Google, Microsoft and Resend, are based in the United States, and your data may be processed there.
We do not sell personal data, and we disclose it beyond the named services only where the law requires us to. We do not use it to choose the ads you see: the only advertising uses are measuring our own ads and crediting the affiliates who recommend WThumb. Google Analytics measures which of our ads bring visitors, as described above, and only after you choose Allow cookies. Rekomi credits an affiliate for a purchase their link brought, as described above, and only if you chose Allow cookies. The one word kept when you create an account is used to count how many new accounts our ads and other sources bring, whichever you choose, and it is not given to any advertising system.
Retention
Personas and their photographs remain until you delete them or your account, and successful thumbnails remain until you delete your account.
Unused reference and extra images are deleted seven days after their last use.
Incomplete uploads and failed outputs are deleted within 24 hours.
The private prompt and instructions behind each run are deleted after 30 days; the record that the run took place stays with your account without them.
The words you type in a Studio conversation stay with that conversation, so you can reopen it, until you delete the conversation or your account.
The words of a support message are emptied 90 days after it was written, and anything attached to that message is deleted at the same moment. The message's author and date remain.
The messages Dodo Payments sends about your subscription are kept for 90 days, so a question about a charge can be answered, and their contents are then emptied; a record of each message's type and date, and of the Dodo subscription it was about, remains without your email address. Deleting your account empties them at once. Your subscription's own record, with its status, dates and Dodo identifiers, is kept while the subscription exists and is deleted with your account.
WThumb keeps raw sessions and page views for 90 days. If a consented journey is linked to your account, its first-touch summary stays with your account until you delete the account. Anonymous first-touch summaries expire after 90 days without activity.
The one word about where your account came from stays with your account until you delete the account, and is deleted with it.
Account deletion and retained audit data
You can start self-service account deletion from your Profile page and follow its progress with a private receipt.
After deletion, WThumb may keep deidentified records under a random audit identifier, such as the outcome, format and coarse dates of past runs and past credit movements. None of these records includes a user ID, email, display name, file, prompt, instructions or anything else that links it back to you.
Your choices and rights
You can delete a persona or one of its photographs from Personas. Finished thumbnails stay in your account until you delete the account, which you can do from your Profile page.
You can ask for a copy or correction of your personal data, object to or restrict its use, or ask for a portable copy by writing to privacy@wthumb.co. You may also complain to the data-protection authority available where you live.
Cookies
WThumb uses cookies needed for sign-in and a private account-deletion status receipt. The deletion receipt is kept while deletion is in progress and for up to seven days after it completes. Vercel's page-view and performance count remains cookieless. Google Analytics cookies, Microsoft Clarity cookies, the affiliate referral kept in your browser's storage, and WThumb's random first-party analytics visitor cookie stay off unless you choose Allow cookies. If you choose Only necessary, WThumb stores no first-party journey and Google Analytics is not loaded, so nothing is sent to it. The one word kept when you create an account, described under What we collect, is not a journey and sets no cookie, so it is kept either way. Reopening Cookie settings withdraws analytics consent, clears WThumb's analytics visitor cookie, and removes the affiliate referral kept in your browser's storage.
Children
WThumb is not for children. You need to be 16, or the age at which you can agree to a service like this where you live if that age is lower.
Who runs WThumb
WThumb is operated by Erdem Erdoğdu, a sole trader based in Istanbul, Türkiye.
These terms are governed by the law of the Republic of Türkiye. Nothing in them takes away a right you have under the consumer or data-protection law of the country you live in.
For anything about the product (a question, a complaint, or a bug), write to info@wthumb.co. For anything about your personal data (a copy of it, a correction, or a deletion), write to privacy@wthumb.co, which reaches the same person.