1. Information we collect

Account information. If you create an account, we collect your email address and the credentials needed to authenticate you. We don't ask for your real name, address, or phone number.

Payment information. Payments are handled entirely by Stripe. We receive confirmation that a payment succeeded and the pass it purchased, but your card number, CVV, and full billing details are sent directly to Stripe and never touch our servers.

Usage & device data. We keep basic view-count, reaction, and comment data tied either to your account or to an anonymous device cookie if you browse signed out, so that features like view counts, per-tile reactions, "you might also like," and comments work. We also log standard technical data (IP address, browser type, request timestamps) for security, rate limiting, and abuse prevention.

Content you submit. Comments and reactions you post are stored and displayed publicly under a short, non-identifying label — not your email address.

2. Cookies

We use a small, fixed set of cookies:

• Authentication cookie — keeps you signed in between visits.
• Age-verification cookie — remembers that you confirmed you're 18+, so you're not asked again every visit.
• Anonymous ID cookie (cp_anon) — a random identifier used for ad-unlock access and view tracking when you browse signed out. It contains no personal information and isn't linked to your identity unless you later sign in.
• Cookie-consent cookie — remembers whether you accepted or declined non-essential cookies from the banner.

We don't use third-party advertising or tracking cookies of our own; our ad-unlock partner may set its own cookies while you're on its offer pages, governed by its own privacy policy.

3. How we use your information

We use the information above to:

operate your account and remember your sign-in state; process pass purchases through Stripe and grant the access they paid for; grant and track temporary ad-supported unlocks; show accurate view counts, reactions, and "you might also like" recommendations; display and rate-limit comments to prevent spam and abuse; detect and prevent fraud, abuse, and security incidents; and respond to support requests you send us.

We don't use your information for targeted advertising, and we don't sell or rent your personal information to third parties.

4. Who we share it with

We share information only with the service providers that make ThotDen work: Stripe (payment processing), Supabase (our database, authentication, and hosting infrastructure provider), Vercel (application hosting), and our ad-unlock content-locker partner (only when you choose the ad-unlock option, and only to the extent needed to verify you completed the offer). Each of these providers processes data on our behalf under their own security and privacy commitments. We may also disclose information if required by law, subpoena, or valid legal process, or to protect the rights, property, or safety of ThotDen, our users, or the public.

5. Data retention

We keep account data for as long as your account is active. View, reaction, and comment data tied to an anonymous cookie is kept in aggregate/anonymized form once it's no longer needed for the features it supports. If you delete your account (available from your account settings, or by emailing us), we delete your account record and associated personal data within a reasonable period, except where we're required to retain certain records (for example, payment records) for legal or accounting purposes.

6. Data security

We use industry-standard measures — encrypted connections (HTTPS), access controls, and row-level security on our database — to protect your information. No method of transmission or storage is 100% secure, and we can't guarantee absolute security, but we work to keep the amount and sensitivity of data we hold as low as reasonably possible.

7. Children's privacy

ThotDen is strictly for adults and is not directed at, or intended for use by, anyone under 18. We don't knowingly collect information from minors. If we learn that we've collected information from someone under 18, we'll delete it promptly — contact us at privacy@thotden.com if you believe this has happened.

8. Your choices & rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can export your data or permanently delete your account and its data at any time from your account settings, or by emailing privacy@thotden.com. We'll respond to verified requests within a reasonable time. You can also decline non-essential cookies from the cookie banner, and browser settings let you block or clear cookies generally (though this may affect features like staying signed in).

9. International users

ThotDen is operated from the United States, and information we collect is processed and stored there and by our service providers' infrastructure, which may be located in other countries. By using the Service, you consent to your information being transferred to and processed in the United States and other jurisdictions that may have different data-protection laws than your own.

10. Changes to this policy

We may update this Privacy Policy from time to time; the "Last updated" date above reflects the most recent revision. If we make a material change, we'll make reasonable efforts to bring it to your attention (for example, a notice on the site). Continuing to use ThotDen after a change takes effect means you accept the updated policy.

11. Contact

Questions about this policy, or want to exercise one of the rights above? Email privacy@thotden.com. See also our Terms of Service and refunds, copyright & support page.