Privacy Policy

We store your email address, account status, and account creation time. If you create a password, we store a one-way password hash, never the original password. We also process session identifiers, IP addresses, and request information needed to authenticate you, prevent abuse, and protect the service.

When you choose Google sign-in, Google provides a verified email address and a stable account identifier. We use this information only to create, link, and authenticate your Thundernail account. We do not request access to Gmail, Google Drive, contacts, or other Google product data.

We use account information to register and authenticate users, maintain secure sessions, deliver verification and password-reset messages, enforce rate limits, resolve account conflicts, and respond to support or security requests. We do not sell personal information or use Google account data for advertising.

If you complete a profile, your username, display name, avatar, bio, profile privacy status, and aggregate follower and following counts form your public profile identity. You can also add optional gender, location, and profile-language details and choose whether Everyone, Followers, or Only you may see each detail. One visibility setting controls both your follower and following lists, while private mode limits optional details and social lists to approved followers. We store accepted relationships, pending follow requests, and limited decline timing needed for the seven-day retry cooldown. Accepted relationships are used to calculate aggregate follower and following counts. Directional block records are private to the person who created them. Blocking removes follows and pending requests in both directions and hides the two accounts from each other across profiles, search, social lists, requests, and related counts. If you upload an avatar, the application corrects its orientation, crops it square, removes embedded metadata, discards the original upload, and stores only 128-pixel and 512-pixel WebP versions. Those versions are publicly delivered through Cloudflare R2 so that your avatar can appear on profiles and profile lists until you replace or remove it.

We share only the information necessary to operate the service with providers that support authentication, email delivery, hosting, and network security. These currently include Google, Resend, DigitalOcean, and Cloudflare. Each provider processes information under its own terms and privacy commitments.

We use secure, HTTP-only session cookies and protect credentials in transit and at rest using appropriate technical controls. Account and security records are retained while needed to operate and protect the service. Terminal email-delivery records are removed on a scheduled basis, and expired sessions and authentication tokens are not accepted.

You may request access to, correction of, or deletion of your account information by contacting us. You may also stop using Google sign-in and use an available email-and-password credential. Disconnecting Thundernail from your Google Account does not by itself delete your Thundernail account.

For privacy questions or account-data requests, email [email protected].