Privacy Policy

1. Information we collect

Information you provide

• Account and identity information: email address, username, password hash, email-verification status, and account-security settings such as two-factor authentication. If you use Google sign-in, we receive your Google account identifier, verified email address, and available avatar.
• Profile and community information: display name, biography, website, location, avatar, banner, Bubble memberships, roles, preferences, and communities you own or moderate.
• Content and activity: threads, posts, replies, reactions, uploads, GIF selections, edits, blocks, notification settings, visits within the Service, and other actions you take.
• Moderation and safety information: reports you submit, report notes, restrictions, appeals, moderation decisions, audit records, and related communications. Reports are shared with the relevant Bubble's moderators as needed for review, but are not shown publicly.
• Payment and creator information: subscription status, plan, renewal dates, invoices, Stripe customer and connected-account identifiers, payout readiness, payment method brand and last four digits, and transaction-related records. Stripe collects and processes full payment-card, bank-account, identity-verification, and tax details; ThinkBub generally does not receive full card or bank numbers.
• Support and legal communications: information you include when contacting us, making a privacy request, or submitting a copyright or other legal notice.

Please do not post sensitive personal information that you do not want made public. Do not submit another person's personal information unless you have the right to do so.

Information collected automatically

• Device and network information: IP address, browser and device information, operating system, request headers, and approximate country derived from your IP address.
• Usage and security information: login times, last-login IP address, pages and features requested, session and authentication events, application and browser errors, rate-limit events, suspected abuse, and service logs.
• Cookies and local storage: session and security cookies keep you signed in, protect forms, and help prevent abuse. Local browser storage remembers theme choice and recent Bubble searches. Session storage helps recover from an expired login. Recent searches stored in local storage remain on your device rather than being saved to your ThinkBub account.
• Anti-abuse signals: Cloudflare Turnstile may process device, browser, network, interaction, and challenge signals to distinguish people from automated abuse.

We do not currently use third-party advertising cookies, cross-site behavioral advertising, or session-replay software.

2. How we use information

We use personal information to:

• create, authenticate, secure, and administer accounts;
• provide profiles, Bubbles, content, uploads, search, notifications, presence, moderation, data exports, subscriptions, and creator payouts;
• personalize settings and remember choices;
• process payments, prevent duplicate charges, handle refunds and disputes, calculate entitlements, and maintain financial records;
• detect, investigate, and prevent spam, fraud, security incidents, policy violations, and illegal or harmful activity;
• respond to support, safety, privacy, and legal requests;
• debug, monitor, maintain, and improve the Service;
• communicate about accounts, transactions, security, policy changes, and the Service; and
• comply with law and enforce our Terms and Community Guidelines.

3. Legal bases for processing

Where European or similar data-protection law applies, we process information under these legal bases:

• Contract: to create your account, provide requested features, process subscriptions, and otherwise perform our Terms.
• Legitimate interests: to secure and improve the Service, prevent abuse, understand basic service operation, enforce rules, and protect users and our rights, where those interests are not overridden by your rights.
• Legal obligation: to keep required financial records, respond to valid legal process, and meet tax, accounting, safety, and regulatory duties.
• Consent: where we specifically ask for consent. You may withdraw consent at any time, without affecting earlier processing.
• Vital interests and public interest: in rare cases where processing is necessary to protect someone's life or safety or perform a task recognized by law.

4. How we disclose information

We disclose information only as described below:

• Other users and the public. Your username, profile, public content, reactions, roles, and related activity may be visible to others. Subscriber-only content is visible to users with the relevant access and to authorized moderators and service administrators.
• Bubble owners and moderators. They may receive membership information, reports, moderation history relevant to their Bubble, and the information needed to manage their community. They may use it only through the Service and consistently with our rules and applicable law.
• Service providers. Vendors process information for hosting, databases, email, security, storage, media delivery, error monitoring, and other infrastructure. Depending on the feature and production configuration, these include Bunny.net for file storage and CDN; Mux for video processing, streaming, and playback analytics; Sentry for error monitoring; and our hosting and email providers.
• Payments. Stripe processes subscriptions, payment methods, invoices, fraud signals, identity verification, connected creator accounts, and payouts. Information may be shared among ThinkBub, Stripe, subscribers, and creators as needed to process and support a transaction.
• Features you choose. Google processes information when you choose Google sign-in. Klipy receives GIF search requests when you use the GIF picker. Google Fonts and jsDelivr may receive ordinary network information, including your IP address and request details, when your browser loads fonts or emoji assets.
• Legal, safety, and enforcement. We may preserve or disclose information if we reasonably believe it is necessary to comply with law or valid legal process; enforce our policies; detect or prevent fraud, abuse, or security threats; or protect the rights, property, or safety of ThinkBub, our users, or others.
• Business transfers. Information may be disclosed as part of due diligence or transferred in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections.
• At your direction. We disclose information when you ask us to or give us permission.

We do not sell personal information for money. We do not currently share personal information for cross-context behavioral advertising or use it for targeted advertising.

5. Cookies, local storage, and tracking choices

ThinkBub uses cookies and similar browser storage that are necessary to operate the Service, maintain sessions, protect requests, prevent abuse, save your theme, remember recent searches on your device, and recover from an expired session. Blocking necessary cookies may prevent login or other features from working. You can clear cookies and local storage through your browser settings.

Because we do not currently track your activity across unrelated websites for behavioral advertising, ThinkBub does not respond differently to legacy browser Do Not Track signals. At present, there is no sale or targeted-advertising sharing for a Global Privacy Control signal to opt out of. If our practices change, we will recognize legally required opt-out signals.

Other parties may receive ordinary network and usage information when your browser loads their features, as described in Section 4. We do not authorize them to track you across unrelated services for ThinkBub advertising.

6. Data retention

We keep personal information for as long as reasonably necessary to provide the Service and for the purposes described in this policy. Retention depends on the type of information and may continue as needed to:

• maintain your account, content, communities, and subscriptions;
• preserve security, moderation, fraud-prevention, consent, and audit records;
• complete transactions and meet tax, accounting, payment-network, and legal obligations;
• resolve disputes and enforce agreements; and
• maintain disaster-recovery backups for a limited period.

Data-export download links expire after 48 hours, and the stored export is removed by a scheduled cleanup afterward. Deactivating an account is reversible and does not delete it. Requesting deletion soft-deletes the account, ends access, and removes certain relationships and generated export files. Public contributions, moderation records, transaction records, logs, records held by Stripe or other providers, and backup copies may remain where needed for the purposes above. We may de-identify retained contributions or display them as belonging to a deleted user.

We will delete or de-identify information when it is no longer reasonably needed, unless law permits or requires longer retention.

7. Your choices and rights

Depending on where you live, you may have rights to:

• access and receive a portable copy of personal information;
• correct inaccurate information;
• delete information;
• restrict or object to certain processing;
• withdraw consent;
• opt out of a sale, targeted advertising, or certain profiling;
• appeal our refusal of a privacy request; and
• complain to your local data-protection authority.

You can update common account and profile information, manage subscriptions, deactivate or delete your account, and request a machine-readable data export in Settings. You may also email [email protected]. We may need to verify your identity before completing a request. Authorized agents may submit requests where the law permits, but we may require proof of authority and identity.

We will not discriminate against you for exercising a privacy right. Some rights have legal exceptions. For example, we may retain information needed for security, payment records, legal claims, or another user's freedom of expression.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No service can guarantee absolute security. Use a unique password, enable two-factor authentication where available, and contact [email protected] if you believe your account or information is at risk.

9. International data transfers

ThinkBub and its providers may process information in the United States and other countries whose data-protection laws differ from those where you live. Where required, we use approved contractual safeguards or another lawful transfer mechanism. Contact [email protected] to ask about applicable safeguards.

10. Children

ThinkBub is not directed to children under 16, and they may not create accounts or use the Service. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided personal information, contact [email protected] so we can investigate and take appropriate action.

11. Changes to this policy

We may update this Privacy Policy as our practices or legal obligations change. We will post the revised policy and update the date above. If a change materially affects how we use personal information, we will provide reasonable additional notice, such as an in-service notice or email.

12. Contact

thinkbub LLC
502 W 7th St, Suite 100
Erie, PA 16502-1333
Phone: (302) 319-2903
Privacy email: [email protected]
Security email: [email protected]

If European data-protection law applies to you, you may also complain to the supervisory authority where you live, work, or believe a violation occurred.