# Privacy Policy for thomas.md

> This policy describes how Thomas Marchand (th0rgal) collects and uses personal data when you visit thomas.md, claim a license, join the newsletter, or use the beta program.

Effective date: August 2026. Site operator: Thomas Marchand, hey@thomas.md, Lisbon, Portugal.

## What we collect

**Account data.** When you sign in (for example via OAuth), we store your account identifier, email address, and profile fields needed to assign licenses and Discord roles.

**Purchase data.** Payment processors (Stripe, PayPal, Tebex) send webhook notifications that include transaction IDs, amounts, and buyer email addresses. We store this data to fulfill licenses and send purchase-related email.

**Newsletter data.** If you subscribe on [/email](https://thomas.md/email), we store your email address and optional interest tags so we can send updates you asked for.

**Analytics.** We use privacy-oriented analytics (Vercel Analytics and Google Analytics) to measure page views. These services may set cookies or use similar technologies according to their own policies.

**Server logs.** Hosting providers and CDNs may log IP addresses, user agents, and request paths for security and reliability.

## How we use data

We use personal data to deliver purchased licenses, send transactional and follow-up email, operate the beta program, prevent fraud, and improve the site. We do not sell personal data.

## Third parties

Data may be processed by Supabase (database and authentication), Vercel (hosting), Stripe, PayPal, Tebex, Discord (role assignment), and email delivery providers. Each processes data under its own terms.

## Retention and deletion

Purchase and license records are retained as long as needed to honor licenses and comply with tax or legal obligations. You can unsubscribe from the newsletter at any time on [/email](https://thomas.md/email). To request account deletion or data export, email [hey@thomas.md](mailto:hey@thomas.md).

## Your rights

Depending on your jurisdiction (including the EU), you may have rights to access, correct, delete, or restrict processing of your personal data. Contact [hey@thomas.md](mailto:hey@thomas.md) to exercise these rights.

## Changes

We may update this policy. Material changes will be reflected on this page with a revised effective date.