Legal

Privacy Policy

Last updated: October 27, 2026

The short version

We collect what we need to make your thumbnails, run your account and take payments. Nothing more.
We never save your photos or thumbnails. They're held only in our server's memory while you work, and deleted 1 hour after your last action. Download the thumbnails you want to keep.
We don't sell your data, show ads, or use analytics or advertising cookies.
Your images are processed by Google Cloud's AI models to make thumbnails; Stripe handles card payments.
You can ask to see, correct or delete your data at any time: support@viralthumbnail.app.

1. Who is responsible for your data

ViralThumbnail ("we", "us"), operated from Mexico, is responsible for the personal data described here. For anything about your data, write to support@viralthumbnail.app.

2. What we collect and why

Data	Why we use it
Account: name, email, and your password (stored only as a salted hash), or your Google name and email if you sign in with Google.	To create and secure your account and contact you about it.
What you upload: photos of you, product or scene images, video frames, the video title, notes, description and edit instructions.	To plan and generate your thumbnails, and to screen them for safety. Never saved to disk (see section 5).
Generated thumbnails and their concepts and headlines.	To show them to you, let you edit them and download them. Never saved to disk (see section 5).
Your YouTube channel ID and the thumbnails of its latest public videos, if you use the channel-style feature.	To match your channel's look. We fetch them from YouTube's public feed.
Payments: your Stripe customer ID, what you bought, and your credit history. Card details go directly to Stripe; we never see or store them.	To add credits, manage subscriptions, handle refunds and prevent fraud.
Usage records: which actions you ran (plan, render, edit), when, and the AI calls they made.	To apply credits and daily limits, prevent abuse, and understand our costs.
Technical logs: IP address, pages and API addresses requested, browser type, errors.	To keep the service secure and working, and to investigate problems.

We process this data to provide the service you asked for (our contract with you), to meet legal obligations (for example, payment records), and for our legitimate interest in keeping the service secure.

3. AI processing

To make your thumbnails, your uploads and text are sent to Google Cloud's Vertex AI (Gemini models and the Nano Banana Pro image model) and screened by Google Cloud Model Armor. Google processes this data as our service provider, under Google Cloud's terms, which don't allow it to use our customers' data to train its AI models without permission. When trend research is on, your video title and topic may be used in Google Search queries.

4. Who we share data with

Google Cloud: hosting (servers in Iowa, United States), AI processing, logs and backups.
Google: sign-in, if you choose "Continue with Google".
Stripe: payments, subscriptions and refunds.
YouTube: our server requests your channel's public feed, if you use the channel-style feature.
Authorities, only when the law requires it.

We don't sell personal data and don't share it for advertising. Because our servers are in the United States, your data is transferred there; our providers protect it under their own data-protection terms.

5. How long we keep it

Data	Kept for
Your uploaded photos, images and video frames, and the thumbnails we generate	Never written to disk or backups. They're held only in the server's working memory while you work, and deleted 1 hour after your last action, or at once if the server restarts. Video frames you send for analysis are discarded as soon as the analysis finishes.
Your project's text: title, notes, concepts and headlines	Deleted together with its images.
Account, credit history and usage records	While your account is open. When you ask us to delete your account, we delete them, except payment records we must keep by law.
Payment records	As long as tax and accounting law requires (in Mexico, generally 5 years).
Technical logs	Up to 30 days.

Download the thumbnails you want to keep. Once deleted, they can't be recovered, by you or by us.

6. Cookies and local storage

ts_session: keeps you signed in, for up to 30 days. Required for the app to work.
A short-lived cookie during Google sign-in, to protect the sign-in from forgery.
Your light or dark theme choice, saved in your browser's local storage.

We don't use analytics, tracking or advertising cookies. Stripe's checkout page sets its own cookies, under Stripe's privacy policy.

7. Your rights

You can ask to access your data, correct it, have it deleted (cancellation), or object to a use of it (the ARCO rights under Mexico's data protection law), and you can withdraw your consent. Write to support@viralthumbnail.app from your account's email address, saying what you'd like. We'll reply within 20 business days. To delete your account, write to the same address; we'll confirm when it's done.

8. Security

All traffic is encrypted with HTTPS. Passwords are stored only as salted hashes, your images exist only in the server's memory and are never written to disk, and access to the server is limited to us. No system is perfectly secure; if a breach affects your data, we'll tell you without undue delay.

9. Children

ViralThumbnail is for people 18 and older. We don't knowingly collect data from children. If you think a child has given us data, write to support@viralthumbnail.app and we'll delete it.

10. Chrome extension

When you use the ViralThumbnail extension in YouTube Studio, it reads what you need to make a thumbnail (the video's title and description, frames from the video you select, and your channel ID from the page address) and sends it to us, only when you use it. It's handled exactly as described above.

11. Changes to this policy

If we change this policy in an important way, we'll tell you by email or in the app before the change applies.

12. Contact

Privacy questions and requests: support@viralthumbnail.app.