THRUM PRIVACY POLICY

Document ID: thrum-privacy Version: 1.11 Last Updated: November 2, 2026

This Privacy Policy describes how THRUM LLC, a Washington limited liability company with a principal address of 316 Queen Anne Dr, Seattle, WA ("Thrum," "we," "us"), collects, uses, and discloses personal data in connection with the Thrum licensing web service and website (the "Service," as defined in the Thrum Terms of Service) and the license-verification communications made by the downloadable Thrum software (the "Software," as defined in the Thrum End User License Agreement, or "EULA"), and the optional iPhone notification service described in Section 1.6 (the "Push Relay"). This Privacy Policy should be read together with the Terms of Service and the EULA.

The Software itself runs locally on your device; Thrum does not operate a hosted platform where you use the Software's coding functionality. The data described below relates to your account, your Subscription, the periodic License Check-In performed by the Software, the install count, the page-view counts on our websites, and, if you turn it on, the Push Relay. It does not relate to the content you create or process locally using the Software.

1. Information We Collect

Thrum collects a deliberately minimal amount of personal data. We do not collect your files, your source code, your prompts, or anything about how you use the Software. What we hold is limited to what we need to run your account, verify your licence, and see which of our marketing works: your email address; a name and a physical address, only if you choose to give them; your subscription status and plan; a random installation identifier and device-class label generated by the Software on your device; a record of that identifier, the Software's version, and your operating system for the install count in Section 1.3; any support correspondence you send us; only if you turn on iPhone notifications, your phone's push token and records of the alerts we deliver to it; if you register or buy after following one of our campaign links, the campaign that link names; your answer to our question about what made you try Thrum, or that you skipped it; and page-view counts for our websites, which do not identify you. Sections 1.1 through 1.8 describe each of these.

1.1 Account and Identity Data. When you register for the Service, we collect your email address. If you choose to add a name to your account, we store it; giving one is optional. If you choose to provide a physical address (for example, for billing correspondence or invoicing purposes), we store that address; providing it is optional. If you choose to sign in with your Google or GitHub account instead of a password, that provider confirms your identity to us. We receive your email address, whether the provider has verified it, and the provider's identifier for your account. We store that email address and identifier, linked to your account so you can sign in with it again, together with when you linked it and when you last used it. We do not receive your name or profile picture from the provider.

1.2 Subscription and Billing Data. We keep a record of your Subscription status (active, cancelled, lapsed) and plan tier so the Service can issue and verify your license. For purchases through our online checkout, we do not collect or store your payment card or other billing details ourselves: payment card information, billing addresses used for payment, and related billing data are collected and processed directly by Lemon Squeezy, acting as merchant of record (see Section 3). If you buy directly from us under a written order, such as a company license, we keep the billing contact, address, and invoice details needed for that order.

1.3 License Check-In and Activation Data. The Software contacts our licensing service in three distinct situations, and they transmit different things.

Periodic License Check-In. When the Software periodically verifies that your Subscription is active, it transmits only two items: (i) an opaque credential issued to you by our licensing service, and (ii) a randomly generated installation identifier. The installation identifier is generated by the Software on your device and is not derived from your hardware. The periodic License Check-In transmits no repository information of any kind.

One-time device activation. When you first link a device or repository to your Subscription, the Software transmits the installation identifier and a device-class label. If the activation concerns a repository, it also transmits an identifier for that repository and its address, with any embedded credentials removed. We use the address only to work out your licence, and we delete it within about 7 days.

Open-source eligibility check. When you initialize or register a repository with a registered installation, the Software sends our licensing service the repository's canonical origin URL (for example https://github.com/owner/repo, with any embedded credentials removed), a repository identifier, and a commit hash, so that we can check whether the repository is public open source and eligible for a free grant. This happens for private repositories too. If the repository is private or not eligible, we use the URL only for that check and do not store or log it. If the repository is public and eligible, we store its URL linked to your installation so that we can re-check eligibility each month, until the grant ends or you delete your account.

Free use. On a device where you have never activated a Subscription, the Software contacts a server we operate only for the install count below, and when you ask it to, such as when you activate the device or register a repository. Your acceptance of the EULA is recorded on your own machine, not by us. If your Subscription lapses, the Software keeps making the periodic License Check-In described above, with the same two items, until you deactivate the licence on that device with thrum license deactivate. That way a renewal is picked up automatically.

Install count. The first time you accept the EULA at its prompt on a device where you have never activated a Subscription, the Software can send a server we operate, once, the device's randomly generated installation identifier, which includes the time it was created, the version of the Software, and the name of your operating system, so that we know the Software was installed. It sends no account, machine name, or repository information. It is not sent at any other time or retried, and a failed attempt does not affect the Software. If your device's time zone is one in the fifty United States, the Software shows you this notice and sends the count unless you have set DO_NOT_TRACK=1 or THRUM_NO_INSTALL_PING=1. Otherwise, the Software asks you once, and sends nothing and creates no identifier for this purpose unless you say yes. The time zone is checked on your device and is not sent to us. We keep one record for each identifier, for 30 days, wherever it comes from. Unless the conditions below are met, we do not link the record to any account and cannot tell from it who you are. If within those 30 days that device holds a paid, complimentary, or open-source Subscription (a free trial does not count), we link the record to your account, because activation uses the same identifier, which shows us when that install first appeared and how Free installs become paid ones. We do not store your IP address with the record. If you object, find the identifier with thrum daemon status, enter it at https://my.thrum.team/install-count, or email it to leon@thrum.team, and we will delete the record permanently, whether or not you have a Subscription. It may remain in our backups for up to 70 days (Section 7). We keep no log of the identifiers submitted on that page. If that device has a Subscription, the identifier stays in use for its license, as described above; removing that device from your account or deleting your account deals with that separately.

Model download for local search. If you use the Software's local semantic search, it downloads its model files once from our release page on GitHub. That download is served by GitHub, which sees your IP address under its own privacy statement. We see only GitHub's total download count for each file, never who downloaded it.

IP address. Connecting to our licensing service necessarily discloses your IP address at the network layer. We use it only to rate-limit requests and to control access to administrative functions, and to protect the Service against abuse. We do not store it in your account record or associate it with your identity. Our servers' logs do not record visitor IP addresses. Those logs are deleted after 30 days at most. Our network security provider, Cloudflare, keeps IP addresses in its security logs for up to 7 days (see Section 5).

What is never transmitted. None of these calls transmits the contents of your files, source code, repositories, prompts, agent messages, or other work product. Thrum operates no diagnostics, telemetry, or crash-reporting channel that transmits any of them. The Software runs locally on your device, and these calls do not give Thrum access to your usage of the Software or the content you create or process locally (see Section 2).

1.4 Website Usage Data. Our servers' logs do not record your IP address, your email address, or your browser's details. They record errors, service events, and performance data. When something needs tracing, such as a failed payment notice or an activation error, a log line can carry internal reference numbers, such as those for your account, machine, subscription, or an email we sent you, which on their own do not show who you are. The performance data is what we need to find slow pages: for each request, the kind of page asked for (for example, the activation page, never its full address), the response status and size, and how long it took. We keep the performance data for no more than two days. Cloudflare processes connection data, including your IP address, to protect the site, and keeps it in security logs for up to 7 days. We do not use any of this data to build a profile of you.

Page-view counts (Plausible). Our website at thrum.team, and some pages of my.thrum.team, use Plausible Analytics to count page views. When you open one of these pages, your browser loads a small script from plausible.io and sends Plausible the page's address, the site that linked you there, and your browser's user-agent string, and Plausible sees your IP address. On thrum.team, the address can include campaign tags such as utm_source; on my.thrum.team, we send only the page's path, with no query string. Plausible uses your IP address to find your approximate location (country, region, and city), and your user-agent to find your browser, operating system, and device type. To count unique visitors, it combines your IP address and user-agent with a random value that it deletes every 24 hours, so it cannot recognise you on another day or on another site. Plausible also records how far down the page you scroll and how long it stays open. On thrum.team only, it also records when you click a link to another site or download a file (with that link's address), and when you submit a form (only that it happened, never what you typed). Plausible does not store your IP address or full user-agent string, and it sets no cookies and stores nothing on your device. We see only totals, such as how many people visited a page and where they came from, never who you are. We send Plausible no account or other identifying details. On my.thrum.team, only the home, pricing, registration, login, forgot-password, support, and legal pages, and your account page, load the script. No page whose address carries a code or token loads it, and neither do pages for activating a machine, signing in with Google or GitHub, confirming your email, resetting your password, unsubscribing, the install count, removing a machine, cancelling, or checkout results, nor error pages.

1.5 Support Communications. If you contact us for support (for example, by opening a support ticket), we collect the information you provide in that correspondence, including your contact details and the contents of your message, so we can respond to you. Messages you send through the support form on my.thrum.team are delivered to our support mailbox, which Google Workspace hosts.

1.6 iPhone Notifications (Push Relay). If you install the Thrum iPhone app and turn on notifications, the Software on your machines can alert your phone when one of your agents needs you, for example when it asks you a question. These alerts go through a push relay that we operate at app.thrum.team, on the same infrastructure as the rest of the Service (Section 4). From there they go through Apple's Push Notification service (APNs), which is the only way an app can deliver notifications to an iPhone. If you never turn on notifications, none of this happens and we hold none of this data.

What an alert contains. Each alert carries random identifiers for the message, conversation thread, or question it relates to, and a priority level. The identifiers are generated separately for each of your machines and are not derived from the content, from names, or from your repositories. An alert never contains message text, transcripts, code, file paths, or repository names. It carries a sender name only if you have turned on sender names in the Thrum Software on the machine the alert comes from, and only for alerts from that machine. If you do, that name appears in notifications on your phone, including on the lock screen, outside the Thrum app.

The iPhone app. The Thrum iPhone app talks directly to the Software on your own machines, over your local network or your own private network. Your messages, replies, and transcripts go between your phone and your machines without passing through Thrum, and the app keeps its cached messages, pairing credentials, and settings on your phone. The app has no in-app analytics, no third-party crash reporting, no advertising or tracking code, and no Thrum sign-in. It uses the camera only to scan the pairing code shown by your machine, and it captures and keeps no image. When you turn on notifications, your phone hands its push token to your paired machine, and that machine registers it with the Push Relay.

What we keep. For each phone that has notifications turned on, we keep: the push token Apple issues for it, whether it uses Apple's test or production service, your account identifier, the identifier of the machine it is paired with, the date it was registered and last updated, and a version number. We do not keep your phone's name, model, location, or IP address, or the version of the app. For each alert we also keep a delivery record: your account, the machine and phone involved, the time of the event, the number of delivery attempts, and the outcome. We use these records only to deliver alerts and retry failed ones, and never to analyse how you use the Software. Section 7 says how long we keep them.

Reports Apple shares with us. If you choose, in your iPhone's settings or in TestFlight, to share analytics or crash data with app developers, Apple may share crash reports and usage statistics about the Thrum app with us. Apple collects these under its own privacy policy. We use them only to find and fix problems in the app.

1.7 Which link brought you to us. If you arrive at my.thrum.team through a link that carries campaign tags (for example ?utm_source=newsletter&utm_campaign=launch), and you register or start a checkout during that visit, we record the source, medium, and campaign named in that link against your account and against that order. We use this only to learn which of our announcements and marketing bring people to Thrum, and we delete it six months after we record it. We do not use a cookie or any other identifier for this, so we see only the link you arrived through on that visit. We do not record advertising click identifiers, and we do not pass campaign tags to Lemon Squeezy or anyone else. Separately, we keep daily totals of visits, registrations, and checkouts for each campaign. Those totals are not linked to anyone.

1.8 What made you try Thrum. Your account page may ask what made you try Thrum, with a few choices and an "Other" box for a short answer in your own words. Answering is optional, and nothing depends on it. If you answer, we keep your choice and anything you type, linked to your account, and use them only to learn why people try Thrum. If you skip the question, we keep only that you skipped it and when, so that we don't ask again. Please don't put personal or confidential details in the "Other" box. We do not share your answer with anyone. We delete your answer, or the record that you skipped, 12 months after we record it, or sooner if you delete your account, and keep only totals for each choice and for skips, which are not linked to anyone.

2. How We Use Information

We use the minimal information described above to: provide and maintain the Service, including issuing and verifying license Subscriptions; process and manage your account; communicate with you about your Subscription, updates, or support requests; detect and prevent fraud, abuse, or unauthorized use; comply with legal obligations; improve the Service; and learn which of our marketing works.

Thrum is not a hosted platform. The Software runs locally on your own device — you do not use it "in" a Thrum-operated service. As a result, Thrum does not have access to, and does not collect, your usage data or the content you create or process locally using the Software. The install count in Section 1.3 tells us only that an install happened, with its identifier, version, and operating system, and, if you later activate that device, that it is yours. The License Check-In described in Section 1.3 exists solely to verify that your Subscription is active; it is not a mechanism for monitoring how you use the Software. The Push Relay described in Section 1.6 only delivers the alerts you have asked for, and it never carries the content of your work.

Legal bases (EEA, UK, and Switzerland). Where the GDPR or a similar law applies, we rely on the following legal bases:

Where we rely on legitimate interests, you may object at any time (see Section 9). We do not send marketing messages, except that if you register before buying opens, we email you once to say that it has. To opt out, use the link in that email or tell us at leon@thrum.team. We keep a record that we sent it for up to 90 days, and any opt-out until you delete your account.

2.1 Model providers and other services you connect the Software to

The Thrum Software is a tool for orchestrating AI coding agents. When you use it, it sends your prompts, and the file contents and repository context you direct it to send, to the AI model provider you have configured — for example Anthropic, OpenAI, or a model you run yourself. It does this directly from your machine to that provider, under your own account and API key. That traffic does not pass through Thrum, and we never see it.

Your relationship with each model provider is your own. Their privacy policy and terms — including whatever they say about retention and about training on your data — govern that data, not this Policy. We encourage you to read them. If you configure the Software to use a locally hosted model, no data leaves your machine at all.

This is the same boundary described in Section 1.3. The only things the Software ever sends to Thrum are licence-verification data and, if you turn on iPhone notifications, the alert data described in Section 1.6. Neither includes your prompts, code, or agent messages.

3. Payment Data — Handled by Our Merchant of Record

Billing and payment processing for purchases through our online checkout is performed by Lemon Squeezy, acting as merchant of record for those sales. Lemon Squeezy collects and processes your payment card and related billing information directly; Thrum does not store your full payment card details. Lemon Squeezy's own privacy policy governs its handling of your payment data.

4. Hosting and Infrastructure

The Service (account portal, licensing service, and Push Relay) is hosted by Hetzner in its data centre in Hillsboro, Oregon, United States. Data transmitted during a License Check-In is processed on infrastructure operated by Hetzner in that location. We keep backups of the Service's database, and of the records of the agreements you accept, in Google Cloud Storage in the United States, encrypted in transit and at rest, so that we can recover the Service after a failure. Push Relay data is not included in these backups.

5. Third Parties and Subprocessors

We share personal data with the following categories of service providers, each acting to support the Service:

• Lemon Squeezy — our merchant of record for online checkout purchases. Lemon Squeezy is the seller in the payment transaction and acts as an independent controller of your payment data under its own privacy policy. We receive from Lemon Squeezy only your name, email address, and subscription status; for that limited data Lemon Squeezy acts as our processor under its data processing addendum (Section 3).
• Hetzner — infrastructure hosting for the Service. Hetzner acts as our data processor under a written data processing agreement meeting the requirements of GDPR Article 28, and processes personal data only on our instructions. Our infrastructure is located in Hillsboro, Oregon, United States.
• Google — Google Cloud stores the backups described in Section 4, and Google Workspace hosts our email, including messages you send through the support form. For these, Google acts as our processor under its data processing terms. If you choose to sign in with Google, Google confirms your identity to us under its own privacy policy.
• Resend — sends the emails the Service sends you, such as sign-up confirmations, sign-in links, and notices about our agreements. Resend receives your email address and the content of each message, and acts as our processor.
• GitHub — if you choose to sign in with GitHub, GitHub confirms your identity to us under its own privacy statement. When we check whether a public repository is eligible for the open-source grant, our servers look that repository up on GitHub; that lookup sends GitHub nothing about you.
• Cloudflare — network security, DDoS protection, and rate limiting for requests to the Service. Requests to my.thrum.team and app.thrum.team pass through Cloudflare, which records connection data including IP addresses for security purposes and keeps it in security logs for up to 7 days. Our login, registration, and password-reset pages also use Cloudflare Turnstile to check that you are not a bot. Your browser loads Turnstile from challenges.cloudflare.com, which receives your IP address, your browser's user-agent string, and technical details of your connection. Cloudflare processes these to provide the check for us, and, under its own Turnstile privacy policy, also uses them as a controller to improve its bot detection.
• Plausible — Plausible Insights OÜ, an Estonian company, counts page views on our websites as described in Section 1.4. It acts as our processor under its data processing agreement and stores the data in the European Union.
• Apple — if you turn on iPhone notifications, Apple's Push Notification service (APNs) delivers each alert to your phone. For each alert, Apple receives your phone's push token, the alert identifiers and priority described in Section 1.6, the time we send the alert, and delivery timing. It receives a sender name only for alerts from a machine where you have turned sender names on. Apple receives no message content. Apple handles this data under its own terms and privacy policy.
• Professional advisers — our accountants and lawyers, where necessary and subject to confidentiality.
• Legal and safety disclosures — we may disclose personal data where required to do so by law, or in response to a valid subpoena, court order, or other lawful request, and where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers — if Thrum is involved in a merger, acquisition, financing, or sale of all or part of its assets, personal data may be transferred as part of that transaction. We will notify you before your personal data becomes subject to a different privacy policy.

We do not sell personal data to third parties.

5.1 Our account portal makes few third-party requests

The pages of my.thrum.team load no fonts, scripts, stylesheets, or any other resource from a third party, with two exceptions: the pages listed in Section 1.4 load Plausible's page-view script from plausible.io, and the login, registration, and password-reset pages load Cloudflare Turnstile from challenges.cloudflare.com (Section 5). Everything else is served from our own systems. We do not embed trackers or advertising pixels, and we do not permit third parties to set cookies through our sites.

6. Cookies

We use only cookies that are strictly necessary to operate your account at my.thrum.team: a session cookie that keeps you signed in, and short-lived security cookies that protect sign-in, forms, and account linking. The session cookie is set with the __Host- prefix and the HttpOnly, Secure, and SameSite=Strict attributes, and the corresponding server-side session is deleted when you log out and whenever you reset your password.

We do not use advertising cookies or tracking pixels, and we do not permit third parties to set cookies through our sites. The page-view counts in Section 1.4 use no cookies and store nothing on your device. Because we set no non-essential cookies, we do not need to ask for your consent to them.

Do Not Track. We do not track you across other websites or over time, and we do not allow third parties to do so through our site. We therefore treat every visitor the same, whether or not your browser sends a "Do Not Track" or Global Privacy Control signal.

7. Data Retention

We keep personal data only for as long as it serves the purpose we collected it for.

• Account data (your email address, and any name or physical address you gave us) — for as long as your account is active. If you close your account or ask us to delete it, we remove or irreversibly anonymise it.
• Subscription and licence records — for as long as your account is active, and afterwards where we need them to meet tax, accounting, or audit obligations.
• Short-lived authentication data — sign-in sessions last up to 30 days and are deleted when they expire, when you log out, or when you reset your password. Email confirmation and password-reset tokens last up to 24 hours and are deleted within about an hour after they expire.
• Buying-opens email records — the record that we sent it, for up to 90 days; any opt-out, until you delete your account.
• Device-linking records (the short-lived code you use to link a device, and any repository address received during activation) — deleted about 7 days after the code expires. A device-linking code is valid for 15 minutes.
• Open-source grant records (the URL of an eligible public repository, linked to your installation) — while the grant is active; deleted when the grant ends or you delete your account. URLs of private or ineligible repositories are never stored.
• iPhone notification records — we delete a phone's registration, including its push token, as soon as you turn notifications off for that phone, Apple tells us the token is no longer valid, or you delete your account. If your Subscription lapses or a machine's licence is revoked, we stop sending to its paired phones, and we delete those registrations after 30 days unless the licence becomes valid again. Per-alert delivery records are deleted within 30 days after the alert is delivered or finally fails. Push Relay operational logs expire within 30 days and never contain alert content or credentials.
• Campaign records (the source, medium, and campaign from the link you arrived through) — deleted six months after we record them, or sooner if you delete your account. Daily campaign totals are not linked to anyone and are kept.
• Answers to what made you try Thrum, and records that you skipped it — deleted 12 months after we record them, or sooner if you delete your account. Totals for each choice and for skips are not linked to anyone and are kept.
• Install-count records — we delete the record 30 days after we receive it. If within those 30 days that device holds a paid, complimentary, or open-source Subscription (a free trial does not count), the record is linked to your account and deleted with it. We keep totals per week, version, and operating system, with no identifier.
• Operational and audit records of licences issued and devices activated — retained as part of our records of the service we provided.
• Backups — when we delete data from the Service, it can remain for up to 70 days until our backups expire. Those are the encrypted backups described in Section 4, and copies of the database we keep on our own server when we update the Service, which are not separately encrypted. We use backups only to recover the Service after a failure.
• Page-view data — Plausible keeps the page-view records for our websites, without your IP address or any identifier that lasts beyond a day, for as long as we use Plausible. We delete our Plausible sites when we stop using it.
• Infrastructure and security logs — Cloudflare security logs containing IP addresses: up to 7 days. Our servers' logs, which do not record visitor IP addresses, are deleted after 30 days at most, and the performance data in them after two days at most.

Agreement acceptance records are retained indefinitely, by design. When you accept the EULA or the Terms of Service, we record the fact, date, time, version, a cryptographic hash of the exact text you accepted, and a copy of that text, together with your account identifier, your email address, and the browser or client you accepted from (its user-agent string). We keep those records for as long as they may be needed to evidence the agreement between us, because the federal E-SIGN Act requires that an electronic record of an agreement remain capable of accurate reproduction, and because we may need them to establish or defend a legal claim.

This is a deliberate exception to deletion. If you ask us to delete your personal data, we will do so — but we retain the acceptance record, because it is the evidence that an agreement was formed. It records that you agreed; it records nothing about how you used the Software.

What this means in practice. When we delete your account, we remove or irreversibly destroy any name you gave us, your password, your linked sign-in identifiers, and the other details attached to your account. Your email address itself is retained, on its own, because it is the identifier the agreement records are tied to — an acceptance record that cannot show who accepted would be worthless as evidence, which is the reason the law permits this retention. Nothing else remains attached to it.

8. Security

We implement reasonable administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8.1 Notification of a data breach. If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to your personal data, we will:

• notify affected individuals without unreasonable delay, and in any event within the time required by applicable law;
• where the breach affects residents of Washington State, provide notice in accordance with RCW 19.255.010, which requires notice to affected consumers no more than thirty (30) days after discovery;
• where the breach affects individuals in the European Economic Area or the United Kingdom and is likely to result in a risk to their rights and freedoms, notify the relevant supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of it, in accordance with Article 33 of the GDPR, and notify the affected individuals directly where the breach is likely to result in a high risk to them (Article 34); and
• include in that notice, to the extent known, the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information.

Nothing in this Section limits any notification right you have under the law of your place of residence.

9. Your Rights

Depending on where you live, laws such as the EU and UK General Data Protection Regulation may give you rights over your personal data. Thrum is a small company and does not currently meet the thresholds that make the California Consumer Privacy Act and similar United States state privacy laws applicable to us. Even so, and given how little data we hold, we offer the following rights to everyone who uses the Service, wherever you live:

• Access. You may ask us what personal data we hold about you.

• Correction. You may ask us to correct inaccurate data.

• Deletion. You may ask us to delete your account data, subject to any legal or accounting retention obligations described in Section 7.

• Restriction/Portability. You may ask us to restrict certain uses of your data or provide it to you in a portable format.

• Objection. Where we process your data on the basis of our legitimate interests, you may object to that processing at any time (GDPR Article 21).

• Withdrawal of consent. Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew it.

• Complaint to a supervisory authority. If you are in the EEA or the UK, you have the right to lodge a complaint with your national data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk); a list of EEA authorities is available from the European Data Protection Board. We would be glad if you raised the matter with us first, but you are not required to.

We will respond to any request under this Section within one month. We may ask you to verify your identity before acting on a request — normally by replying from the email address on your account. We do not charge for responding unless a request is manifestly unfounded or excessive.

Deleting your account ends your licence. If you ask us to delete your account data, we will also be unable to verify your Subscription, and the paid features of the Software will stop working when your current licence token expires. We will tell you this before we act on a deletion request.

To exercise any of these rights, contact us at leon@thrum.team. Because billing and payment data for online checkout purchases is held by Lemon Squeezy rather than Thrum, requests concerning that data should also be directed to Lemon Squeezy under its own privacy policy (Section 3).

10. International Data Transfer

Thrum LLC is a United States company, and the Service is hosted in the United States (Hetzner, Hillsboro, Oregon), with backups in Google Cloud Storage in the United States. If you use the Service from outside the United States — including from the European Economic Area, the United Kingdom, or Switzerland — the personal data you provide is collected directly by us in the United States, and stored and processed there.

We collect this data from you directly. No business in the European Economic Area, the United Kingdom, or Switzerland sends it to us on your behalf, so its collection is not a transfer by an exporter that requires standard contractual clauses or a similar transfer mechanism. Our data protection obligations to you still apply in full: we use your data only for the purposes described in Section 2, keep it only as described in Section 7, and honor your rights under Section 9 wherever you live. Where our own service providers process your data, they do so under data processing agreements with appropriate safeguards. For example, Cloudflare is certified under the EU-U.S. Data Privacy Framework. Plausible processes page-view data in the European Union.

11. Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal data from children under the age of 13 (or such other age as required by applicable law). If we learn we have collected such data, we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy with a revised effective date and, for material changes, provide additional notice as described in the Terms of Service.

13. Contact

Questions about this Privacy Policy, or requests regarding your personal data, may be directed to: leon@thrum.team.

Thrum LLC — EIN 42-4360014 — 316 Queen Anne Dr, Seattle, WA