Privacy Policy

This policy explains what RoThumbnail ("we", "us") collects when you use rothumbnail.com, why, who helps us process it, and the choices you have. RoThumbnail is run by an independent developer. Questions: support@rothumbnail.com.

RoThumbnail is an independent tool. It is not affiliated with, endorsed by, or sponsored by Roblox Corporation or YouTube.

What we collect

When you use RoThumbnail without an account

Your first thumbnail doesn't need sign-up. To give you a free credit and keep your thumbnails together, we create a guest session in your browser. For it we store:

a random guest account ID and a session cookie,
your credit balance,
the IP address and browser user agent your session was created from.

Google shares your name, email address, profile picture and Google account ID with us. We also store the sign-in tokens Google issues so your sign-in keeps working. We never see your Google password.

If you signed in from a guest session, the thumbnails from that session move to your account.

What you give the generator

Your text prompt. We store it with the thumbnail it produced, so your history is complete.
Images you upload (screenshots, avatars, photos of yourself). They are resized in your browser, sent to our AI provider to generate your thumbnail, and not stored by us afterwards. Only upload photos of people who have agreed to it.

What the generator produces

Your thumbnails. We store every thumbnail you generate so you can find and download it again in My thumbnails.
A record of each generation: the style and size you chose, whether you added an image, the result (finished, failed or blocked) and the time.

Payments

Payments are handled by Waffo.com Limited ("Waffo"), which sells our plans and credit packs to you as our merchant of record and handles tax. Waffo's own privacy policy applies to the details you enter at checkout. We receive and store your order and subscription IDs, plan and payment status. We never receive or store your full card details.

Support messages

If you contact us, we keep your name, email address and message so we can reply.

Technical and abuse-prevention data

To stop people farming free credits, we count guest sessions and new accounts per IP address per day. These counters are deleted after 48 hours.
Cloudflare Turnstile checks that a real person is starting a guest session. It evaluates signals from your browser and device; see Cloudflare's privacy policy.
Our hosting provider keeps short-term server logs (such as IP address, requested page and time) for security and troubleshooting.

Usage analytics

We use PostHog to see how the site is used: pages visited, referring site, device and browser type, approximate location from your IP address, and actions such as generating or downloading a thumbnail, opening the pricing page and starting or completing a checkout. Session replays record how you move through the site, with text typed into fields masked. Once you sign in, these events are linked to your account ID (not your email). In Europe we only use analytics cookies and session replay if you accept them; see the Cookie Policy. We don't use advertising cookies.

How we use it

To run RoThumbnail: generate thumbnails, keep your history, track your credits and plan.
To prevent abuse and keep the service secure, including limiting free credits per person.
To process payments and handle billing questions.
To understand how the site is used and improve it.
To answer your messages.
To meet legal obligations.

We don't sell your personal information, and we don't use your prompts, uploads or thumbnails to train AI models.

If you are in the EEA or UK, we rely on contract (to provide the service you asked for), our legitimate interests (security, abuse prevention and cookieless usage statistics), your consent (analytics cookies and session replay), and legal obligation as our legal bases.

Who processes your data

We use these providers to run RoThumbnail. Each processes data only to provide its service to us:

Provider	What for	Data involved
Cloudflare	Hosting, image storage, bot check (Turnstile), abuse counters	All service data, IP address, generated thumbnails
Neon	Database	Account, session, credit and generation records
EvoLink, running OpenAI's GPT Image 2 model	AI image generation	Your prompt and uploaded images
fal.ai, running the same GPT Image 2 model	AI image generation when EvoLink is unavailable	Your prompt and uploaded images
SeeAPI	Checking prompts, uploaded images, avatars and generated images for prohibited content	Prompts and images
Google	Sign-in	Name, email, profile picture, Google account ID
Resend	Sending emails (such as contact-form messages)	Email address and message
Waffo (merchant of record)	Payments, tax and refunds	Billing and payment details
PostHog	Usage analytics and session replay	Usage events, device and browser data, IP address, account ID

These providers are based in, or process data in, the United States. Where the law requires it, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.

We may also disclose information if required by law, or to protect the rights and safety of our users or others.

How long we keep it

Account data and thumbnails: until you delete your account.
Guest sessions: a guest session signs out after 7 days without use. If a guest account isn't used for 30 days, we delete it, including its generation history and thumbnails.
Abuse-prevention counters: 48 hours.
Analytics events and session replays (PostHog): up to 1 year.
Uploaded images: not stored by us after generation.
Payment records: as long as tax and accounting law requires.

Your choices and rights

Delete your account any time in Settings → Security. This deletes your account, your credits, your generation history and your thumbnail files.
Access, correct or export your data, or ask any privacy question, by emailing support@rothumbnail.com.
Depending on where you live (for example the EEA, UK or California), you may have further rights, such as to object to or restrict processing, and to complain to your local data protection authority. We don't sell or share personal information for targeted advertising.

Children

RoThumbnail is not for children under 13, and you must be at least 13 (or older where your country requires it) to use it. If you are under 18, use RoThumbnail with your parent's or guardian's permission. If we learn that we collected personal information from a child under 13, we will delete it. Parents can contact us at support@rothumbnail.com.