Privacy Policy

The short version: Thruly never reads, records or sends your screen. The app shares anonymous usage statistics only if you say yes. The website sets no cookies. We collect as little as we can, and you can ask us to delete it at any time.

Who is responsible for your data

Thruly ("we", "us") is responsible for the personal data described here. Thruly is operated by Pelumi Peter, Lagos, Nigeria. For privacy questions and requests, contact hello@thruly.app.

What we never collect

Not from the app, not from the website:

• what's on your screen, or the contents of any window;
• window titles, app or process names, file paths or document names;
• your keystrokes;
• hardware IDs, serial numbers or your precise location.

What we collect, why, and for how long

Waitlist

• What: your email address, the page you signed up on and which audience it was for (for example "developers"), campaign tags from the link you followed (utm_*), the referring website's domain, the version of the consent text you saw, and the dates you signed up and confirmed.
• Why: to confirm your email, then email you when Thruly launches and about major updates (a few emails a month at most).
• Legal basis: your consent. You can withdraw it at any time with the link in every email.
• How long: if you don't confirm your email, we delete it after 14 days. If you confirm, we keep it until you unsubscribe or ask us to delete it. After you unsubscribe, we keep your email address marked as unsubscribed so we don't email you again, unless you ask us to erase it completely.

Website statistics (no cookies)

• What: the page you viewed, the referring website's domain, campaign tags, and your screen size group (mobile, tablet or desktop). To count unique visitors per day, our server combines your IP address and browser type with a secret that changes every day and is then deleted. Your IP address itself is never stored.
• Why: to understand which pages and links work, without tracking you.
• Legal basis: our legitimate interest in running and improving the website.
• How long: 90 days, after which only daily totals remain.

Spam protection (Cloudflare Turnstile)

When you submit the waitlist form, Cloudflare Turnstile checks that you're a person and not a bot. Cloudflare processes technical information about your browser and connection for this check, under Cloudflare's privacy policy. It doesn't set tracking cookies on our website.

Desktop app: usage statistics and crash reports (only if you say yes)

• What: the first time you start Thruly, it asks whether to share anonymous statistics. Only if you choose Share anonymous stats does the app send: a random install ID, the app version, your Windows version, the processor type, the app language, your time-zone offset from UTC (not your time zone's name), daily counts of how you use Thruly's features, and crash reports with personal details such as user names in file paths removed.
• Why: to see which features matter and to fix crashes.
• Legal basis: your consent. If you choose Don't share, the app sends nothing to us at all. You can change your choice in the tray menu at any time, and Delete my data removes everything linked to your install.
• How long: usage events and crash reports for 90 days, daily usage counts for 13 months. Installs that are inactive for 13 months are deleted.

Purchases (when sales open)

Paddle sells Thruly to you as our Merchant of Record and handles your payment details. We never see your full card details. From Paddle we receive your email address, country and order details, so we can give you your licence and support you.

• Legal basis: to perform our contract with you, and to meet our legal and tax obligations.
• How long: we keep your email address, country and order details for as long as your licence is valid, so we can restore it and help you. Paddle keeps its own payment and tax records, as an independent controller under its privacy notice, for as long as the law requires.

Accounts (planned)

When Thruly adds sign-in, your account email and sign-in details will be handled by Google Firebase Authentication. We'll update this policy before that happens.

Emails you send us

If you contact us, we keep the conversation for as long as we need it to help you, and delete it no later than 1 year after your last message, unless we need it for a legal claim.

Cookies

The thruly.app website doesn't set any cookies, and we don't use advertising or third-party tracking tools.

Who we share data with

We don't sell your data. We share it only with the services that run Thruly for us, under contracts that require them to protect it:

• DigitalOcean: hosts our servers and database (United Kingdom).
• Cloudflare: hosts the website, protects it from attacks, and runs Turnstile.
• Zoho: sends our emails: confirmation emails through Zoho CPaaS and announcements through Zoho Campaigns (United States data centre).
• Paddle: our Merchant of Record for purchases. Paddle also acts as an independent controller for the payment data it collects (Paddle's privacy notice).
• Google Firebase: sign-in, once accounts are available.
• Microsoft Store: distributes the app. Microsoft's own privacy statement covers its store data.

We may also share data with professional advisers, or with authorities when the law requires it.

International transfers

Some of these services store data outside your country, for example in the United Kingdom or the United States. Where the law requires it, we rely on safeguards such as Standard Contractual Clauses. [confirm transfer safeguards with a lawyer]

Your rights

Depending on where you live (for example under the Nigeria Data Protection Act 2023, the EU or UK GDPR, or US state laws), you can ask us to:

• show you the data we hold about you, or give you a copy;
• correct it;
• delete it;
• stop or limit using it, or object to how we use it;
• withdraw your consent at any time. This doesn't affect what we did before.

Email hello@thruly.app and we'll reply within one month. You can also complain to your data protection authority, for example the Nigeria Data Protection Commission, or the authority in your EU or UK country.

Security

All traffic uses HTTPS. Email links use one-time tokens that we store only in hashed form. Access to our systems is limited, and we keep only the data described here.

Children

Thruly isn't directed at children under 13, and we don't knowingly collect their data.

Changes to this policy

If we change this policy, we'll update the date at the top. For important changes, we'll tell people on the waitlist and customers by email.