Privacy Policy

Last updated: 30 July 2026

This Privacy Policy explains how ThunderFret (“we”, “us”) collects, uses, and protects your personal data when you use the website at thunderfret.com and its interactive practice tool (the “Service”). We keep the data we collect to a minimum and never sell it. If you have any questions, contact us at support@thunderfret.com.

1. Who we are

ThunderFret is the controller responsible for your personal data. We are based in the Netherlands. For any privacy request, reach us at support@thunderfret.com.

2. What data we collect

• Account data. When you sign in with Google, we receive your email address, your name, and your Google account identifier from Google. We store your email so we can identify your account and your subscription status.
• Subscription data. We store whether your account is free or Pro, the plan type, the renewal or expiry date, and the identifiers our payment provider gives us so we can match a payment to your account.
• Payment data. Payments are handled entirely by our payment provider, Lemon Squeezy, acting as merchant of record. We do not receive or store your full card number — Lemon Squeezy processes it under its own privacy policy.
• Consent records. When you make a purchase, we record the fact and time of your acceptance of our Terms of Service (including the version accepted and technical request data such as IP address and browser type), so that we can evidence your consent. Legal basis: our legitimate interest in establishing and defending legal claims.
• Practice progress. If you are signed in, the practice tool backs up your learning progress to your account: course and Academy completion, review schedules, streaks, practice minutes and drill results, together with the riffs, tabs and exercises you create in the tool. We do this so your progress survives a lost or cleared device and follows you between your own devices. It is stored against your account in our database, is never sold, and is shared only with the providers listed in section 5 that host it for us. It is deleted when you delete your account. Legal basis: performance of a contract.
• Usage & device data. We use privacy-friendly, cookieless analytics to understand which pages are visited and how the Service performs. This is aggregated and is not used to identify you personally.
• Technical logs. Our hosting and database providers process technical information such as IP address and browser type as part of delivering and securing the Service.

3. How we use your data, and our legal basis

• To provide the Service — creating and running your account and unlocking the features you are entitled to. Legal basis: performance of a contract.
• To process payments and manage subscriptions. Legal basis: performance of a contract.
• To improve and secure the Service — understanding usage, fixing problems, and preventing abuse. Legal basis: our legitimate interests.
• To meet legal obligations — such as tax and accounting requirements. Legal basis: legal obligation.

4. Cookies & similar technologies

We may use cookies, local storage, and similar technologies to operate and improve the Service. Today this consists primarily of:

• Strictly necessary cookies — to keep you signed in and run your session securely. These are required for the Service to function and do not need consent.
• Local storage on your device— the practice tool stores your settings, sketches, and practice progress in your browser's local storage so they survive between visits. Your device preferences — such as left-handed mode, volumes and tuning — stay on that device only. If you are signed in, your practice progress and the work you create in the tool are also backed up to your account, as described in section 2.

Advertising. The free version of the Service may display advertising served by Google AdSense. Where advertising is active, Google and its partners may use cookies or similar identifiers to serve and measure ads; in the EEA, the UK, and Switzerland, personalised advertising is only shown with your consent, collected through a Google-certified consent banner before any such cookies are set. You can withdraw or change your choice at any time via the banner. A Pro subscription removes advertising entirely. See also how Google uses information from partner sites.

Beyond that, our analytics are cookieless and we do not use cross-site tracking of our own. We may introduce additional cookies or similar technologies in the future — for example for functionality, analytics, or payment fraud prevention by our providers. Where such technologies require consent under applicable law, we will ask for it before setting them, and we will update this policy accordingly.

5. Who we share data with

We share personal data only with the service providers that help us run ThunderFret, and only as needed:

• Google — sign-in (authentication).
• Supabase — our authentication and database provider, which stores your account data in the European Union.
• Vercel — our hosting and analytics provider.
• Lemon Squeezy — our payment provider and merchant of record.
• Google AdSense — advertising on the free version of the Service (subject to consent where required; not shown to Pro subscribers).

These providers act as our processors (or, for payments, as an independent merchant of record) and are permitted to use your data only to provide their service to us. We never sell your personal data.

6. International transfers

Your account data is stored in the European Union. Some of our providers (such as Google, Vercel, and Lemon Squeezy) may process data outside the European Economic Area. Where that happens, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

7. How long we keep it

We keep your account data (your profile and subscription status) for as long as your account exists. When you delete your account — which you can do yourself, see Section 8 — we erase that data, along with everything listed below, straight away.

• Consent records (including the IP address and browser type captured at checkout) are deleted together with your account. We keep them only while your account exists, as evidence of the agreement you entered into.
• Feedback you send through the in-app bug/idea button is stored without your email or device details — only the message itself and an internal account reference that becomes anonymous once your account is deleted.
• Your practice progress (course and Academy completion, review schedules, streaks, practice minutes, drill results, and the riffs, tabs and exercises you create) is kept for as long as your account exists, and is erased together with your account. You can download all of it at any time from your profile.
• Device-only data (your settings and preferences, such as left-handed mode, volumes and tuning) never reaches us — it lives only in your browser and is cleared when you clear your browser data. The same is true of all of the above if you use the tool without signing in.
• Payment and invoice records are held by Lemon Squeezy, our merchant of record, which keeps them for the period required by tax and accounting law. We do not hold your payment records ourselves.

8. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to access, correct, delete, or export your personal data, and to restrict or object to certain processing. Where we rely on your consent, you can withdraw it at any time.

Two of these you can exercise yourself, instantly, from your profile page when signed in:

• Download my data— exports everything we hold about your account as a file (right of access & portability).
• Delete my account — permanently erases your account and all associated data, and cancels any active subscription first (right to erasure).

For anything else — correction, restriction, objection — email us at support@thunderfret.com. You also have the right to lodge a complaint with a supervisory authority — in our case, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Data security

We take reasonable technical and organisational measures to protect your data, and we rely on established providers (Supabase, Vercel, and Lemon Squeezy) that maintain their own security standards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Children

The Service is not directed at children under the age at which they can consent to online services in their country. We do not knowingly collect data from such children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date above and, where the changes are material, take reasonable steps to let you know.

12. Contact

For any question or request about your privacy, contact us at support@thunderfret.com. See also our Terms of Service.