1. Who is responsible for your data
Thomsen Shield is operated by Thomsen ("we", "us"), who is the data controller for the personal data described in this policy. Email support@thomssen.dev for any privacy question or to exercise the rights in section 9.
2. What we collect, and why
- Email address - collected by Stripe at checkout, used to send your payment receipt and to look up your license if you contact support. Legal basis: performing the purchase contract with you.
- License key and device identifier - when you activate Thomsen Shield, the app sends your license key and a hardware-derived identifier for that PC to our license server, so we can confirm the license is valid and bound to one device. Legal basis: performing the contract (delivering the license you paid for).
- Payment information - handled entirely by Stripe. We never see or store your card number. Legal basis: performing the contract, and our legal obligation to keep financial and accounting records.
- Standard server and security logs - Vercel and Supabase (which run our license server and database) and Hostinger (which hosts thomssen.dev itself) log routine request metadata such as IP address, as most web infrastructure does. Legal basis: our legitimate interest in keeping the service secure and working.
- Theme and cookie preference (on thomssen.dev) - stored in your browser only, not sent to us. Legal basis: consent, where used for anything beyond strictly necessary storage.
3. What we don't collect
Thomsen Shield does not send us your network traffic, browsing history, the connections it observes, or the IPs it blocks. All detection and blocking logic runs locally on your machine. Nothing about your day-to-day usage of the app is transmitted anywhere. Thomsen OSINT is likewise built local-first - its lookups and case data stay on your PC, with no cloud account. Thomsen VM doesn't require a purchase, account, or license activation, so there's nothing tied to your identity for it to send us.
4. Cookies
Our main site (thomssen.dev) stores your theme and cookie choice in your browser's local storage - strictly necessary, and not used to track you. It does not currently run any analytics or advertising scripts; if that ever changes, it will only happen with your consent. This page itself (api.thomssen.dev) sets no cookies of its own.
5. How we use it
In short: to issue and validate your license, process your payment, prevent fraud (e.g. chargebacks, key sharing), keep the service secure, and respond if you contact support. We don't use your data for advertising, and we don't sell it to anyone.
6. Who we share it with
Only the services that make Thomsen Shield work:
- Stripe - payment processing (their privacy policy)
- Supabase - database hosting for license records
- Vercel - hosting for our license server (api.thomssen.dev)
- Hostinger - hosting for our main website (thomssen.dev)
Each processes data under their own privacy policy and only as needed to provide their service to us. We don't sell your data or share it for anyone else's advertising.
7. International transfers
Some of these providers (for example Stripe and Vercel) are based in, or may process data in, the United States or other countries outside the EU/EEA. Where that happens, they're required to provide appropriate safeguards for the transfer, such as the EU Standard Contractual Clauses or an adequacy decision - see their own privacy policies (linked above where available) for how each handles this.
8. Data retention
We keep license and purchase records for as long as your license is active, and afterward for as long as applicable tax and accounting law requires us to keep financial records. Support emails are kept only as long as needed to handle your request, unless we're legally required to keep them longer.
9. Your rights
Subject to the conditions in applicable law, you have the right to access, correct, delete, restrict, or object to our use of your data, and to receive certain data in a portable format. Where processing relies on your consent, you can withdraw it anytime. To exercise any of these, email support@thomssen.dev - note that deleting your account data will deactivate your license. You also have the right to lodge a complaint with a data protection supervisory authority in the EU/EEA country where you live or work. You can find the relevant authority through the European Data Protection Board (EDPB).
10. Security
Data in transit between the app and our server is encrypted (TLS). Your license token is cryptographically signed and stored encrypted on your own device.
11. Children
Thomsen Shield isn't directed at children under 16, and we don't knowingly collect data from them.
12. Changes to this policy
If this policy changes materially, we'll update the date at the top of this page.