Legal
Privacy Policy
Last updated: July 17, 2026.
This policy describes the small amount of personal data Thornfold actually handles, why, and for how long. It reflects how the site really works today. We have deliberately kept data collection minimal, and this policy does not claim to cover data we do not collect.
1. Who we are
Thornfold is the business that publishes and sells these products. If you have a privacy question, contact us using the details on our contact page.
2. The data we handle
We handle only what we need to sell you a product and deliver it:
- Your email address, which you give us at checkout or when you request a
free resource.
- Your order details, such as which product you bought, the date, the price,
and which versions of our policies applied to your order.
- Delivery and access records, such as the secure download links tied to your
order and whether an email about your order was sent.
- Your free-resource request, if you ask for one, including whether you asked
to hear from us by email.
- Technical data needed to keep the site working, described in section 3.
We use a privacy-preserving website analytics measurement, described in section
- We do not run advertising trackers, and our order emails do not
contain tracking pixels.
3. Cookies, analytics, and technical data
We use a small number of strictly necessary cookies, listed below. We use no advertising cookies.
For website analytics we use Google Analytics 4, and you are in control of it. Until you choose, and if you decline, analytics runs in a privacy-preserving mode: analytics storage is denied, so it sets no analytics cookie and keeps no identifier for you on your device, and only a cookieless measurement signal is sent to Google.
We show a short banner asking whether you are happy to allow analytics cookies. If you allow analytics, Google Analytics sets a _ga cookie and measures your visit in the ordinary way, so we can understand how the site is used. If you decline or ignore the banner, Google Analytics does not set or read analytics cookies or store an analytics identifier on your device. Thornfold stores only your consent choice in browser storage so we remember it. You can change that choice at any time through Analytics settings.
Whatever you choose, we never use analytics for advertising. Advertising storage, advertising personalisation, and advertising user data are always denied, Google Signals is off, no advertising or remarketing data is sent, and no user identifier is used. Google Analytics does not store your network address.
| Cookie | What it is for | How long it lasts |
|---|---|---|
| Purchase session | Tells us that a purchase attempt belongs to the same browser, so one purchase cannot accidentally be charged twice. It is a random identifier, stored in a scrambled form. It is not your name, your email, or a profile of you. | Up to 90 days |
| Order access session | Created when you open your order link. It lets you see your order and download your files without the link itself sitting in your browser's address bar, where it could be printed or forwarded. | 2 hours |
| Site-access session (private previews only) | Used only while the site is being tested privately, before launch. | 2 hours |
Analytics (Google Analytics _ga, _ga_*) | Set only if you allow analytics. Google Analytics uses it to recognise your device across pages so your visit is counted once. Not set if you decline. | Up to 400 days |
We also handle two pieces of technical data:
- A scrambled form of your network address (IP). We never store your actual
IP address. We store a one-way scrambled version of it, and we use it only to stop abuse: to limit how many times anyone can try to check out, request a free resource, or open a download in a short period. It cannot be turned back into your address.
- Basic error and performance records, so we can find out when something
breaks. These are automatically stripped of personal data, payment data and access links before they are stored.
4. Payment data goes to our provider, not to us
When you pay, your payment is processed by our payment provider, which acts as the merchant of record. Your card or payment details go to that provider. We do not see or store your full payment details. The provider handles that data under its own privacy terms.
5. Email is sent through our email provider
We send order and delivery emails through an email provider on our behalf. To do that, your email address and the message are handled by that provider for the purpose of sending the email.
6. Why we handle your data
- To take your order and give you access to your files.
- To send you your confirmation, download link, and any update about your order.
- To send a free resource you asked for.
- To answer you if you contact us.
- To understand, in aggregate, how the site is used, so we can improve it.
- To keep the site secure and stop abuse.
- To keep basic records of sales, as any business must.
If you asked to hear from us by email about new resources, we use your email for that until you tell us to stop. That is separate from the emails we must send to deliver something you bought.
7. How long we keep it
| Data | Kept for |
|---|---|
| Order records (product, date, price, policy versions accepted, and a short, non-personal campaign code if you arrived from one of our ads) | as long as needed for business and tax records, then removed |
| Email address for a purchase | with the order record, for the same period |
| Download and delivery records | while your access is active, plus a short period afterward |
| Free-resource request and email-contact choice | until you ask us to stop, or until it is no longer needed |
| Email-sending records | a short period, to confirm delivery and handle problems |
| Scrambled network address, for abuse limits | a short period, then removed automatically |
| Error and performance records | a short period |
| Website analytics | If you allow analytics, Google Analytics event data is retained for 14 months according to our configured setting and Google's terms. If you decline: cookieless measurement events and modeled or aggregated reports only. |
If you ask us to delete data we are not required to keep, we will.
8. Who we share it with
We share your data only with the providers that make the sale work and the analytics provider described in section 3: our payment provider (merchant of record), our email provider, the services that host the site, store your files, and record errors, and Google, which provides our website analytics. Each handles data only for the purpose described above. We do not sell your data, and we do not share it for advertising.
9. Your choices
You can ask us what we hold about you, ask us to correct it, ask us to delete what we are not required to keep, and unsubscribe from any optional emails at any time. You can also allow or decline analytics cookies at any time using the "Analytics settings" link in the footer. Contact us and we will help. Where the law gives you specific data rights, we will honour them.
10. Security
We keep access tokens in a hashed form, we do not expose private file locations to your browser, your order link opens your order once and then stops working as a key, and we limit who and what can reach your data. No system is perfectly secure, but we take reasonable care.
11. Children
Thornfold sells to businesses and professionals. It is not intended for children, and we do not knowingly collect data from children.
12. Changes to this policy
If we change what data we handle, we will update this policy and the "last updated" date above. If a change is significant, we will make it clear.
13. Contact
For any privacy question or request, contact us using the details on our contact page.