Privacy policy

Last updated 1 October 2026

thirds.ai is a service run by an individual sole trader in England. The operator uses thirds.ai as a trading name and is the controller for the personal data described on this page. In this policy, “thirds.ai” means that operator and the service.

thirds.ai turns words, HTML, and images into branded PDF documents and static images. This page explains, in plain words, what we store about you, why we store it, and what you can ask us to do with it. If you have a question this page does not answer, write to us at support@thirds.ai.

What we store about you

Your account holds your email address, a display name if you choose to set one, and the sign-in methods you have connected. We also keep a record of your plan, your credit use, and your renders, because that record is how we know what to show you and what to charge.

If you use a public form or try a template without an account, we keep a scrambled copy of your network address. The playground also keeps a small key in your browser. We use these values only to limit repeated public actions and count the free files you make.

Cloudflare Turnstile checks your browser and network signals when you use a public form or try a template without an account. It uses these signals only to stop bots. It does not receive your form text. Read the Cloudflare Turnstile Privacy Addendum for more detail.

When you write to support@thirds.ai, we keep your message in the support mailbox until your request is closed. We do not sell your data.

If you offer a testimonial, we store your name, company, quote, and permission so the owner can review it. Sending the form does not publish the quote. We publish it only after a separate owner action. You can ask us to change or delete it at any time.

Cookies

We set two first-party cookies: one keeps you signed in, and one counts your visits and links your first visit to your account when you sign up. We keep the visit cookie even if you click Decline, and no other company gets it. If you click Accept in the cookie banner, PostHog also keeps a cookie and some browser storage for our product analytics, as the next section explains. The Cookie notice lists each cookie and when it ends. We set no advertising cookies.

Product analytics

We use PostHog Cloud to see how people find thirds.ai and use it, so we can fix what's confusing. PostHog is our sub-processor for this work, and it stores the data in the EU. The banner at the foot of the page asks if you're OK with cookies and recordings.

Before you choose, and after you click Decline, PostHog counts page views and clicks without a cookie or browser storage, and we don't record your visit. Each count carries the same random analytics ID that our servers use, so we can link your visits over 30 days, and to your account if you sign up.

After you click Accept, PostHog keeps a cookie and some browser storage with a random ID, so it can tell your visits apart. It also records your visits and shows us where people click and scroll, so we can watch how a page works for real people. If you're signed in, we link these records to the same random analytics ID that the events below use. PostHog never gets your email address or name from us.

Recordings hide everything you type into a box. They also hide your designs, previews, files, logos, chat messages, API keys, and webhook secrets, and they hide your email address and name.

PostHog gets the address of each page you open, the site that sent you to us, and the campaign tags in your link. We remove the rest of each address after the ? or #, but we keep the utm_ tags and the gclid, fbclid, and msclkid ad click IDs. Your browser connects to PostHog directly, so PostHog also sees your network address and your browser and device type.

You can change your choice at any time. Click Cookie settings at the foot of any page, or in the account menu in the studio. Your new choice works at once.

We also record the events in this table, whatever you choose in the banner. Our servers use the visit cookie to count visits and sign-ups, and PostHog gets each event with a random analytics ID, never the cookie itself.

These events use a random analytics ID. They can include these fields, each limited to approved values:

These fields never include prices, payment details, or payment IDs.

For these events, we keep only approved values from the utm_source, utm_medium, utm_campaign, utm_content, utm_term, and discovery_source tags in a visit link. An absent or unapproved value stays unknown. We also accept the ad click IDs gclid and fbclid, limited to 128 letters, digits, underscores, or dashes.

These events never include your email, name, API key, prompt, chat text, source image, brand asset, HTML, template data, file name, document, or output file. They also leave out page addresses, referring page addresses, and other query fields, and our servers don't send PostHog your network address.

We keep event details and visit source tags on our servers for 90 days. For each event linked to your account, we keep its event ID, event name, and time until account closure. These records stop repeat counts and support totals. The owner can read analytics. Authorized PostHog staff can access it when they need to run or support the service. Report access is read-only.

How sign-in works

When you sign in with an email link, Resend delivers that one mail for us. When you sign in with GitHub or Google, the provider tells us only who you are: an account identifier, your email address, and your name. We never ask for access to your repositories, your files, or anything else in those accounts.

When you connect an AI app

You can connect an AI app, such as Claude, ChatGPT, or Cursor, to your thirds.ai account. The app gets access only after you click Allow on our page. Then it can make PDFs and images, and read and change your designs and brand kits, with your account and your credits.

For each app you connect, we keep its name, the web address it sends you back to, and when you connected it and last used it. We keep only a scrambled copy of each access key the app gets. The app decides what it keeps from your chats and files, so its own privacy policy covers that part.

You can disconnect an app at any time under Connected apps in Settings. It loses access right away.

Your documents

The HTML, templates, and assets you send exist on our servers only to make your PDFs and images. We delete the input of a job when the job ends. We keep a finished PDF or static image until its retention period ends and then delete it. The longest period is 365 days on a paid plan and 30 days on the free plan, with credit packs only, or during the $1 Starter trial. You can choose a shorter period, and you can delete a file earlier at any time. If your paid plan ends, any file with more than 30 days left is deleted 30 days from that day. Our backups can hold a copy for a short time after a deletion.

We never write the content of your documents into our logs, and no person looks at your documents unless you ask us for help with them. Read about our security controls.

AI templates and images

We send your prompt, brand details, and source image to OpenRouter and the model host it selects to build your template. That provider may use this content to improve its models. We keep the working content until you close your account.

When you generate an AI image, we send your prompt to OpenRouter and the image model host it selects. The same provider data terms apply. We keep successful image prompts and their saved versions in your private account until you close it. This lets you read prompt history and restore an earlier image. Failed standalone prompts are removed by cleanup after a one-hour grace period. A chat image prompt stays with its chat. We save the finished image in your account so you can use it in your templates.

Who helps us run the service

• Hetzner Online GmbH hosts the live application, database, and file storage in Finland.
• Resend sends our sign-in and account email.
• GitHub and Google confirm who you are, only if you choose to sign in with them.
• Cloudflare checks public forms for bots and stores our backups.
• OpenRouter and its selected model host help build templates and generate images when you use our AI tools.
• PostHog Cloud in the EU stores our product analytics and, if you click Accept, the recordings of your visits.
• Stripe runs checkout and payment processing.

Your rights

You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete your account and everything in it. Write to support@thirds.ai and we will answer within a month.

Changes

When this policy changes, the new version appears on this page with a new date at the top.