Effective September 21, 2026
The Thing is a public conversation at thething.cc. The operator is Chad Boyda, a sole proprietor based in Austin, Texas, United States. This policy explains how he processes information when you read, sign in or contribute. Contact privacy@thething.cc for privacy requests and support@thething.cc for service questions, identifying The Thing in your message.
We store your email address to verify access to your account and send sign-in codes or links. Your email is not displayed on your public profile. We store session records and an essential sign-in cookie. Sign-in credentials expire after ten minutes; sessions can last up to a year unless revoked.
Your display name, handle, bio, published posts, replies and published attachments are public. Anyone may read, copy or share them, and search engines may index them. We retain earlier handles to prevent another account from taking them. A handle is a public identifier, not a guarantee of anonymity.
If you choose Google sign-in, we verify your Google account identifier and email address and store the identifier to recognize your account on later visits. Google’s sign-in service loads for signed-out visitors and may show a browser-controlled One Tap prompt. Google receives information needed to provide that sign-in service under its own privacy policy. We do not request access to Gmail, Drive, Calendar or other Google account content, and do not copy your Google name or photo into your public profile. Existing accounts require email verification once before Google is connected.
Your private notifications record replies, grouped reactions and publication events, along with read positions and notification preferences. New unread replies can also trigger a grouped email after 30 minutes, at most once every 24 hours. Delivery can be delayed by service interruptions. Reply emails are on by default and include public-safe conversation excerpts. You can turn them off in Notifications or unsubscribe from an email. This does not stop sign-in or copyright emails. Delivery records, pending email batches and reaction-state history support duplicate prevention and reliable delivery. We do not send push alerts.
We also store submitted messages, attachments, assessment results, relevant conversation context, timestamps and queue outcomes. Rejected submissions and detailed feedback are available to their author rather than displayed in the public feed. Service providers process information needed to operate the service.
Saved thoughts are private account bookmarks. Public search returns published contributions, not private submissions or assessment feedback. You can remove bookmarks without changing the public contribution.
Your browser saves drafts, attachment references, appearance preferences and reading position locally. Saved or recovered drafts can remain on that browser until you clear them or clear browser storage. Attaching media uploads it before publication. Links can be sent for preview generation while you compose. Avoid including confidential links, secrets or another person's sensitive information.
Our infrastructure receives network and device information needed to serve requests and prevent abuse. The application uses hashed identifiers for rate limits and approximate view counts. Reactions are associated with your account; aggregate reaction and view counts are public. Hosting and security providers may process network information under their own policies.
The website also loads Cloudflare Web Analytics to measure visits and page performance. Cloudflare states that this analytics service does not use cookies or local storage for analytics and does not fingerprint visitors. Hosting, security checks, sign-in cookies and local drafts are separate from that analytics service.
Google Analytics and PostHog product analytics are on by default. You can turn analytics off in Analytics preferences on this Privacy page. Your saved opt-out and browser Global Privacy Control or Do Not Track signal keep analytics off. When enabled, Google receives visits to broad public page categories and completed actions such as submissions, joins and shares, with cookie identifiers and technical information such as browser details and IP address during transmission. We do not send your email, handle, account ID, contribution text, search terms, exact page address, page title or full referring address. To understand traffic sources, we retain only the website origin for a small list of recognized search engines and public social websites, with search terms and other address details removed. Private areas, profiles and adult-content pages are excluded. Advertising features are disabled. Analytics cookies expire after 60 days without renewal. User and event data in Google Analytics are retained for 14 months without restarting the retention period on new activity; aggregate reporting can remain longer. You can change your choice in Analytics preferences on this Privacy page; turning it off removes Google Analytics cookies and reloads the page. Cloudflare analytics and essential storage are separate from this optional choice. Masked session recordings by PostHog are also on by default while analytics is enabled. Your saved recording opt-out is preserved, and you can turn recordings off separately on this Privacy page. PostHog receives broad public page categories, allowlisted completed actions, fixed error categories and masked session recordings showing layout and interaction. All page text and form values are masked; images, embedded media, editable drafts, dialogs and private feedback are blocked. Private, profile, admin, adult-content and token-bearing pages are excluded. We do not send raw error messages, console logs, network request or response bodies, headers, email, handles, account identifiers, or exact addresses. PostHog recordings are retained for 30 days; analytics and error data are retained for up to one year on our free plan. PostHog uses a random browser identifier in local storage to connect these events and recordings; we do not identify your account. IP address is transmitted to reach PostHog but IP-based enrichment is disabled. You can turn session recordings off independently in Analytics preferences on this Privacy page. This stops recording and reloads the page; product analytics can continue while Analytics is enabled. Turning Analytics off stops both analytics services and recordings. Earlier saved PostHog opt-outs remain in effect for product analytics until you explicitly enable Analytics again.
When you report a post or reply, we retain the reason, your details, a snapshot of the reported content, timestamps, and review status or decision notes. Your report receipts are private to your account; the operator can access the review queue and related audit records. Receiving a report does not mean it has been reviewed. Hiding a publication does not erase its retained submission or reporting records, or copies already delivered to others.
The account-free copyright form collects contact details, a signature, material locations and legal statements for private operator review. We retain notice and counter-notice records, receipt-secret hashes, delivery records and an audit trail for handling claims and legal obligations. A private receipt link reveals review status, not contact details. We may share a submission, including contact details, with the affected person or original notice sender as needed to process the claim. Unsent form data stays in this tab’s session storage until you send or clear it. Email copyright@thething.cc with a receipt ID for questions.
We use automated assessments to score contributions, select eligible posts and moderate spam. Assessment input can include the submitted text, attached media descriptions, relevant posts or replies, your public profile and limited recent submission history. These judgments can be wrong and do not establish that a statement is true or identify who wrote it.
Cloudflare provides hosting, storage, delivery and Turnstile security checks. Resend delivers sign-in email, unread reply digests and copyright case notifications. TypeSafe/Jev processes contribution assessments. OpenRouter and its model providers process image and video descriptions; the current models use Google Gemini. Video analysis samples content and can miss details. Provider retention and processing depend on their terms and the services used. We do not promise zero retention or that every provider excludes all data from model improvement.
We use the information to deliver the conversation, authenticate accounts, process contributions, preserve drafts and results, prevent abuse, respond to requests and maintain the service. We may disclose information when legally required, to investigate security or rights complaints, or to protect people and the service. A business transfer may involve service records subject to applicable law and notice requirements. The application does not currently implement advertising sales or ad personalization.
Account records, public contributions and published media are retained while needed to operate the service or meet legal obligations. You can edit your profile and remove your own not-accepted main submissions from Your contributions. That action removes their text and assessment detail from that record; minimal identifiers, hashes, timing and abuse-prevention records remain. Unpublished media is scheduled for cleanup after seven days. Separate copies or references, published content, and content already copied by others may remain. The service does not promise instant erasure of all backups, provider records or public copies.
The account dialog lets you prepare a JSON download of your retained account records, including submissions and assessment feedback, replies, bookmarks, reactions, notifications, your report receipts and media metadata. Uploaded image files are linked separately; browser-only drafts, authentication secrets and other accounts’ private data are not included. The file is prepared in pages over an interval, not as a single atomic snapshot. Report target snapshots and the operator’s global review queue are excluded. This download does not delete your account or contributions. There is currently no self-service account-deletion control.
You can withdraw a reaction by selecting it again, sign out, and clear local browser storage. Clearing local storage can also remove drafts. For access, correction, export, deletion or other privacy requests available under applicable law, contact privacy@thething.cc. We may ask for information needed to verify that the request concerns your account. Some records may need to be retained for security, disputes or legal obligations. Where applicable, you may complain to your data-protection authority.
Providers may process information in countries other than your own. Security measures reduce risk but no service can guarantee complete security. We will update this policy when practices change and identify its effective date; material changes will receive additional notice where required.