Last updated: July 19, 2026
This Privacy Policy explains how ThermoSketch LLC ("ThermoSketch," "we," "us," or "our"), a Wyoming limited liability company, collects, uses, and protects information in connection with your use of the ThermoSketch website, applications, and engineering simulation and analysis tools (collectively, the "Service") at thermosketch.com and its subdomains. This Policy is incorporated by reference into our Terms of Service.
This Policy applies to all users of the Service, regardless of location, and reflects our commitment to offering the same core set of rights and protections to everyone, rather than a different tier of rights depending on your country.
Regardless of whether you are on a free or paid plan, ThermoSketch does not store your design geometry or simulation inputs/outputs on our servers. Calculations are performed in memory and results are returned directly to your browser; if you want to keep a project, you download it to your own device. This is a deliberate product design choice — not a technical limitation — and it applies to every plan, with no exceptions. We only store the minimum information needed to operate your account and subscription. Details below.
| Category | Examples | Where It's Stored |
|---|---|---|
| Account & identity data | Email address, password hash or OAuth identifier (Google/GitHub) | Supabase (our authentication/database provider) |
| Subscription & billing status | Plan tier, subscription start/end dates, Payment Processor subscription ID | Supabase |
| Payment card data | We do not collect or store this. Card details are handled entirely by our Payment Processor (currently Dodo Payments) as merchant of record. | Held by Payment Processor only |
| Usage metadata | User ID, tool name, node/edge counts, request duration, result/error codes | Supabase (auto-purged after 30 days, see §5) |
| Error logs | Error codes, tool name, non-identifying technical metadata (explicitly stripped of coordinates, dimensions, and other design values) | Supabase / error monitoring tooling (retained 90 days) |
| Diagnostics submission (only if you click "Send Diagnostics" after a failed calculation) | The specific simulation parameters that caused the failure, submitted directly from the app to our backend and forwarded to our support team | Support mailbox only (deleted within 30 days of ticket closure) |
What we do not collect or store: your design geometry (e.g., flow-channel layouts, heat-source placement), simulation input parameters, or simulation results. There is currently no cloud project-storage feature, on any plan, and we do not currently plan to add one; if that ever changes, we will update this Policy first and seek your consent before any such feature is enabled for your account. The one narrow exception is diagnostics submission: if a calculation fails, you may explicitly opt in — separately, for that specific incident — to send the failing parameters to our support team so we can investigate. Nothing is sent unless you click "Send" each time; this does not create a general-purpose cloud storage or project-history feature.
We use the information described above to: (a) create and maintain your account and authenticate you; (b) provide, operate, and maintain the Service; (c) process subscriptions and communicate with our Payment Processor about your billing status; (d) enforce usage quotas and detect abuse; (e) provide customer support and respond to your requests; (f) comply with legal obligations (e.g., tax recordkeeping related to subscription revenue); and (g) improve the Service based on aggregated, non-identifying usage metadata.
Where the General Data Protection Regulation ("GDPR") applies, our legal bases are: account and subscription data — necessary for performance of our contract with you (Art. 6(1)(b)); usage metadata — our legitimate interest in operating, securing, and preventing abuse of the Service (Art. 6(1)(f)); and any data processed pursuant to your consent, where applicable (Art. 6(1)(a)).
| Data | Retention Period |
|---|---|
| Account and subscription data | For the life of your account, plus any period required by tax or accounting law after account closure |
| Usage metadata | Automatically deleted after 30 days |
| Error logs | Retained 90 days |
| Diagnostic files you submit to support | Deleted within 30 days of the related support ticket being closed |
| Design geometry / simulation inputs and outputs | Not stored on our servers at any time (see §2 and §7) |
Certain paid plans may include AI-assisted analysis features (for example, an AI chat/agent that can call analysis tools on your behalf). These features operate only on the data present in your active session — your current design canvas, tool-call parameters, and chat messages — and do not retain, store, or read your design data from prior sessions on our own servers.
Third-party LLM providers. To power these features, we use one or more third-party large language model ("LLM") providers. As of the effective date of this Policy, our LLM provider(s) may include Anthropic, OpenAI, and/or Google (Gemini/Vertex AI). Our system is designed to switch between these providers (e.g., for cost, performance, or availability reasons) without requiring a change to the product itself; the current provider(s) in active use are also listed on our security page at thermosketch.com/security. We do not currently use any LLM providers other than those listed above. If this list changes in the future, we will update this section first.
What is sent, and what the provider does with it. When you use an AI-assisted feature, your current session's design parameters, tool-call context, and chat messages are transmitted to the active LLM provider to generate a response. We use each provider's commercial/business API tier, not free consumer products. Based on each provider's own currently published policies: Anthropic and OpenAI do not use commercial API inputs/outputs to train their models by default, and retain request data only briefly for abuse-monitoring purposes (approximately 7 days for Anthropic's API and 30 days for OpenAI's API); Google's paid Gemini API/Vertex AI similarly does not train on your prompts or responses by default and retains data only for a limited period for safety and abuse-detection purposes. These are the providers' own policies, not commitments ThermoSketch makes on their behalf — please refer to each provider's current privacy documentation for authoritative, up-to-date terms.
Separate obligation — AI system disclosure. Where required by applicable law (for example, the EU AI Act's transparency obligations for AI systems that interact with people, effective August 2, 2026), the product interface itself — not just this Policy — will clearly disclose when you are interacting with an AI system.
We use the following service providers ("sub-processors") to operate the Service. We choose providers with independent security certifications where possible and disclose known limitations honestly below:
Anthropic, OpenAI, and/or Google — third-party LLM providers powering AI-assisted features on certain paid plans (see §6 for details on data sent and each provider's retention/training policies).
Cloudflare — front-end hosting and content delivery network (CDN).
Modal — computational backend for running simulations (SOC 2 Type II certified). Important disclosure: while our own application code does not persist your design data, Modal's infrastructure retains encrypted request/response payloads for up to 7 days as part of its own platform operations, after which they are automatically deleted; Modal contractually commits not to access the content of these payloads. This is outside our code's control, and we disclose it so you have a complete and accurate picture — we do not claim your data "never touches a disk."
Supabase — authentication and database hosting for account, subscription, and usage-metadata records (SOC 2 Type II certified; encrypts data at rest).
Dodo Payments — our Payment Processor and merchant of record for paid subscriptions; handles your payment card data, billing, invoicing, and (per its own policies) refunds. See Dodo Payments' own privacy policy for how it handles your payment information.
We do not sell your personal information to third parties, and we do not share it with third parties for their own independent marketing purposes.
Our sub-processors may process data in regions outside your own country. Specifically:
Supabase (account, subscription, and usage-metadata storage) is hosted on AWS in the us-west-2 (Oregon, USA) region.
Modal (computational backend) operates a multi-cloud, multi-region infrastructure; container execution is not pinned to a single region and the majority of capacity is located in the continental United States, though capacity in other regions may be used. By default, request/response routing and staging of payloads larger than 2 MiB occurs through Modal's control plane in us-east (Virginia, USA), regardless of which region actually executes the computation. We have not configured a fixed execution region for Modal as of this Policy's effective date; if we do so in the future (e.g., to align with Supabase's region), this section will be updated accordingly.
Where applicable, we rely on our sub-processors' own compliance mechanisms (such as Standard Contractual Clauses, SOC 2 certifications, or equivalent data protection frameworks) to safeguard cross-border transfers. Because design geometry and simulation data are never stored on our servers in the first place (see §2), these regional disclosures primarily concern account, subscription, and usage-metadata records rather than your design content.
Regardless of where you are located, you have the right to: (a) access the personal information we hold about you; (b) request a copy of it in a portable format; (c) request correction of inaccurate information; and (d) request deletion of your account and associated personal information ("right to be forgotten"). You can exercise these rights from your account settings page, or by emailing support@thermosketch.com. We will respond to and complete deletion or export requests within 30 days. Note that because we do not store design geometry or simulation data in the first place, an export or deletion request will not include any such data — there is none to export or delete.
If you are located in a jurisdiction with specific statutory privacy rights (for example, under the EU/UK GDPR or similar regional laws), those rights are provided as described in this section; we do not currently operate a "sale" of personal information to third parties in the sense used by regional privacy statutes, so rights specific to opting out of data sales are not applicable to how we currently operate.
We use only strictly necessary cookies required for authentication (e.g., your login session cookie, shared across our subdomains). We do not currently use advertising or cross-site tracking cookies. If we introduce analytics or tracking cookies in the future, we will update this Policy and provide appropriate notice/consent mechanisms (e.g., a cookie banner) before doing so.
The Service is intended for users who are at least 18 years old and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at support@thermosketch.com and we will delete it.
We use TLS encryption for all data in transit. Account and subscription data at rest is protected by our database provider's platform-level encryption (AES-256). Our strongest protection for your design and simulation data is architectural: since that data is never stored on our servers (see §2), there is no persistent copy for us to secure or for an attacker to steal from our systems. For more detail, see our security overview at thermosketch.com/security.
If we become aware of a data breach affecting your personal information, we will assess the situation internally within 72 hours of discovery and notify affected users and/or relevant regulators where required by applicable law.
We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (such as by email or a notice on the Service) before the changes take effect.
If you have questions about this Privacy Policy or wish to exercise your rights, contact us at support@thermosketch.com.