Who we are
Thumbnail Vault is operated by Jamie Whiffen LTD. This policy explains what data we collect and how we use it when you use Thumbnail Vault.
Access and personal information
You can browse Thumbnail Vault and use its basic standalone tools without an account. A free account is required to save references, collections, notes, previews, comparisons and briefs across devices. We collect your email address for account confirmation and recovery, with email/password or Google sign-in. You also tell us what best describes how you use YouTube, and may add a YouTube channel, as explained below. Images you choose in the Previewer are processed in your browser. If you explicitly save that work to your account, its images are uploaded to private Supabase storage so you can reopen them on another device.
AI-assisted search
Some searches use AI to interpret your video idea and compare thumbnail examples. For these searches, we send your search text and selected reference details and thumbnail images from the Vault to Anthropic through Vercel AI Gateway. A temporary Supabase cache stores the selected reference IDs and a coded search identifier rather than the raw search text. Cache entries expire after 24 hours. Temporary network-based rate-limit records help prevent excessive use; scheduled cleanup removes expired entries and old rate-limit records. We retain aggregate usage totals to enforce spending limits.
Your profile answers
When you create an account, we welcome you with a few questions: a YouTube channel, your first name, what best describes how you use YouTube, where you heard about Thumbnail Vault and your channel's niche. Your first name and how you use YouTube are needed to finish, and so is a niche unless you design thumbnails. The channel and where you heard about us are optional. If you sign up with Google, we fill in your first name from your Google account, and you can change it. If saving your answers fails, you can carry on into the library, and it may ask the questions about YouTube again on a later visit. We call your answer about how you use YouTube, such as Business owner or Thumbnail designer, your creator type. The channel can be your own or one you work on. If you add a channel, we may use it to suggest a niche, such as Gardening, which you can change. When you add a channel in the welcome after signup, we use its public YouTube picture for your account, as the welcome says. When you add one later, in the library or Account settings, you choose whether to use it. Either way, we save a link to that picture with your answers and show it in your account menu, where only you see it. If you say no, or choose Use my initial in Account settings, we don't keep the picture. Leaving out the optional answers never limits what you can use for free.
We use your answers to:
- Choose the examples in Picked for you, a section at the top of the library.
- Choose examples from your niche and related niches for the first page of the library.
- Word Jamie's free channel review offer to suit your creator type. Thumbnail designers don't see this offer.
- Help Jamie see who might be a good fit for his one-to-one work, such as a coach who adds a channel. He compares these accounts by hand with his own records of booked calls and clients. If you're on his email list, he may email you about it, and you can tell him to stop at any time.
- See whether Picked for you is useful. We note when you first answered and which examples it first showed you. Jamie's weekly report then counts saves, collections, notes and briefs for each creator type.
- Keep your first name with your account, so we can address you by name.
- See where people hear about Thumbnail Vault. Jamie's weekly report counts these answers in a table with no names or email addresses.
Your channel link never goes to our analytics or into a cookie. We don't send your answers to Kit, our email provider.
You can see, change or remove your answers at any time in Account settings. Removing them also deletes your niche, the channel picture and the details we noted, and turns off Picked for you. We keep a note that you removed them, so we don't ask again. Your first page then returns to the day's general selection. Your answers and those details are included when you ask for a copy of your data.
How we suggest a niche
To suggest a niche, our server asks YouTube for the titles of the channel's recent public uploads. We only do this when you add or change the channel in your profile and haven't chosen a niche yourself, or when the channel's picture is used for your account.
We don't save the titles. Our server only holds them in memory, for up to a day, so it doesn't have to ask YouTube about the same channel again. Only the suggested niche is saved with your answers, along with a code made from the channel's link, so we can tell when you change it, and a link to the channel's picture if it's used for your account. If the lookup can't run, such as when YouTube can't be reached, we save that code with a note to try again and look the channel up the next time you save your answers. If the channel has videos in the Vault, we also save a short code for it with your answers, which leaves them out of Picked for you. Picked for you says when a niche is only a suggestion, so you can change it if it's wrong. This lookup uses the YouTube API Services described under YouTube data.
Cookies and local storage
We use browser localStorage to maintain your secure account session, preserve an unfinished save, remember display preferences and keep standalone-tool drafts on this device. The remix prompt form remembers what you enter and your recent entries in this browser only, never on our servers, and clearing this site’s data in your browser removes them. An optional creator photo is processed in your browser and kept for reuse only when you choose Save photo in this browser. It is not uploaded to our servers or automatically attached to an AI chat. Delete saved photo removes that local copy. When you save to your account, saved references, collections, notes and named tool documents are stored in your private account workspace. Clearing browser data signs this device out and removes device-only preferences, but does not delete account data.
If you've answered the profile questions, we also keep a small cookie in your browser while you're signed in. It holds your creator type, your channel niche and, if your channel has videos in the Vault, the short code that leaves them out of Picked for you. It never holds your channel link, handle or email address. The library uses it so Picked for you appears with the page. It also lets us choose the first library page for your niche as the page loads. It lasts up to a year, and it's cleared sooner when you sign out, remove your answers or delete your account.
Network requests and service logs
Unless you turn usage analytics off, Thumbnail Vault records a small allowlisted set of first-party product events, such as account prompts, completed saves, collections and audit-link clicks. These events use a random browser identifier and, when signed in, your account identifier. They may also include campaign parameters, referring domain and page path. We do not accept free-form personal data in these events. Your browser requests public thumbnail images, and your channel's picture if it's used for your account, from YouTube. When you paste a YouTube link into Downloader or Brief Builder, the video ID is sent to noembed.com to retrieve the public title and channel. When you open the account form to sign up, sign in or reset your password, your browser loads Cloudflare Turnstile from challenges.cloudflare.com to check that a person, not an automated script, is using it. Standard hosting and security logs may process IP address, browser information and timestamps.
Visit counts
Vercel, which hosts Thumbnail Vault, counts visits for us. For each page you open, it records the page, the site that sent you, any campaign labels in the link, your country, your device type and your browser. It sets no cookies and keeps no identifier in your browser. To tell one day's visits apart, it uses a code made from your request, which Vercel discards after 24 hours, so it can't identify you or follow you to other sites. Visit counts stay off if you turn analytics off in Analytics settings or your browser sends Do Not Track or Global Privacy Control.
Usage analytics
Usage analytics are on for every visitor by default. PostHog in the EU receives named usage events, a random browser identifier, page categories, campaign labels, device and browser categories, feature outcomes and safe counts. From your profile answers, it receives only your creator type, where you heard about Thumbnail Vault and simple yes/no details, such as whether you added a channel or a first name. We use this to improve the tools and understand which visits lead to useful actions. We do not send your email, first name, channel link or handle, channel niche, uploaded images, titles, briefs, raw searches, passwords or authentication links in these named events. Unless you turn analytics off, creating an account also saves campaign details with your account profile. These are the campaign source, medium and name from the link that brought you to the Vault and the domain of the site that sent you, and they're included when you ask for a copy of your data.
We also measure page loading speed, interaction delays and layout stability using Web Vitals. These reports keep numerical measurements without element details. We use masked session replays and heatmaps to understand clicks, scrolling and where people get stuck. Input values and page text are masked before they leave your browser. Images, video, embedded pages and editable content are blocked from recordings. Click capture does not include element text or attributes. Page URLs have query strings and fragments removed, and private routes are excluded. Network capture keeps request timings, with private paths removed and no request or response headers or bodies. Console entries retain their level and timing, with message contents and stack traces removed. Recordings are kept for 30 days.
By default, no analytics identifier is stored on your device. The random identifiers last only as long as the page, so reloading it or opening a new tab gives you new ones. If you turn analytics on yourself in Analytics settings, or you allowed analytics there before 11 October 2026, your browser keeps those identifiers and the campaign that first brought you in its local storage. Then returning visits are measured on the same browser, not across all your devices.
You can turn analytics off at any time using Analytics settings in the footer. Do Not Track and Global Privacy Control turn them off too, whatever you chose. Turning analytics off stops future events, visit counts, session replays and heatmaps and removes the identifiers stored on your device, but it doesn't delete events already sent. While analytics are on, your browser makes a network connection to PostHog, although we disable IP-based enrichment.
YouTube data
Thumbnail Vault uses YouTube API Services. Video titles, channel names and pictures, publish dates, video lengths and view counts in the library, each channel's typical views on its recent uploads, and the recent uploads the Previewer shows for a channel you enter, come from YouTube through those services. By using Thumbnail Vault you agree to be bound by the YouTube Terms of Service. Google's Privacy Policy explains how Google handles data.
Third parties
Supabase provides authentication and private account storage. Cloudflare Turnstile checks that the account form is used by people, not automated scripts. To do that, Cloudflare processes information about your browser and connection, such as your IP address, and Supabase receives only a one-time result. YouTube provides public thumbnail images, channel upload titles and channel pictures, and the other data described under YouTube data, noembed provides public video metadata, and Vercel serves the application and counts visits. Creating a new Vault account includes joining Start Getting Views, Jamie's five-day course and ongoing YouTube newsletter. This is disclosed before you submit the signup form. After you verify your email, we record the signup request and send it to Kit. Existing course progress and unsubscribes are preserved. You can unsubscribe using the link in any newsletter email. Unsubscribing does not delete your saved Vault work. Course and booking links have their own privacy policies.
The Ideas + Bugs link opens our feedback board, a separate site run for us by Featurebase (CORDNET OÜ, Estonia), which stores data mainly in the EU. The Vault doesn't send it anything about you. Anyone can post or comment on the board without an account. Featurebase handles your posts, votes, comments and any images you add on our behalf, and your name and email too if you sign in to the board. Featurebase only emails people who sign in to the board. Posts and comments on the board are public, so please don't include private details. Featurebase's own site uses its own cookies and analytics, which its privacy policy covers.
Data retention
Account workspace and profile data remain until you remove items or request account deletion. Profile answers stay until you change or remove them, or delete your account. Removing your answers doesn't delete Jamie's own records of emails between you or calls you've booked. Device-only preferences remain until you clear site data. First-party product events and hosting logs are retained only as reasonably needed for product measurement, security and legal requirements. Newsletter data remains subject to your withdrawal of consent and Kit's retention controls. A limited record of a subscription request or unsubscribe may be retained to avoid re-enrolling you accidentally. Feedback posts stay on the board until you delete them, ask us to remove them or we close the board. Featurebase then removes the deleted data from its live systems within 90 days and from its backups within a year.
Your GDPR rights
Where we hold personal data about you, UK GDPR may give you the right to:
- Access your personal data
- Rectify inaccurate data
- Request erasure
- Request data portability
- Object to or restrict certain processing
You can ask for a copy of your data, including your saved work and profile answers, by emailing jamie@jamiewhiffen.co.uk, and we'll send it within a month.
Contact
You can delete your Vault account from Account settings. Deleting your Vault account does not unsubscribe you from email lessons, and unsubscribing does not delete your Vault account. Use the unsubscribe link in an email to stop those messages. For privacy requests, email jamie@jamiewhiffen.co.uk.