Privacy Policy
Effective and last updated: October 11, 2026
This Privacy Policy explains what information Thruline Studio collects, why we use it, when we disclose it, how long we keep it, and the choices available to you.
Scope and operator
Tio Magic Company, doing business as Thruline Studio ("Thruline," "we," "our," or "us"), operates the Thruline Studio website, collaborative production workspace, and related services. This Policy applies to information we process through those Services and when you communicate with us. It does not govern a third party’s independent services or practices.
Information we collect
We collect information you provide, information created through your use of the Services, and limited technical information needed to operate and protect the product. Depending on how you use Thruline, this may include:
- Account and identity data, such as your Google account name, email address, profile image, internal user ID, authentication session, and project role.
- Project and User Content, including scripts, notes, prompts, chats, comments, descriptions, uploads, images, video, audio, source documents, Canvas layouts, Storyboard plans, Sequences, exports, and generated output.
- Collaboration data, such as project membership, invitations, live presence, cursors, selections, edits, review comments, activity attribution, and revision or conflict records.
- Generation and agent data, such as selected models, prompts, reference associations, parameters, estimates, credit holds and balances, job state, provider request metadata, outputs, errors, proposals, approvals, and operational events.
- Technical and usage data, such as IP address, browser and device information, authentication and security logs, requested routes, timestamps, performance data, error diagnostics, basic signed-in activity timestamps and daily visit/sign-in counts retained for 12 months, and privacy-normalized analytics events when optional analytics is enabled.
- Communications you send us, including support, privacy, copyright, feedback, and generation-credit requests.
Sources of information
We receive information directly from you; from your Google sign-in; from project owners and collaborators who invite you, mention you, or contribute to shared projects; automatically from your browser, device, and use of the Services; and from service providers that return authentication, hosting, storage, analytics, generation, moderation, billing-cost, security, or delivery information.
How we use information
We use personal information for the following business and operational purposes:
- Provide, authenticate, personalize, synchronize, export, support, and maintain the Services and your projects.
- Perform requested AI generation, analysis, import, agent, and media-processing operations; preserve generation evidence; and calculate or reconcile credits.
- Protect accounts, enforce permissions, prevent fraud and abuse, investigate failures, debug problems, and improve reliability and safety.
- Respond to support and legal requests and send important service, security, account, or policy notices.
- Comply with law, enforce our Terms, protect rights and safety, maintain business records, and establish or defend legal claims.
AI processing and no-training commitment
When you choose an AI-assisted feature, the Services assemble the prompt and relevant project context and send the minimum material reasonably needed to the configured provider. Depending on the feature, that material may include text, images, video, audio, or documents. Current providers may include Google Gemini, Fal, and Replicate. Their processing and retention are governed by their API terms, model terms, our account configuration, and applicable data-processing commitments.
Thruline does not use User Content to train or fine-tune AI models and does not sell User Content as training data. We may use de-identified or aggregated operational information that does not identify you or expose project content to understand reliability, cost, safety, and feature usage. Providers may retain limited request or usage data for service delivery, security, abuse prevention, or other purposes allowed by their terms.
How we disclose information
We disclose information only as reasonably necessary for the purposes described in this Policy, including to the following recipients:
- Infrastructure and authentication providers, including Supabase, Google authentication and Google Cloud Storage, and Vercel, for account access, databases, collaboration, private media storage, hosting, networking, and delivery.
- AI and media-processing providers, including Google Gemini, Fal, and Replicate, when a requested feature requires model processing, moderation, or output delivery.
- PostHog, when analytics is deployment-enabled, for privacy-configured page analytics, session replay, and application error tracking. We disable interaction autocapture and mask rendered text and input values; we do not intentionally send raw project content in custom analytics events.
- Authorized project owners, editors, and viewers according to project membership and role. Content you place in a shared project is available to authorized members of that project. Portfolios are separate from projects: explicitly publishing a Personal or Team Portfolio makes its published name, handle, profile text, avatar, selected contact information, links, and works publicly accessible. Drafts are not public. Selecting Play on a Portfolio YouTube work connects your browser to YouTube; its own privacy practices then apply. We do not load the YouTube player before you select Play.
- Courts, regulators, law enforcement, professional advisers, and affected parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or establish and defend claims.
- A buyer, investor, lender, successor, or adviser in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and legal safeguards.
Retention and deletion
We generally retain account and durable project content while your account or project remains active, until you delete it through available project controls, or until an authorized account-deletion request is completed. Temporary source imports are generally designed to expire within 24 hours, unfinished onboarding sessions within seven days, and completed project-export archives within 24 hours. Provider copies follow provider retention settings and terms. We may retain limited backups, security logs, credit and transaction records, deletion evidence, and legal records for as long as reasonably necessary for recovery, fraud prevention, accounting, disputes, compliance, and enforcement. Deletion from active systems may not be immediate or complete where law or technical backup cycles require continued retention.
Security
We use administrative, technical, and organizational safeguards designed to protect personal information, including authenticated access, project-scoped authorization, private cloud storage, short-lived media links, server-only provider credentials, and database row-level security. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or disclosure will never occur. Keep your Google account secure and contact us promptly if you suspect misuse.
California notice at collection
In the preceding 12 months, we may have collected and disclosed the following California categories of personal information to the service providers and recipients described above for the business purposes in this Policy:
- Identifiers and customer-record information: name, email address, profile image, account and project IDs, IP address, authentication data, and support contact details.
- Commercial information: generation-credit balance and ledger activity, model selections, requested services, generation jobs, exports, and related transaction or cost records. The Services do not currently collect consumer payment-card details.
- Internet or electronic activity: routes and features used, interactions, device and browser information, logs, session and collaboration activity, and privacy-configured analytics.
- Audio, electronic, visual, and similar information: images, video, audio, source documents, generated media, comments, prompts, and other submitted project content.
- Preferences and limited inferences: appearance and model preferences, likely workflow state, generation defaults, safety signals, and project associations used to provide and secure the Services.
- Sensitive personal information: account log-in and authentication information. User Content may also contain sensitive information chosen by a user; we do not use sensitive personal information to infer characteristics about a person.
No sale, sharing, or targeted advertising
Thruline does not sell personal information for money or other valuable consideration and does not share personal information for cross-context behavioral advertising. We have not done so in the preceding 12 months. We do not knowingly sell or share personal information of anyone under 18, and we do not use sensitive personal information to infer characteristics. Because we do not sell or share personal information as those terms are defined by California law, the Services do not currently provide a sale-or-sharing opt-out link. If these practices change, we will update this Policy and provide required controls.
Your privacy rights
Depending on where you live and subject to legal exceptions, you may have the following rights concerning personal information:
- Know and access the categories and specific pieces of personal information we hold, the sources, purposes, recipients, and applicable sale or sharing disclosures.
- Correct inaccurate personal information associated with your account or projects.
- Delete personal information, subject to exceptions for security, legal compliance, completing requested transactions, internal records, and other permitted purposes.
- Receive a portable copy of qualifying information. Project owners may also use available project-export tools for project content.
- Exercise applicable privacy rights without unlawful discrimination or retaliation.
How to make a privacy request
Email admin@tiomagic.com from the address associated with your account and describe the access, correction, export, or deletion request. We may ask for information reasonably necessary to verify your identity, authority, project relationship, and the scope of the request. An authorized agent must provide proof of authority, and we may still verify the request with the account holder. We will respond within the time required by applicable law and explain if an exception applies. Do not send passwords, OAuth tokens, or unnecessary identity documents.
Children
The Services are not directed to children and may be used only by people aged 18 or older. We do not knowingly collect personal information from a child through an account. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
United States processing
Thruline and its providers may process and store information in the United States and other countries where they operate. Those locations may have privacy laws different from the laws where you live. When required, we rely on contractual, organizational, or other lawful safeguards for transfers.
Changes to this Policy
We may update this Policy to reflect changes in law, providers, security, or the Services. We will post the revised Policy with a new effective date and provide additional notice for material changes when reasonably practicable. We will not apply a materially expanded use of previously collected User Content retroactively without an appropriate legal basis or consent where required.
Contact
For privacy questions, requests, complaints, or account deletion, contact Tio Magic Company, doing business as Thruline Studio, at:
admin@tiomagic.com