Who we are
thx.so is operated by Bypass Inc. (バイパス株式会社), a company registered in Japan. You can reach us at privacy@thx.so.
What we collect — creators
When you sign up as a creator, we store: your email address, your chosen profile slug, an optional bio and avatar, and the ID of the Stripe account you connect. We do not store your card or bank details — Stripe holds those on your connected account.
What we collect — tippers
When someone tips a creator, Stripe collects their payment method on the creator's connected account; we never see card data. We store the tipper's email (for the receipt) and any optional message they include with the tip.
We do not place tracking cookies on creator profile pages (thx.so/<slug>).
Cookies
We use a session cookie on the dashboard so you stay signed in. We do not use analytics or advertising cookies on marketing pages or creator profiles by default.
Subprocessors
The following services process data on our behalf:
- Stripe — payments, KYC, payouts
- Cloudflare — hosting, CDN, edge compute
- Supabase — database, authentication
- Email provider (Resend or Postmark, TBD) — transactional email
- Sentry — error tracking
Retention
Account data is retained for the lifetime of your account, plus 90 days after deletion. Transaction logs are retained for seven years to satisfy financial record-keeping requirements.
Japan-specific
We comply with Japan's Act on the Protection of Personal Information (個人情報保護法 / APPI). Japanese residents may exercise rights under the APPI by contacting privacy@thx.so.
Your rights (GDPR / CCPA)
If you are in the EU, UK, or California, you have rights including access, correction, deletion, and portability of your personal data. Email privacy@thx.so and we'll respond within 30 days.
Changes to this policy
We'll notify creators by email at least 30 days before any material change to this policy.