Privacy

Thumble privacy

Last updated: July 30, 2026

What we collect

If you join the Thumble launch list, we collect your email address, the time you signed up, the form source, your consent text, country from Cloudflare, browser user agent, and a hashed IP address for basic abuse prevention and consent records.

Skin directory and downloads

You do not need an account to browse or download skins. The directory catalog and .pocketpad packages are static files. Thumble does not add tracking parameters or create a profile when you install one. Cloudflare may process standard request data to host, cache, secure, and operate the site.

ChatGPT Controller Builder

The optional Thumble plugin for ChatGPT processes the controller name, labels, semantic key names, layout, appearance choices, source summary, confidence, and notes that ChatGPT sends to its tools. It does not connect to your Mac, inspect installed profiles, receive raw key codes, collect files or credentials, press controls, or install anything.

Controller drafts are carried in signed bearer tokens rather than stored in a Thumble account or database. Draft tokens expire after one hour and prepared download links expire after ten minutes. The tokens are integrity-protected but not encrypted, so anyone who receives one before it expires may use it. Do not share a draft or download URL publicly.

The MCP application logs only the requested tool or download operation, outcome category, duration, and request size. It does not intentionally log controller contents or bearer-token URLs. The hosting provider may process IP addresses and normal HTTP connection information to deliver and secure the service. ChatGPT processes conversation and tool data under OpenAI's own terms and privacy policy.

Native controller import

A downloaded .thumblecontroller file stays on the device where you save it. Thumble validates it locally and asks for confirmation before adding a new keypad setup. The artifact format cannot contain application launch targets, filesystem paths, image payloads, credentials, raw key codes, shell commands, or instructions to replace, select, or default a profile.

How we use information

We use your email only to send Thumble launch updates, tester announcements, and related product news. Controller draft data is used only to validate, preview, and return the controller you requested. We do not sell personal information or share it with advertisers.

Where it is stored

Waitlist signups are stored in Cloudflare D1. Cloudflare may process technical request data to provide hosting, security, and database services.

Your choices

You can unsubscribe from future launch emails at any time. You can also ask us to remove your waitlist record by emailing [email protected].

Retention

We keep waitlist records until the launch campaign is complete or until you ask us to delete your record. The ChatGPT Controller Builder does not maintain a customer profile or controller database. Signed drafts and downloads become unusable at their stated expiration, while infrastructure security logs may be retained for up to 30 days unless a longer period is required to investigate abuse or comply with law.

Security and support

Report a security concern privately to [email protected]. For product help, see Thumble Support.