ThatLev privacy policy.

Last updated 22 October 2026. Effective on publication.

This policy covers thatlev.com, the character pages at ai.thatlev.com, the ThatLev shop, and ThatPet support diagnostics. It explains what I collect when you browse, buy something, request custom art or ask for updates. StillOn’s website and Mac app have their own privacy policy.

Who looks after your information

ThatLev is responsible for the information described here. For privacy questions or requests, email [email protected]. I don’t sell your personal information or use it for advertising profiles.

Orders and email sign-in

An order records your items, quantities, price, payment status and payment references, checkout email, and delivery address and tracking details when shipping is needed. New orders also record the artwork license version you accepted and when you accepted it. New purchases are sold through Link, Stripe’s merchant of record, which uses your checkout information for payment, tax, receipts, fraud prevention and payment support under its own privacy policy. Stripe processes payments; I don’t receive or store your full card details. For a crypto coffee, the record also includes the network, receiving address, amount and transaction ID. Blockchain transactions are public and permanent; I can’t change or remove them.

To open your purchases, enter the email you used at checkout and a one-time code sent through Resend. Your order link alone does not give someone access to your order or downloads. Sign-in and order emails do not add you to a mailing list.

A sign-in cookie remembers this browser for 90 days. Returning to your purchases renews it, with a fresh sign-in required after one year. A separate cookie for the sign-in challenge lasts 10 minutes. You can sign out of this browser or all browsers from My purchases. I store protected code verifiers, hashed session tokens and temporary request counters to prevent people from guessing codes or accessing someone else’s orders.

Artwork access and security

To investigate unauthorized sharing and delivery problems, I keep server records of shop preview and download requests for 30 days. They record the file, time, response status, general browser and device, and a pseudonymous visitor and session identifier. Authorized downloads also link to the order. These security records are separate from optional analytics and do not store raw IP addresses or send marketing notifications. A request does not prove someone saved a file or took a screenshot.

Kelvin’s license check

Kelvin, my Mac app, checks its license with thatlev.com about twice a day. Each check sends a random identifier Kelvin made on the Mac, Kelvin’s version, the macOS version and the Mac’s model, and the server sees the network address it comes from (used for rate limiting and a rough country). I keep the licence, a hash of that identifier and those details so the free preview and any removal reach the right Mac. Nothing about the battery, apps or history is sent. Removing the licence in Kelvin’s License pane disconnects that Mac from it.

ThatPet technical diagnostics

ThatPet keeps a small technical journal on your device for up to seven days, capped at 5 MB. It records app and operating-system versions, broad device architecture, pet settings, connection and character-download status, recent event types and fixed error codes. It does not collect chat text, credentials, usernames, file paths, chat identifiers, process command lines or memory dumps. Existing debug logs are never attached.

“Send crash reports” is on by default and can be turned off in Settings. On the next launch, the app can send a report about a crash or an unexplained exit; an unexplained exit may also be a force-quit or power loss. Turning this setting off also removes pending automatic reports. “Include diagnostics” is separately checked by default when you send feedback; uncheck it to send just your message and the usual system details. If you provide a reply email, that feedback and its attachment are linked.

Reports use a fresh random reference only to prevent duplicate uploads, with no lasting device identifier. Technical attachments are kept privately for 30 days and are removed without deleting your feedback or reply email. Diagnostic content is not included in support notifications. Servers see the network address needed to receive the request; it is not saved in the diagnostic report.

Advertising inquiries, coffees and support

An advertising inquiry includes your name, email, brief, offer, product link and any timing you provide; earlier custom art requests held the same kind of details. I use them to review and discuss the work with you, and they stay private. A coffee records the amount, payment method, payment status and, if you give one, your receipt email. Sending either does not subscribe you to updates. If you contact me for help, I keep our correspondence so I can follow up.

Updates you choose

Product release alerts and project launch lists are for the specific product or project you select. The character and creator updates list is separate and covers occasional emails about the characters and what I’m making. I keep your email, the list you chose, signup date and source. A signup may be linked to your visit to count interest without counting the same visit twice.

You can leave a list using its unsubscribe link, replying to an update or emailing [email protected]. Withdrawing permission stops future updates; it does not affect processing that already happened with your permission.

Promotional emails use Resend for delivery and ThatLev tracking links and a small image to record image-load signals, link clicks and their timestamps, linked to the message and recipient. Each image link and button has its own identifier so I can understand what was useful. An image load does not prove you read the email, and security or privacy tools may open images or follow links automatically. I keep these email records privately, separate test activity, and use a minimal suppression record to honour opt-outs. Website analytics still follow your cookie choice.

Understanding how the website is used

If you allow analytics, first-party measurement records page visits, sections reached, navigation timing, a few scroll milestones, video starts, and link and button clicks. It also records the referring channel, a general device and browser description, and approximate country or city where available. This helps me find broken links and see which projects and products interest people. Shop measurement also counts product views, preview and pack choices, bag changes, checkout steps and errors, download requests and clicks to open the Telegram pack. These clicks do not prove a download finished or a pack was installed. Custom-request measurement uses format choices and broad offer ranges, not your idea, name, email or exact offer. Verified orders supply sales totals.

After you agree, random cookie identifiers connect visits in this browser for up to 180 days and group activity into sessions that expire after 30 minutes of inactivity. The server hashes these identifiers before storage. Essential security and service requests use a daily pseudonymous network/browser value when there is no analytics consent. The analytics database does not store your IP address. Public counters show totals. The measurement does not record what you type, sign-in codes, customer emails, payment details or screen recordings. Private order tokens are removed from tracked addresses. Visits to other participating project marketing pages can also be counted through this shared measurement system; their own policies cover those sites.

Bag reminder emails and tracking

Checkout no longer offers bag reminders. If you asked for them before 18 October 2026, your email was linked to that bag and used for up to three reminder or offer emails. Those emails measure image loads and link clicks; mail privacy tools may load them automatically. You can unsubscribe in each email. Recovery links remember the selected offer for up to seven days, and do not sign you in or unlock downloads. Recovery message and activity records are removed after 90 days; a minimal suppression record is retained to honour opt-outs.

What this browser remembers

Alongside the sign-in cookies, your browser stores the products and quantities in your bag so they survive a reload. A separate random bag cookie lasts 30 days. Its hashed value links your bag to an anonymous server copy, including the items, amount and last activity time, so I can count unfinished bags and checkouts. A referral cookie, when set, remembers the channel you arrived from for six hours, if you allow analytics. It does not contain your email. The character signup popup remembers a dismissal for seven days or a joined flag until you clear site data; it does not store your email in that preference. Your cookie choice lasts 180 days. Optional visitor, session and referral cookies are set only after you allow analytics. There are no advertising cookies. Clearing site data empties the bag, removes these preferences and signs you out.

Why I use this information

Where data protection law requires a legal basis, orders, delivery, sign-in and support rely on performing a contract with you. Discussing an inquiry relies on taking steps you requested before an agreement. Optional updates and publication of earlier commissions, and optional website measurement, rely on your consent. Security and fraud prevention rely on legitimate interests in running the site. Accounting and other legally required records rely on legal obligations. You can object to processing based on legitimate interests.

Who helps run the site

Hosting, database, file delivery and email providers process the information needed to run their services. Stripe handles card and wallet payment records, public blockchain data providers are queried to confirm crypto payments, and Resend delivers sign-in emails. Limited operational alerts reach me through the private ThatLev topic on my ntfy server; alerts can include a signup email, an inquiry’s name, brief and offer, or an order or coffee reference, amount and items. These alerts are for me to follow up, not public posts. If a physical order needs a fulfilment or delivery provider, they receive the details needed to send it. Information may also be shared when required by law or needed to handle a legal claim.

Providers may process information outside your country, including outside the European Economic Area. Where required, transfers need an adequacy decision or appropriate safeguards such as standard contractual clauses. Contact me for information about the providers and safeguards relevant to your data. External sites you open from a link have their own privacy policies.

How long information is kept

The analytics cleanup is configured to remove individual events after 365 days; aggregate counts can remain. Anonymous bag snapshots and completed notification records are removed after 30 days by the scheduled cleanup. Email subscriptions stay while the requested list is active or until you ask to leave. Sign-in codes expire after 10 minutes; expired authentication records are cleared during subsequent sign-in activity.

Order and license records are kept for access to purchases, support, and applicable accounting or legal requirements. Inquiries, earlier commission requests and correspondence are kept while needed to discuss or deliver the work, handle follow-up questions or resolve a dispute. You can ask for deletion; some records may need to remain where the law requires it. Deleting your purchase records can affect access to downloads, so I’ll explain that before acting on your request.

Your choices and rights

Cookie settings lets you change your analytics choice at any time. Choosing only essentials stops optional tracking and removes the analytics identifiers. Your bag and sign-in keep working. Previously recorded information is subject to the retention period above.

Depending on the law that applies, you can request access to your information, correct it, ask for deletion, restrict or object to its use, or request a portable copy. You can withdraw consent to optional updates or publication at any time. I may need to verify your identity before releasing or changing private information. Where the GDPR applies, I normally respond within one month, and you can complain to your local data protection authority.

I don’t make automated decisions that have legal or similarly significant effects on you. You can browse without giving an email. An email is needed for purchases, sign-in, inquiry replies and any updates you request; a delivery address is needed only when something is being shipped.

This page will show the date of any update. If I materially change how your information is used, I’ll provide an appropriate notice and ask for new permission where required. See also the ThatLev terms.