Privacy Policy

This policy describes what thrill.foo, operated by Thrillmade LLC, doing business as Thrill Studio (“Thrillmade,” “we,” “us”), collects from visitors, how that information is used, who it is disclosed to, and how it is safeguarded. It covers the public site only — not studio.thrill.foo, the separate, credentialed surface Thrillmade staff use internally.

We wrote this to describe what the site actually does, not what a generic privacy policy template assumes a website does. thrill.foo runs no analytics, no advertising, and no third-party trackers of any kind.

Information we collect

We collect three things, and nothing beyond them:

• Standard server request logs. Our hosting provider, Vercel, processes ordinary web server logs (IP address, user agent, requested URL, timestamp) as a normal part of serving every page. This happens automatically for any website; we do not layer any additional tracking on top of it.
• One functional cookie, only if you unlock a client pitch. Client pitch pages live at thrill.foo/p/<slug> behind a password. Entering the correct password sets a single httpOnlycookie so the page stays unlocked for your session. That cookie carries no personal information and is not used to track you across the site or elsewhere — it exists solely to remember that you unlocked that one page. This is the only cookie a visitor to the public site can receive.
• Whatever you send us directly.There is no contact form on the site, so we don’t collect form submissions. The “talk to us” button opens an email addressed to hello@thrill.foo, our public contact address — if you email us, we receive whatever you choose to include, the same as any other email correspondence.

We do not use cookie banners, ad pixels, behavioral profiling, or data brokers, because none of those are part of the site. There is nothing else to disclose about tracking because there is no other tracking.

How we use it

• Server logs are used for security, debugging, and abuse prevention — the same operational purpose any hosted website uses them for.
• The pitch-unlock cookie is used only to keep a password-protected pitch page unlocked for the visitor who entered the password.
• Email you send us is used to respond to your inquiry and, if it leads to a client engagement, to conduct that business relationship (proposals, invoicing, project communication).

We do not sell personal information, and we do not share it for advertising purposes.

Who we disclose information to

We rely on a small set of named service providers (subprocessors) to run the site and the business. Each receives only what it needs to perform its function, under its own standard security and data-processing terms:

• Vercel— hosts thrill.foo and processes the standard request logs described above as part of serving the site.
• Supabase— provides authentication for studio.thrill.foo, the internal surface Thrillmade staff use to sign in. It is not reachable by, and does not receive information from, visitors to the public site.
• Resend— sends the email-based login links staff use to authenticate on the internal surface, and may be used to send or receive business correspondence.
• Stripe— processes payments for client engagements. Stripe handles all payment and card information directly; it is never collected, transmitted through, or stored on thrill.foo’s own servers.

We disclose information to these providers only as necessary to operate the site and the business, and to no one else except where required by law.

Security

• All traffic to thrill.foo is served over HTTPS.
• The pitch-unlock cookie is set httpOnly, so it cannot be read or cleared by page scripts.
• The internal surface (studio.thrill.foo) is gated end-to-end by Supabase-authenticated, allowlisted accounts — no part of it is reachable from the public site or by an unauthenticated visitor.
• Payment and card data never touch our servers; Stripe handles that directly under its own security program.

Data retention

Server logs are retained per Vercel’s standard operational log window, not indefinitely. Email correspondence is kept for as long as it’s relevant to the business relationship it supports.

Children

thrill.foo is a business-to-business marketing site and is not directed to children.

Your choices

Because we don’t run analytics or advertising, there’s no tracking to opt out of. If you’d like to know what information we hold about you, or want us to delete correspondence you’ve sent us, email hello@thrill.fooand we’ll handle it directly.

Changes to this policy

We may update this policy as the site or business changes. The “last updated” date at the top of this page always reflects the most recent revision.

Contact

Thrillmade LLC
418 Broadway, Ste N
Albany, NY 12207
hello@thrill.foo

This policy is governed by the laws of the State of New York, with venue in New York County.