Browsing. We record product events first-party: page views, preview opens, on-site searches (the query text), checkout starts and downloads. Each event carries a random session identifier, the referrer, the landing page, UTM parameters if present, and a device class (mobile, tablet, desktop). None of it is tied to your name or email. The identifier stays in your browser and is replaced after 30 minutes without activity, so it is not reused across visits to build a profile.

Arriving from a Google ad. Google adds a click identifier to the link. We keep it with the anonymous session for 90 days, like the other campaign parameters. Each event also carries a random tab identifier. It is kept in that tab's session storage and ends when you close the tab. If you open a live preview from that tab and return from it to buy, the identifier comes with you. If you buy in that tab, or in another tab before the session identifier is replaced, we tell Google that the click led to a sale. We do it in a file we upload ourselves, with the click identifier, the time and value of the sale, and our order number for it (so a refund can be withdrawn). It never includes your email or anything else about you. We never do this for visitors in the EEA, the UK or Switzerland, or when we cannot tell the country (every event records the country a request came from, never a region, city or IP address). There is still no Google script, pixel or cookie on this site.

Buying. When you purchase, we store your email, the license key, the theme and version it names, and the Polar order id — the minimum a working license requires. Your payment details go to Polar (the merchant of record), never to us.

Subscribing. If you give us your address for the mailing list, we store the address, which page you gave it on, and the dates you confirmed and unsubscribed. We use it for one thing: a mail when a theme ships or a post goes up. Nothing is sent until you click the confirmation link, every mail carries a one-click unsubscribe, and unsubscribing is immediate. We do not sell, rent or share the list, and we do not track opens or clicks — a mail from us contains no tracking pixel and no rewritten links. Ask us to delete your address and it goes, not just its subscription.

Buying or signing in adds you to the list. A purchase or a verified account puts that address on the same list, without a second confirmation step: the payment or the sign-in verified it already. The mails are the same ones, the one-click unsubscribe in each of them is the same, and once you unsubscribe, buying or signing in again does not put you back.

Writing to us. Support email stays in the mailbox you wrote to, used only to answer you.

Signed in. Where accounts exist (comments, /account), authentication is handled by Clerk, which sets the session cookies that keep you signed in. Comments and ratings you post are stored with your account identity — that is the point of posting them.

• No third-party analytics — no Google Analytics, no pixels.
• No cross-site tracking, and no ad script, pixel or cookie. The one advertising use is the sale we report to Google, above.
• No tracking cookies. Your light/dark preference stays in your own browser and never reaches us.
• No card numbers or billing addresses — Polar holds those.
• No selling or sharing of data with anyone, ever.

Four services run this site, each seeing only what its job needs:

• Vercel — hosting. Standard server logs (IP addresses, request paths) exist transiently at the infrastructure level.
• Convex — the database holding events, licenses and comments described above.
• Polar — merchant of record for payments; collects your billing details under its own privacy policy and passes us your email and order id.
• Clerk — authentication, where sign-in exists.

Google is not one of them. It hears from us only about a sale that began with a click on our Google ad, outside the EEA, the UK and Switzerland, exactly as described under what we collect, and holds that under its own privacy policy.

Events tell us which themes get looked at, which get bought, and which searches return nothing — that is how the catalog decides what to build next. License records make your downloads work and let us honor refunds. The one advertising use is the Google click identifier: it tells Google which of our ads led to a sale, so we keep paying for the ads that work and stop the ones that do not. The only mail about new themes and posts is the list described above, which you can leave in one click.

Click identifiers are removed after 90 days, the longest Google accepts a sale for an ad click. With them go the other campaign parameters: the UTM values, and anything after the “?” in the landing and referring addresses. Raw browsing events (page views, preview and demo clicks, searches, checkout starts, errors) are deleted after 180 days, keeping only daily counts: how many of each a theme and a campaign had that day, with no session identifier, search text, country or device. A job runs this every day.

Purchase, refund and download records are kept, because licenses, refunds and the download counts on theme pages depend on them. License records live as long as the license does — deleting one kills your downloads, so we keep them until you tell us to. The upload files we make for Google are deleted once Google has them. Support mail is kept as long as the conversation is useful.

Email support@tailthemes.com from the address on your order and we will tell you what we hold about you, correct it, or delete it — deletion included, with the caveat that deleting a license record ends that license. We answer within 30 days, usually much faster. If you are in the EU or UK, these are your GDPR rights and they work exactly this way.

The site sells developer tooling and is not directed at children under 16; we do not knowingly collect their data.

If what we collect changes, this page changes first and the date at the top moves. Material changes to what happens with purchase data would be announced to affected buyers by email, not just posted here. See also the terms of service.