Privacy Policy

1. Data Controller

ThermalStats ("we", "us", "our") operates the website thermalstats.com and is the data controller responsible for your personal data. For any privacy-related inquiries, contact us at [email protected].

2. Information We Collect

ThermalStats collects only the data needed to provide temperature comparisons. Accounts are optional: without one we collect no personal identifying information, and accounts never use passwords.

• Hardware data: CPU model, GPU model, cores, VRAM, cooling type, cooler model, OS, device type, and laptop model (if applicable).
• Temperature data: Idle and load temperatures for CPU and GPU, ambient temperature.
• Test metadata: Test duration, CLI version, an anonymous session ID, and user-agent string.
• Network data: We may store the country derived from your IP address for regional statistics. We do not store raw IP addresses in the database.
• Newsletter: If you sign up for the newsletter (on the blog or from your account), we store your email address and the site language you signed up in.
• Waitlists: If you ask us to tell you when something is ready (such as the macOS app), we store your email address, the site language you used, which kind of Mac you have if you tell us, and when we emailed the list.

Results are only stored when they are submitted from the ThermalStats CLI tool. The browser test sends the CPU/GPU model and temperatures you enter to our server to calculate a comparison, but does not store them.

If you create an account, we also store:

• Account details: your email address and, if you sign in with Google or Discord, the name and profile picture they share with us, and which of them you have connected.
• Sign-in sessions: for each signed-in device, your browser's user-agent string and IP address, kept until that session ends.
• What you add: the results you save, the names and profiles of your PCs (cooler, case, fans, thermal paste, notes), changelog entries, private notes on results, and which results you unlisted.
• Saving results: when the CLI submits a result, we keep a one-way hash of a one-time code for up to 7 days so that only the person who ran the test can save it, and a keyed hash of the submitting network address for up to 24 hours so results from older CLI versions can be saved within the hour. We don't store the address itself.
• Sign-in codes: stored hashed and valid for 10 minutes.
• Linked PCs: for each PC where you link the CLI to your account, the name it reports (computer name and operating system), its machine ID, a one-way hash of its access token, and when it was linked and last sent a result.
• XP, levels and badges: worked out automatically from the results you save and your PC profiles. They are visible only to you unless you publish a profile.
• Public profile (optional): the handle you choose, an optional display name and short bio, which of your PCs to show, and whether the profile is published.
• Invites: if you create your account through someone's invite link, or enter their handle in your settings, we record who invited you. They see how many people joined through their invite, not who.
• Patreon link (optional): if you connect Patreon in your settings, your Patreon user ID and, for a membership in ThermalStats' Patreon campaign, its status, monthly amount and start date, kept up to date by Patreon; whether you're listed on the supporters wall, and your profile card theme. We never receive your payment details or email from Patreon, and we don't keep the sign-in token Patreon gives us when you connect. If you disconnect, we keep only whether you were a Founding Supporter.
• Supporter perks: your vote for a month's community goal (Liquid Looper), and which beta builds you downloaded and on which day (so we can see interest by platform).
• Email choices: which alert emails you turned on (re-test reminders, temperature alerts, monthly recaps, CLI update emails) and their language; a record of each time you turned one of them or the newsletter on or off (when, and whether from your account or an unsubscribe link); whether you said no to the newsletter offer on your account page; and a log of the alert emails we sent you (which kind, which PC, month or CLI version it was about, and when).

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your data based on the following legal grounds:

• Legitimate interest (Art. 6(1)(f) GDPR): For processing anonymous hardware and temperature data to provide the core service (temperature comparisons), for abuse prevention (rate limiting and bot protection), and for cookieless, aggregate site analytics.
• Consent (Art. 6(1)(a) GDPR): For the newsletter and waitlists, and the alert emails in your account settings, which you choose to sign up for and can leave at any time.
• Contract (Art. 6(1)(b) GDPR): For providing the account you sign up for: signing you in, saving your results and showing your history, XP and badges.
• Consent (Art. 6(1)(a) GDPR): For publishing your profile, which you choose to do and can undo at any time by unpublishing or deleting it.

4. How We Use Your Data

• To display temperature comparisons against users with similar hardware.
• To compute aggregated statistics (averages, percentiles, cooling-type breakdowns).
• To detect and prevent abuse (rate limiting, duplicate detection).
• To handle reports: when someone reports a profile or a result, we store the reason, any note they add, and a keyed one-way hash of their network address (so the same network can't report the same thing twice), never the address itself.
• To check each CLI result automatically (whether the test ran long enough for temperatures to settle, whether the load held, and whether the numbers are consistent and plausible) and decide whether it counts for XP and comparisons. Results that look wrong are held until we review them.
• To send the newsletter to people who signed up for it, and to tell people on a waitlist when what they asked about is ready.
• To run your account: email you sign-in codes, keep you signed in, and show your saved results, PCs and history.
• To send the alert emails you turn on, and none you haven't: at most one re-test reminder each time a PC goes 6 months without a test, at most one temperature alert per PC every 30 days, one recap a month (your saved runs, XP, badges, leaderboard spot and the community goal), and one email per CLI release.

5. Cookies & Local Storage

We do not use analytics or advertising cookies, and we do not show ads. The only cookies and browser storage we use are needed for the site to work, so we don't ask for cookie consent:

• Language: A NEXT_LOCALE cookie remembers the site language you chose.
• Theme: A local storage entry remembers the color theme you picked.
• Security: Cloudflare, which delivers our site, may set cookies such as __cf_bm or cf_clearance to tell people from automated bots and to block abuse.
• Sign-in: If you have an account, a ts.session_token cookie keeps you signed in for 30 days, renewed while you use the site. Administrators have separate sign-in cookies.
• Saving a result: When the CLI opens your result, the one-time code that lets you save it is kept in your browser's local storage until you use it or 7 days pass.

6. Analytics

We measure site traffic with Cloudflare Web Analytics, provided by Cloudflare, Inc. (USA). It does not use cookies or local storage and does not fingerprint visitors. It reports aggregate information such as the pages viewed, the referring site, the browser, operating system, and country, and page-loading performance. We cannot use it to identify or follow individual visitors. See Cloudflare's privacy policy for details.

7. Other Third-Party Services

• Cloudflare: Our site is delivered through Cloudflare's network, which processes IP addresses and request data to serve pages, protect the site from attacks and bots, and provide the aggregate analytics described above.
• Resend (USA): delivers our emails (sign-in codes, the alert emails you turn on, the newsletter and waitlist emails), so it processes your email address and the message.
• Cloudflare Turnstile: checks that sign-ins come from people, not bots. See Turnstile's privacy addendum.
• Patreon (USA): handles pledges, payments, refunds and cancellations under its own privacy policy. If you connect it to your account, it tells us your Patreon user ID and your membership in our campaign.
• Google and Discord: if you choose to sign in with them, they share your name, email address and profile picture with us under their own privacy policies.
• Affiliate links: We may participate in affiliate programs (e.g., Amazon Associates). When you click an affiliate link and make a purchase, we may earn a commission at no extra cost to you. Affiliate partners may use cookies to track referrals.

8. International Data Transfers

Some of our service providers, including Cloudflare and Resend, are based in the United States. When data is transferred outside the EEA, we rely on appropriate safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses (SCCs). Cloudflare, Inc. is certified under the EU–US Data Privacy Framework.

9. Data Sharing

We do not sell, trade, or rent your data. Hardware and temperature submissions are publicly visible in aggregated form through the Browse Data page. Individual submissions are accessible via their unique result URL but contain no personal identifying information. We do not share data with advertising networks. Saving a result to your account doesn't change who can see it, and nothing in your account (email, PCs, notes, changelog) is shown to anyone else. If you publish a profile, anyone with its link can see your handle, display name, bio, level, XP and badges, and the PCs you chose to show with their latest temperatures and links to their results. Profiles are kept out of search engines, and a moderator may hide one that breaks our terms. Leaderboards list results by their temperatures and hardware. A result appears under your handle only if your profile is public and you saved the result to your account; otherwise it appears as Anonymous.

10. Data Retention

Temperature submissions are retained indefinitely to maintain the accuracy of community averages. Since no personal data is collected in submissions, there is nothing to delete on a per-user basis. Aggregate analytics are kept by Cloudflare under its own data retention policies. Newsletter and waitlist addresses are kept until you unsubscribe; we may also delete a waitlist once what it was for has launched. Account data is kept until you delete your account. Sign-in sessions end after 30 days without use, or when you sign out. Your email choices, the record of when you turned alert emails on or off (our proof that you asked for them) and the log of alert emails sent are kept until you delete your account. When you delete your account, your PCs, notes, changelog, sessions and email records are deleted; results you saved stay public and in the averages, no longer linked to anyone. Your XP, badges, public profile, the record of who invited you, your Patreon link, goal votes and beta downloads are deleted with your account; you can also unpublish or delete your profile, or disconnect Patreon, at any time.

11. Your Rights (GDPR & Other Jurisdictions)

If you are in the EEA, UK, or another jurisdiction with data protection laws, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your data (noting that submissions are anonymous and may not be linked to you).
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.

If you have an account, you can download your data, unpublish or delete your public profile, and delete your account yourself under Account → Settings. Alert emails can be turned off there too, or with the one-click unsubscribe link in every alert email. To leave the newsletter or a waitlist, use the unsubscribe link in any of its emails or write to us. To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection supervisory authority.

12. Children's Privacy

ThermalStats is not directed at children under 16 (or under 13 in jurisdictions where that threshold applies). We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. If changes are significant, we will make reasonable efforts to notify you (e.g., via a banner on the site).

14. Contact

If you have questions about this privacy policy or wish to exercise your data protection rights, contact us at [email protected]. You can also reach us via GitHub Issues.