Privacy policy

Thorwick gives creative freelancers one link per project to send their clients, showing where the project is and what it includes. It is run by Maximilian Maczynski, an individual based in the United States. Questions about this policy or your data go to hello@thorwick.com.

Creatives have an account, set up projects, and send portal links. Their clients open those links. Clients never create an account and never sign in.

• Your email address, which is how you sign in.
• If you sign in with Google: your name, email address and profile picture, as Google provides them. We ask Google for nothing else.
• What you enter about your business: business name, your name, what kind of work you make, logo, accent colour and timezone.
• Feedback you send us from the app, which arrives as an email with your name, your address and the page you sent it from.
• What you enter about your projects: titles, client names, client companies, client email addresses, descriptions, stages, notes, deliverables, and documents you upload (images and PDFs, up to 4 MB each).

Only what a creative enters about you, such as your name, company and email address, and the project details they share with you. The creative decides what goes on your project page. For questions about it, ask them first, or write to us.

If you answer a review from your project page — send notes, say you sent them another way, or approve — we ask for your name and email the first time, and keep them with the project alongside what you sent, so the creative knows who it came from. The creative can see them, and anyone the link is forwarded to sees your name on the project’s revision history, never your email. When you approve, we email you a receipt as your record.

Opening a project link sets no cookies and requires no sign-in. Like any website, our hosting provider receives basic request information, such as your IP address and browser type, in order to deliver the page.

We record that a project page was opened, so the creative can see whether the link reached you, and we email them the first time you open it. We do not store your IP address for this. Instead we keep a code made from the date, the link, and your browser and network details, which lets us tell one visit from another on the same day and cannot be matched to visits on any other day. We do not know who you are from it.

If the creative has your email address, they can send you the link, and we send you an update when they move the project to a new stage. Those emails come from us on their behalf, and replying to one reaches them, not us. Ask them to stop sending them and they can switch them off for your project.

From the home page you can ask for free beta access. We keep your name and email address, and note where you came from, meaning the site that linked you and any campaign tag in the link, so we know which posts are working. Earlier sign-ups may also have told us what they make, how many projects they run, a link to their work, and what it would be worth to them.

We use it to let you in, or to tell you when there is a spot, and we email you when you do. Reply to any of our emails to be taken off the list, and we delete your entry.

Thorwick sets cookies to keep creatives signed in. There are no advertising cookies, no analytics cookies and no third-party tracking. Opening a project link sets no cookies. If you answer a review, one cookie remembers your name on that device for a year, so you are not asked again; choosing “Not you?” removes it.

To see how many people visit our own pages, such as the home page and the app, we use Vercel Web Analytics. It sets no cookies, does not follow you across sites, and does not identify you: it counts page visits with the page address, the referring site, and your country, browser and device type. Project pages are never counted, and we strip everything from page addresses except campaign tags like ?ref=.

When a creative sends you an update, your project page plays a short animation the first time you open it. So that it plays only once, your browser remembers, in its own storage, which updates you have already seen. That note holds nothing about you and never leaves your device, and clearing your browser data removes it.

If a creative adds a video to your project page, it stays a plain tile until you press play. Only then does the player load from YouTube or Vimeo, and those services may set their own cookies from that point, under their own policies.

To run Thorwick: to sign you in, to store and show your projects, to email clients about the projects they are part of, and to tell creatives when a client first opens a link or a project has gone quiet. We do not sell personal information, show advertising, or use your content to train AI models, and we never email a client about anything but their own project.

Thorwick’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Google information is used only to sign you in and identify your account.

We use a small number of providers to run the service. Each processes data only to provide its part of it:

• Supabase, for the database, file storage and sign-in
• Resend, for sending email
• Vercel, for hosting and for counting visits to our own pages
• Google, only if you choose to sign in with Google

These providers may process data in the United States. We share personal information with anyone else only if the law requires it.

A project link works without a password, so anyone it is forwarded to can see that project page. The link is long and random, so it cannot be guessed, and project pages are hidden from search engines. A creative can change a link, which stops the old one working, or turn it off entirely.

As long as your account is open. When you delete a project, it disappears from your list and its link stops working. We keep the record until your account is closed. When you ask us to close your account, we delete your account and its projects within 30 days.

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Write to hello@thorwick.com and we will reply within 30 days. We will not treat you differently for asking.

All traffic is encrypted over HTTPS. Project data can only be read by our own servers, never directly from your browser, and every request is checked against the account it belongs to. No system is perfectly secure, and if a breach affects your data, we will tell you.

Thorwick is a tool for working professionals and is not directed at children under 13. We do not knowingly collect their information.

When this policy changes, the date at the top changes too. If a change affects how your data is used, we will email account holders before it takes effect.