/api/inquiry)When you submit the inquiry form on the homepage, we collect: name, email address, project type, and message. This data is stored privately on our server (inquiries.json), forwarded to internal channels (Discord and Telegram) so we can respond, and retained until your inquiry is resolved or 24 months - whichever comes first.
We use Microsoft Clarity, a privacy-conscious analytics product, to understand site usage. Clarity captures clicks, scroll depth, page paths, browser/device type, country/region, and anonymized session recordings. Clarity automatically masks sensitive fields (passwords, credit cards) and does not capture keystrokes outside form fields. Clarity data is owned by Microsoft and governed by the Microsoft Privacy Statement.
Our server logs anonymous aggregated pageview data (path, screen width, referrer domain) to pageviews.log. This data is not linked to identity. We rotate these logs every 90 days. Cloudflare upstream additionally logs request IPs and user agents for security and abuse prevention - their retention is governed by the Cloudflare Privacy Policy.
When you email audit@thirstyai.live (or any @thirstyai.live address), Cloudflare Email Routing forwards your email to our inbox. Forwarded email is retained for as long as needed to respond and follow up.
We do not use your data for advertising. We do not sell it. We do not share it with third parties except the named processors below.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Cloudflare | CDN, DNS, email routing, DDoS protection | Request metadata (IP, UA, headers) | Global edge |
| Microsoft Clarity | Aggregated usage analytics + session replay | Anonymized behavior data | US (Microsoft Azure) |
| Google Fonts | Typography (Bebas Neue, DM Sans, DM Mono) | IP address when loading fonts | Global edge |
| Discord / Telegram | Internal inquiry notifications | Inquiry content (name, email, message) | US |
If you are located in the EU/EEA, UK, or Switzerland, your data may be transferred to the United States. Transfers to Microsoft (Clarity) are governed by Microsoft's Standard Contractual Clauses. Cloudflare is certified under the EU-U.S. Data Privacy Framework. Data minimization and pseudonymization are applied wherever practical.
Under GDPR (EU/UK), CCPA/CPRA (California), and similar laws, you may have the right to:
To exercise any of these rights, email audit@thirstyai.live with the subject line DSAR Request. We respond within 30 days.
If you are a California resident, the following additional rights apply:
Global Privacy Control: We honor the GPC signal. When your browser sends Sec-GPC: 1 or navigator.globalPrivacyControl = true, we treat it as an opt-out signal and suppress non-essential analytics (Microsoft Clarity) on this device.
The site sets a small number of cookies and localStorage entries:
| Cookie/Key | Set by | Purpose | Lifespan |
|---|---|---|---|
| _clck, _clsk | Microsoft Clarity | Link a visitor's pageviews into one session, bot detection | 1 year / session |
| MUID | Microsoft (c.bing.com) | Cross-site user identifier for Clarity | 1 year |
| showTab, theme | thirstyai.live (localStorage) | Remember your tab choice and light/dark mode | Until you clear it |
| analytics_consent | thirstyai.live (localStorage) | Record your consent or opt-out choice | Until you clear it |
*.clarity.ms and c.bing.com| Data type | Where | Retention |
|---|---|---|
| Inquiry form submissions | inquiries.json + Discord/Telegram | 24 months or until resolved |
| Server pageview logs | pageviews.log | 90 days, rotated |
| Cloudflare access logs | Cloudflare | Per Cloudflare retention policy |
| Microsoft Clarity | Microsoft Azure | Per Microsoft Clarity policy |
| Email correspondence | audit@thirstyai.live inbox | Until case closed |
This site is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, please contact audit@thirstyai.live and we will delete it.
We protect data with TLS 1.2+ (HSTS preload pending), CSP headers, CAA DNS records, restricted admin access, and least-privilege server permissions. inquiries.json is stored with restrictive file permissions on a private VPS. No data store on this site is publicly indexed.
We may update this policy as the site evolves. The "last reviewed" date at the top reflects the most recent change. Material changes will be announced on the homepage and/or via direct email if you have an active inquiry with us.
For any privacy question, data-subject access request, or to invoke any right under this policy:
Email: audit@thirstyai.live
Subject line: Privacy Request (or DSAR Request)
Operator: Joel Panchevre, San Antonio, TX, USA
Responsible disclosure: /.well-known/security.txt