Website and purchase privacy notice

Applies to: throughlinepost.com and buying a Throughline subscription
Last updated: 2026-10-14
Controller: Lucrative Pictures LLC, an Arizona limited liability company
· PO Box 123, Flagstaff, AZ 86002, USA
Contact: privacy@throughlinepost.com

This notice covers the website. The application is a separate system that behaves differently and has its own notice — in short, your footage never leaves your Mac. That includes the application’s opt-in reliability data, which goes to telemetry.throughlinepost.com, is off unless you say yes, and is described in full there rather than here.

The short version

This site sets no cookies, stores nothing in your browser, and loads nothing from a third party — no fonts from Google, no tag manager, no pixel, no embedded video. Every file the page requests comes from this domain. That is asserted by an automated test on every change, not just intended.

Since 2026-10-14 the homepage counts, anonymously, which of its sections get read and uses the totals to put the most-read sections first (§0). The count carries no identifier and cannot tell one visitor from another. Turning on Global Privacy Control or Do Not Track switches it off.

If you never type your email address into the form, we learn nothing about you beyond what any web server unavoidably sees while answering a request.

0 · What the homepage counts

Only on the homepage, a small script from this domain (/measure.js) measures how long each section of the page is on screen while the tab is in front, and sends that when you leave or switch tabs:

What it does not collect: no cookie, no identifier, no fingerprint, no user
agent, and no IP address: the country is derived by our host at the edge and the address itself is never read or stored.

Where it lives: a Cloudflare Durable Object, as daily totals only
(e.g. “14 October, from bsky, US, mobile: 9 visits”). Individual visits are not kept, so there is nothing to look up, export or delete for one person. Totals older than 400 days are deleted.

Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in understanding which
parts of the page are useful, using data that identifies no one. No consent banner is shown because nothing is stored on or read from your device beyond what the page needs to display.

To opt out: turn on Global Privacy Control or Do Not Track in your browser
and the script sends nothing.

Which post led to a purchase. The site’s buy buttons carry the same channel to the checkout as utm_source (the ?ref= tag, else the referring host name, else website) and the page the button was on as utm_campaign. Polar stores those words with the order, so we can see that a trial started from, say, bsky. Nothing else about your visit goes with it.

1 · If you subscribe to the newsletter

The newsletter form on this site (which replaced the pre-launch launch list on 2026-10-07) sends exactly three things:

Your IP address is not stored. The country code is derived from it by our host at the moment of the request and the address itself is discarded — that choice was made specifically so there is no IP address here to justify keeping.

Legal basis: consent (GDPR Art. 6(1)(a)), given by submitting the form.
People who joined the launch list before 2026-10-07 agreed only to a launch email: they get that one email, with an invitation to join the newsletter, and are not added to it unless they say yes.
Retention: until you unsubscribe or ask us to delete it (launch-list entries: until launch plus 12 months).
Recipients: nobody. The list is not sold, rented, shared or used for
anything except a message about Throughline. We do not use a mailing-list provider.
Where it lives: Cloudflare Workers KV.

To be removed, email privacy@throughlinepost.com. One line is enough and you do not have to explain. We will confirm when it is done.

2 · If you buy a subscription

Payment is handled by Polar Software Inc., who act as merchant of record — legally, Polar is the seller, and they collect and process what a sale requires: your name, email address, billing country, the tax status of that country, and your payment details. We never see or store your card number.

Polar is an independent controller for that data and processes it under their own privacy policy. What reaches us is the fact of a purchase, the email address attached to it, and the licence key issued for it — which is what we need to support you and to honour a refund.

Legal basis: performance of a contract (GDPR Art. 6(1)(b)) and our legal
obligation to retain sales records for tax (Art. 6(1)©).
Retention: as long as the subscription is active, plus the seven years US
and EU tax rules require for transaction records.

Trial and purchase emails. When you start a free trial or buy a subscription, Polar passes your email address and the product you chose to Loops (Loops, Inc., USA), which we use, as our processor, to send a short series of emails about getting started: how to activate, a first thing to try, and when the trial ends. Every one of those emails has an unsubscribe link, and unsubscribing stops the rest. Loops receives no footage, no licence key and no payment details, and it is used for nothing but these emails. (The newsletter list in §1 is separate and stays on our own host.) See Loops’ privacy policy. Legal basis: our legitimate interest in helping you use what you signed up for (Art. 6(1)(f)), with an opt-out in every message.

3 · What the web server sees

Like every website, ours is served by a host that logs requests in order to deliver them and to resist attack. Our host is Cloudflare, acting as our processor. Their edge logs contain IP addresses, user-agent strings and the URLs requested; they are retained on Cloudflare’s own schedule and we do not export, aggregate, analyse or build profiles from them.

We have not enabled Cloudflare Web Analytics or any equivalent.

4 · Email

Mail sent to any @throughlinepost.com address is routed by Cloudflare Email Routing to a mailbox we read. Your message, and anything you attach, is held there for as long as the correspondence is useful.

Please do not email us case material, exhibits, deponent names or client footage. If you need to send us a file to reproduce a bug, ask first and we will tell you how to do it without disclosing someone else’s matter.

5 · Your rights

Wherever you live, you may ask us to access, correct, delete or export what we hold about you, and to withdraw consent. Under the GDPR and UK GDPR you additionally have the rights to restriction, objection and portability, and the right to complain to your supervisory authority. Under the CCPA/CPRA: we do not sell or share personal information, and we have not in the preceding twelve months.

Email privacy@throughlinepost.com. We will answer within 30 days and will not charge you for it. We do not require an account to make a request, because there are no accounts.

6 · International transfer

We are in the United States and our host and payment provider operate globally. If you are in the EEA or the UK, submitting the form or making a purchase transfers your data to the US. Cloudflare and Polar each rely on the EU Standard Contractual Clauses for that transfer. Loops, which sends the trial and purchase emails (§2), is also in the US.

7 · Children

Throughline is a professional tool and is not directed at children. We do not knowingly collect anything from anyone under 16.

8 · Changes

If this notice changes materially we will update the date at the top and, where the change affects data we already hold, say so on the page rather than quietly reissuing it.

privacy@throughlinepost.com · Lucrative Pictures LLC · PO Box 123, Flagstaff, AZ 86002, USA