thornberry — Privacy Policy

Provider: Thornberry LLC, a Wyoming limited liability company — a wholly owned subsidiary of Decryptofy Inc., a Delaware corporation
Version: 1.0.0-beta · Effective date: June 17, 2026

This Privacy Policy explains how Thornberry LLC, a Wyoming limited liability company and a wholly owned subsidiary of Decryptofy Inc. (Delaware) (“Company,” “we,” “us”), handles personal information in connection with the thornberry desktop application and the thornberry.ai website (together, the “Service”). Thornberry LLC is the data controller; Decryptofy Inc. is identified for transparency only. thornberry is local-first: the most sensitive data — your Broker credentials, positions, and trades — stays on your own device and is never transmitted to us.

1. Summary (At a Glance)

• We collect a small amount of account, purchase, and support information.
• Diagnostic and analytics Telemetry is opt-in and off by default.
• Your Broker API keys, positions, trades, and Strategy code never leave your device to us.
• We do not sell your personal information and do not share it for cross-context behavioral advertising.

2. Information We Collect

2.1 Account and identity. When you register or purchase, we (and our authentication provider, Clerk) collect your legal name, email address, your U.S.-jurisdiction declaration, your 18+ age affirmation, and versioned, timestamped records of your acceptance of our Terms, this Policy, the Beta Agreement, and the Risk Disclosures.

2.2 Payment. Purchases are processed by Stripe. We do not store full payment-card numbers. Stripe processes your payment data under its own terms and privacy policy. We receive limited transaction metadata (for example, confirmation, amount, date, and partial card details) to manage orders, taxes, and refunds.

2.3 Support communications. If you contact us, we collect the information you provide (such as your email and message contents) and our responses.

2.4 Opt-in Telemetry. If — and only if — you opt in, we collect crash diagnostics via Sentry and product-analytics events via PostHog. This Telemetry is off by default, and you can disable it at any time. These events are limited to technical and usage data such as application version, operating-system type, crash stack traces, and feature-usage events. They never include your Broker API keys, positions, orders, or Strategy code.

2.5 Website and update data. The thornberry.ai site and the update/appcast server may process limited technical data (such as IP address, approximate location, device/browser type, and request metadata) to deliver content and updates and to maintain security.

3. Information We Do NOT Collect

We do not receive or store your Broker API keys, your positions, your orders or trades, or your Strategy code. Broker API keys are stored in your operating-system keychain on your device. The append-only audit log is encrypted locally on your device using SQLCipher. The Company runs no server that stores user credentials or trading data.

4. How We Use Information

We use information to: (a) create and manage your account and license; (b) process purchases, taxes, and refunds; (c) verify eligibility (age and U.S. residency) and record acceptances; (d) provide support; (e) deliver software updates; (f) if you opt in, diagnose crashes and understand product usage to improve the Application; and (g) maintain security, prevent fraud and abuse, and comply with law. We do not use your information for cross-context behavioral advertising.

5. Legal Bases (If/When Non-U.S. Users Are Permitted)

The current Service is U.S.-only. If we ever permit users in the EU/UK, our legal bases under the GDPR/UK-GDPR would be: performance of a contract (account, license, purchases, support); consent (opt-in Telemetry); and legitimate interests (security, fraud prevention, and product improvement, balanced against your rights).

6. Sub-Processors / Service Providers

We share limited personal information with the following providers, only as needed to operate the Service:

7. How We Share Information

We do not sell personal information and do not share it for cross-context behavioral advertising. We share it only: with the service providers above; to comply with law or valid legal process; to protect the rights, safety, and security of users, the public, or the Company; and in connection with a merger, acquisition, financing, or asset sale (with notice as required by law).

8. Retention

We retain account, purchase, and acceptance records for as long as your account is active and as needed to comply with legal, tax, accounting, and dispute-resolution obligations, then delete or de-identify them. Support communications are retained for 24 months. Opt-in Telemetry is retained for 24 months. Website and security logs are retained for 12 months.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. On your device, Broker API keys are stored in the operating-system keychain and the audit log is encrypted with SQLCipher. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

10. Your U.S. State Privacy Rights

10.1 Scope. As of 2026, roughly twenty U.S. states have comprehensive consumer-privacy laws (for example, California’s CCPA/CPRA, plus laws in Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others), and more take effect over time. Your specific rights depend on your state of residence and on whether a given law applies to the Company.

10.2 Rights. Depending on your state, you may have the right to: access/know the personal information we have collected; delete it; correct inaccuracies; obtain a portable copy; opt out of the “sale” or “sharing” of personal information and of certain targeted advertising and profiling; limit the use of sensitive personal information; and be free from discrimination for exercising these rights.

10.3 “Do Not Sell or Share My Personal Information.” We do not sell your personal information or share it for cross-context behavioral advertising. We nonetheless honor opt-out requests. You may submit one by emailing privacy@thornberry.ai. Where required, we honor recognized universal opt-out mechanisms (such as Global Privacy Control).

10.4 How to exercise rights. Submit a request to privacy@thornberry.ai. We will verify your request and respond within the time required by applicable law. You may use an authorized agent where the law permits. If we deny a request, you may have a right to appeal as your state’s law provides; contact privacy@thornberry.ai to appeal.

11. Children

The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18, and not from children under 13 (COPPA). If we learn we have collected such information, we will delete it.

12. International Transfers

The current Service is offered in the United States, and information is processed in the United States. We do not transfer your personal information outside the United States. If this changes, we will update this Policy and adopt an appropriate transfer mechanism.

13. Data-Breach Notification

In the event of a personal-data breach affecting your information, we will investigate and notify affected users and applicable regulators as required by, and within the timeframes set by, applicable law.

14. Changes; Contact

We may update this Policy and will post the new version with an effective date and, where appropriate, provide notice. Questions or requests: privacy@thornberry.ai; Thornberry LLC, c/o Wyoming Registered Agent Services LLC, 32 N Gould St., Sheridan, WY 82801.