Privacy Policy

Thermal Canary Pro is a one-time-purchase desktop application for Linux. It has no user accounts, no cloud dashboard, and does not sync your hardware data anywhere. This policy explains the small amount of personal data involved in buying and activating a license, and in visiting this website.

1. Who Controls Your Data

The data controller is Sébastien Vérité EI, 1 rue Marguerin, 75014 Paris, France. Contact:. See theLegal Notice for full identification.

2. What This App Does Not Do

• No user accounts, no login, no password to manage.
• No cloud sync of sensor readings, sessions, or hardware health data. Session history and health diagnostics are stored only in local files on your machine.
• No telemetry of any kind. The app does not collect usage analytics.
• No phone-home after activation. Once your license token is issued, the app validates it fully offline. The one exception is an anonymous, disable-able update check - see "Update check" below - which carries no license key, machine identifier, or usage data.

3. Information We Collect

At purchase

When you buy a license, the checkout is entirely handled by Lemon Squeezy (our Merchant of Record). Lemon Squeezy collects your payment details and billing information directly; this data does not pass through our servers. See Lemon Squeezy's own privacy policy for how they handle it.

Lemon Squeezy notifies our license server of a completed sale. We store, in our license database:

• The email address associated with the order.
• A Lemon Squeezy order/customer identifier.
• The generated license key and its status (active, revoked).

We use that email address for exactly one thing: sending you the license key itself, via our transactional email provider (see subprocessors below). We do not add it to a mailing list, and we never send marketing email to it.

At activation

When you activate a license key inside the app, our activation server stores:

• A hash of your machine identifier (derived from /etc/machine-id, or ausername@hostname fallback if unavailable). We never store the raw identifier.
• The hostname of the activated machine, so you can recognise it if you manage multiple devices.
• A hash of the device token issued to your installation, used to tell activations apart.
• Activation and, if applicable, deactivation timestamps.

We enforce one concurrent activation per license key. Activating on a new machine automatically supersedes the previous activation, which then falls into a 30-day offline grace period; no data about your hardware, sensor readings, or app usage is ever transmitted during this process.

Update check

The app periodically checks a static file at thermalcanary.com/version.json to see whether a newer version is available (at startup, and at most once every 24 hours while the app runs, or when you press "Check now" in Settings). This request is anonymous: it does not include your license key, machine identifier, IP-derived identity, or any other identifying data, and our server does not log anything beyond standard web server logs (see below). No response to this request identifies you or your device in any way. You can turn this check off entirely from Settings > Updates > "Check for updates on startup"; a manual "Check now" still works even with it off.

Affiliate links in the app

The in-app hardware health diagnostic may, for some conditions, show a link to a recommended product (for example, replacement thermal paste after a diagnosed dried-paste condition). Where such a link is present, it is an affiliate link: we may earn a commission if you make a purchase through it, at no extra cost to you. Clicking one of these links takes you to a third-party retailer's website, governed by that retailer's own privacy policy; we do not receive any information about your purchase beyond an anonymous confirmation that a sale occurred through the link.

Standard web server logs

Like virtually every website, our hosting infrastructure (OVH) keeps short-lived access logs of incoming requests (IP address, user agent, timestamp, requested URL) for security and abuse prevention. These logs are not used for tracking or profiling and are rotated automatically.

4. Cookies and Tracking

Our cookies

This marketing site currently sets no cookies. There is no login, no shopping cart, and no server-side session used on any public page. If a strictly necessary technical cookie is ever added later (for example, a CSRF token on a future contact form, or a session cookie for a logged-in area), it will be documented in this section, will not carry a tracking identifier, and will not require prior consent under Article 82 of the French Data Protection Act and the ePrivacy Directive, because it would be strictly necessary to deliver a service you explicitly requested.

Analytics and advertising

We do not run any analytics on this site: no Google Analytics, no Matomo, no Plausible, no Fathom, no server-side analytics. We do not run any advertising or retargeting pixels, and no social tracking pixels (no Meta Pixel, no LinkedIn Insight Tag, no X pixel, no TikTok pixel). Nothing on this site profiles you across visits or shares your browsing with a third party.

Third-party scripts

We do not embed the Lemon Squeezy checkout script on our own pages. When you click a "Buy" or "Get Pro" button, you are redirected to lemonsqueezy.com, where Lemon Squeezy sets its own cookies governed by its own privacy and cookie policy. No Lemon Squeezy cookie is set on thermalcanary.com. The same applies to links to our GitHub repository: those are plain outbound links, and GitHub's own cookie policy applies once you follow them.

Managing cookies

Because we do not set optional cookies, there is nothing to opt out of on this site, and no consent banner is required or displayed. You can still inspect, block, or delete cookies for any domain at any time through your browser's privacy settings; Firefox, Chromium, Chrome, and Safari all expose per-site cookie controls under "Privacy and security".

5. Why We Process This Data (Legal Basis)

6. Who We Share Data With (Subprocessors)

• Lemon Squeezy, LLC, United States: payment processing, tax collection and remittance, order/customer records, as Merchant of Record.
• OVH SAS, France: hosting for the website and the license activation API.
• Brevo (Sendinblue SAS), France: sends the single transactional email delivering your license key after purchase. No marketing lists, no tracking pixels.

We do not sell personal data, and we do not share it with anyone beyond the three parties above.

7. How Long We Keep Data

• License and activation records are kept for as long as the license is valid, plus the period required by French commercial and tax law (typically 10 years for accounting records).
• Web server access logs are rotated automatically and not kept long-term.

8. Your Rights

Under the GDPR, you have the right to access, correct, delete, or export the personal data we hold about you, and to object to or restrict certain processing. To exercise any of these rights, contact . You also have the right to lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

9. Changes to This Policy

If this policy changes, the "Last updated" date at the top of this page will change accordingly. Material changes will be reflected on this page before they take effect.