Privacy Policy

Edition of October 7, 2026

Data Controller

The data controller is ThemeForge (themeforge.pro), referred to below as "Operator" / "we". Contact: support@themeforge.pro. This Privacy Policy follows generally accepted international data-protection practices.

1. Introduction

ThemeForge ("we", "our", "us") operates the ThemeForge web service and Code2Flow Importer Webflow Designer Extension. This Privacy Policy explains how we collect, use, and protect your information.

2. Information We Collect

Account Information: When you create a ThemeForge account, we collect your username, email address, and password (stored as a bcrypt hash).

Usage Data: We collect basic usage logs (errors, generation events) to improve the service. Logs do not contain personally identifiable information.

Web analytics data (only with your consent): if you allow analytics cookies, Google Analytics collects pseudonymous information about your visit: pages viewed, referral source, device and browser type, approximate location (country, city) and a random identifier stored in a cookie. Without your consent none of this is collected. See Cookies.

Code2Flow Extension: The Designer Extension processes your HTML and CSS code entirely within the browser. No code data is sent to our servers or any third-party service.

3. How We Use Your Information

• To provide and maintain the ThemeForge service
• To authenticate your access to protected features
• To improve service reliability through error logging
• To analyse site traffic and improve the site — only with your consent to analytics cookies
• To communicate with you about your account if necessary

4. Data Storage and Security

Your data is stored on our server (Ubuntu 24.04, located in Europe). We implement security measures including:

• bcrypt password hashing
• CSRF token protection
• Rate limiting on authentication endpoints
• HTTPS encryption for all communications
• HttpOnly, SameSite=Lax session cookies

5. Third-Party Services

We do not sell or trade your personal information. The service does not use advertising networks or social media tracking pixels.

Web analytics. With your consent we use Google Analytics 4 (processor: Google Ireland Limited; data may be transferred to Google LLC in the USA) to analyse site traffic. The analytics script is not loaded and no analytics cookies are set until you click «Allow» in the consent window. We do not send your account data (name, e-mail) to Google and do not link analytics data to it. Data is retained in Google Analytics for 14 months. Google's privacy policy: policies.google.com/privacy.

DNS and SSL are managed through Cloudflare. Their privacy policy applies to DNS-level data processing.

Cookies

Strictly necessary — always on; the service does not work without them:

• tf_session — keeps you signed in (HttpOnly, SameSite=Lax), until the session ends;
• lang — your interface language, 1 year;
• tf_analytics — your choice in the cookie consent window (allowed/declined), 1 year.

Analytics — only with your consent: _ga and _ga_* (Google Analytics), up to 13 months.

You can change or withdraw your consent at any time — via «Cookie settings» at the bottom of the page or the button below. Withdrawing deletes the analytics cookies.

Cookie settings

6. Code2Flow Extension Data

The Code2Flow Importer Extension:

• Runs entirely within the Webflow Designer environment
• Does not transmit your HTML, CSS, or design data to any external server
• Does not collect usage analytics or telemetry
• Uses only the Webflow Designer API to create elements and styles within your project

7. Data Retention

Account data is retained as long as your account exists. You may request account deletion by contacting us. Project data (theme configurations) is stored on the server and can be deleted through the service interface.

8. Your Rights

You have the right to:

• Access your personal data stored in our system
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your project data via the API

9. Consent to Personal Data Processing

By registering on ThemeForge, you give your free, specific, informed and conscious consent to the Operator to process the following personal data:

9.1. Data processed

• Username, email, display name
• Password (bcrypt hash only — original never stored)
• Last login IP, IP history (up to 20 unique entries)
• Registration and last-activity timestamps
• Payment metadata: transaction ID, amount (card data itself is not transmitted to or stored by the Operator — it is handled by the payment processor)
• Consent history (recurring billing + privacy consent records): timestamp, IP, document version
• Projects and generated themes created by you

9.2. Purposes

• Providing access to ThemeForge service and paid features
• Account authentication and security
• Processing subscription payments (including recurring charges)
• Communication regarding account, subscription, and technical support
• Legal compliance (consent record retention, tax reporting)

9.3. Processing methods

Automated processing on the Operator's secure server (Ubuntu 24.04, Europe). HTTPS encryption, bcrypt password hashing, HttpOnly/SameSite=Lax session cookies. No ad networks or social-media pixels; web analytics (Google Analytics) only with separate cookie consent.

9.4. Retention

• Account data — duration of active account + 3 years after deletion
• Consent history — 3 years from last consent
• Payment history — 5 years (tax-reporting requirements)

9.5. Your rights

You have the right to:

• Confirm that your data is processed by the Operator
• Access your data, request correction, blocking or deletion if incomplete, outdated, inaccurate, or processed in violation of the law
• Withdraw consent at any time (see §9.7)
• File a complaint with the data protection authority of your country

9.6. Third-party processors

The Operator does not sell personal data. Data is shared only with payment processors strictly for payment handling:

• Paddle (international, Merchant of Record): email, transaction ID, amount, billing country. Policy: paddle.com/legal/privacy
• Cloudflare (DNS, SSL, anti-abuse). Policy: cloudflare.com/privacypolicy

9.7. Withdrawing consent

You may withdraw consent at any time by:

1. Requesting account deletion via support@themeforge.pro — account and associated data removed within 30 days (except data legally required to retain — payment history, consent records)
2. Written request to the Operator demanding cessation of processing

Consent withdrawal means you can no longer use service features that require data processing.

9.8. Form of consent

Consent is given when you:

• Register — tick the checkbox "I accept the User Agreement and Privacy Policy" on the registration page
• Pay for subscription — tick the checkbox "I consent to automatic monthly recurring charges per the offer" on the payment page

Each consent event is recorded electronically: timestamp, IP, version of this Policy. Records retained for 3 years.

10. Changes to This Policy

Material changes (affecting data collected, processing purposes, or user rights) will be communicated via the service and by email at least 30 days before taking effect. Minor changes are published with an updated edition date.

11. Contact

For questions about data processing, consent withdrawal, or exercising rights: support@themeforge.pro. Full Operator details at Contacts.