Last updated September 27, 2026
Thomsen Shield, Thomsen OSINT, and Thomsen VM are Windows tools built to run locally on your PC, so we know privacy matters more than usual here. This page explains what we collect when you buy or use them, and just as importantly, what we don't. Thomsen VM is free and involves no purchase or account. Thomsen OSINT is not yet released - this policy will be updated first if anything here changes once it ships.
Thomsen Shield is operated by Thomsen ("we", "us"), who is the data controller for the personal data described in this policy. Email support@thomssen.dev for any privacy question or to exercise the rights in section 9.
Thomsen Shield does not send us your network traffic, browsing history, the connections it observes, or the IPs it blocks. All detection and blocking logic runs locally on your machine. Nothing about your day-to-day usage of the app is transmitted anywhere. Thomsen OSINT is likewise built local-first - its lookups and case data stay on your PC, with no cloud account. Thomsen VM doesn't require a purchase, account, or license activation, so there's nothing tied to your identity for it to send us.
Our main site (thomssen.dev) stores your theme and cookie choice in your browser's local storage - strictly necessary, and not used to track you. It does not currently run any analytics or advertising scripts; if that ever changes, it will only happen with your consent. This page itself (api.thomssen.dev) sets no cookies of its own.
In short: to issue and validate your license, process your payment, prevent fraud (e.g. chargebacks, key sharing), keep the service secure, and respond if you contact support. We don't use your data for advertising, and we don't sell it to anyone.
Only the services that make Thomsen Shield work:
Each processes data under their own privacy policy and only as needed to provide their service to us. We don't sell your data or share it for anyone else's advertising.
Some of these providers (for example Stripe and Vercel) are based in, or may process data in, the United States or other countries outside the EU/EEA. Where that happens, they're required to provide appropriate safeguards for the transfer, such as the EU Standard Contractual Clauses or an adequacy decision - see their own privacy policies (linked above where available) for how each handles this.
We keep license and purchase records for as long as your license is active, and afterward for as long as applicable tax and accounting law requires us to keep financial records. Support emails are kept only as long as needed to handle your request, unless we're legally required to keep them longer.
Subject to the conditions in applicable law, you have the right to access, correct, delete, restrict, or object to our use of your data, and to receive certain data in a portable format. Where processing relies on your consent, you can withdraw it anytime. To exercise any of these, email support@thomssen.dev - note that deleting your account data will deactivate your license. You also have the right to lodge a complaint with a data protection supervisory authority in the EU/EEA country where you live or work. You can find the relevant authority through the European Data Protection Board (EDPB).
Data in transit between the app and our server is encrypted (TLS). Your license token is cryptographically signed and stored encrypted on your own device.
Thomsen Shield isn't directed at children under 16, and we don't knowingly collect data from them.
If this policy changes materially, we'll update the date at the top of this page.