U.S. State Privacy Laws
Effective May 8, 2026
Several U.S. states have enacted privacy laws to grant new privacy rights to their residents. These laws include the California Consumer Privacy Act (as modified by the California Privacy Rights Act) (CCPA), and comprehensive consumer privacy laws enacted in Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Iowa, Indiana, Tennessee, and other states.
The goals and key requirements of these laws are consistent with Thrivania's longstanding commitment to data protection and transparency. This page describes how we comply with these laws and the rights they provide to you.
Your Rights Under U.S. State Privacy Laws
Depending on your state, these laws provide you with rights to:
Access — Request information about the categories and specific pieces of personal information we have collected about you.
Correct — Request that we correct inaccurate personal information we hold about you.
Delete — Request that we delete personal information we have collected from you, subject to certain exceptions.
Opt out of sale/sharing — Opt out if a business “sells” their information, uses or shares it for certain advertising purposes, or profiles them to make decisions with legal or similarly significant effects.
Non-discrimination — Exercise your privacy rights without receiving discriminatory treatment from us.
Data portability — Export your personal data in a machine-readable format.
Appeal — If Thrivania denies a privacy request, you have the right to appeal our decision.
How to Exercise Your Rights
You can exercise your rights in the following ways:
- • Account settings: Access, correct, and delete most of your data through your account settings
- • Data export: Download your data in JSON format from the Account Management section of your settings
- • Account deletion: Delete your account from your settings, which will delete all associated personal data
- • Contact us: For any requests that cannot be completed through your settings, contact our privacy team
We will verify your identity before processing requests. You may also designate an authorized agent to make a request on your behalf.
Our Practices
Thrivania does not sell your personal data.
We do not share your personal information for cross-context behavioral advertising. We do not profile you to make decisions with legal or similarly significant effects.
Commitment Regarding De-identified Data
Under some state laws, “de-identified” information is not considered personal information where a company commits that it will not attempt to re-identify it. Where we process information that we regard as de-identified, we will maintain and use it in de-identified form and will not attempt to re-identify it.
California-Specific Disclosures
For California residents, our Privacy Policy contains detailed information about:
- • The categories of personal information we collect and the purposes for collection
- • The categories of sources from which we collect personal information
- • The business or commercial purpose for collecting personal information
- • The categories of third parties with whom we share personal information
- • Your rights under the CCPA/CPRA including the right to limit use of sensitive personal information
Contact Us
To exercise your privacy rights or ask questions about state privacy laws: