Privacy.

Farooq Alaulddin runs Thread and is responsible for your data. Contact: support@thinkly.dev.

We do not sell your data. We do not use it to train models. We do not show ads.

What we keep and why

• Account: your email, username and display name. Your sign-in id from GitHub or Google, and when you last signed in. Your plan and the storage you use. We need these to provide Thread (contract).
• Your work: your files, their history, proposals waiting for your review, and the AIs you have signed in. We need these to provide Thread (contract).
• Server logs: IP address, browser or client, and the requests made. We keep them to run Thread and keep it secure (legitimate interest).
• Security log: sign-ins and account actions, with IP address and client. We keep it to find and investigate misuse (legitimate interest).
• Change records: for each file change, the workspace name, the path, a fingerprint of the content, which account and which AI made it, when, and whether it was allowed. Not the content itself. They let you and us prove nothing was altered (legitimate interest).

Signing in with Google asks only for your name, email and profile. Thread does not ask for your Drive or your contacts.

Cookies

Thread sets cookies to keep you signed in and to send you to the right server. It sets no others. There are no analytics or advertising cookies.

Apps you install

You can install an app in a workspace. Thread then sends that app the changes to the files the app covers, including their contents. The app is run by its maker, who handles that data under their own terms. Uninstalling stops it. What the app already received stays with its maker.

Who else handles it

• Oracle Cloud runs our servers.
• Cloudflare carries traffic, stores your files, and forwards support email.
• Hetzner holds our backups.
• GitHub or Google confirms who you are, if you sign in with them.
• Our pages load fonts from Google.

These may be outside your country.

How long

• Account and work: until you delete them.
• A deleted workspace: you can restore it for 30 days. Then it is removed.
• Server logs: up to 30 days.
• Security log: 365 days.
• Change records: with no end date, also after a workspace or account is deleted. A record that could be removed would prove nothing.
• Backups: taken daily and kept for about 30 days. A few snapshots taken before maintenance are kept longer.

To close your account, write to support from the address you sign in with. We delete your workspaces, your files and your account. Change records and the security log stay for the times above. The sign-in service’s record of your email and sign-in id is not removed automatically yet; we remove it when you ask.

Your rights

Ask us to see, correct, export or delete your data, or object to how we use it. We answer within a month. You can also complain to your data protection authority.