# Privacy Policy

Version: 2026-10-17-r10

Last updated: October 19, 2026

## 1. Who is responsible

ThreadPage is operated by **Nazarii Olehovych Leus, an individual entrepreneur registered in Ukraine**, trading as **ThreadPage**.

**Ukrainian taxpayer identification number (RNOKPP):** 3591414557  
**Registered business address:** 32 Shkilna Street, Apartment 7, Bershad, Haisynskyi District, Vinnytsia Region, 24400, Ukraine.  
**Privacy contact:** [support@thread.page](mailto:support@thread.page). The operator is also our person in charge of the protection of personal information and our privacy officer.

This policy covers our website, web application and associated services. It explains our processing; it is not a request for blanket consent.

We are the controller of personal data that we process for our own purposes, such as account administration and sign-in, security and abuse prevention, support and reports, billing records, optional product analytics, invitations, Community, and the operation of shared places, including what participants see about each other.

For the content of your Folders, Threads and Notes, our role depends on how you use ThreadPage. If you use it for purely personal or household purposes, for example with your family, we process that content as controller, only to provide what you ask for, such as storing, syncing, sharing, recovering and securing it, to handle reports about it and to meet our legal obligations. If you use ThreadPage for your work or business, you, or the organisation you act for, are the controller of other people’s personal data in your content, and we process it as your processor. The paragraph “Business use” in the section “Your content and connected assistants” of our [Terms of Service](/terms#your-content-and-connected-assistants) sets out our commitments as your processor; where data-protection law requires a separate written agreement, we sign one with you on our standard terms on request. If you use ThreadPage for your work or business under an earlier version of our Terms of Service, we give you the same commitments as your processor from the date this policy was published; the limits of liability of the version you accepted continue to apply to them.

What participants add to a place is part of the owner's content. The owner decides who has access and why. Sharing a place does not make us a joint controller of that content.

Paddle and external services you choose have separate responsibilities for their own processing.

## 2. Local content and cloud content

**Local workspace:** Notes, images, Drafts and related data created in local-only mode are stored in your browser. We do not receive their content simply because you write locally. Browser storage can be cleared or lost and is not a separate backup.

**Cloud features:** When you use an enabled cloud feature and complete the applicable account and source-confirmation process, we receive the content and metadata needed to deliver it. This can include Folders, Threads, Notes, images, references, revisions and owner-private Draft or Recovery data covered by that feature. Eligible Pro activation can start Sync automatically for established same-owner content unless you have chosen Sync Off.

**Separate actions:** Signing in is not permission to claim someone else’s browser content. Turning Sync off does not erase server copies. Signing out may keep that account’s local data for a later sign-in. Account erasure does not delete an export or guarantee immediate deletion on an offline device.

Even with local-only Notes, our website and infrastructure process information necessary to deliver network requests, including an IP address. Local-only content does not mean that no personal data are processed.

## 3. Information we process

| Category | Information and source |
|---|---|
| Account and sign-in | Email, account ID, optional display name, password hash for password login, one-time sign-in codes sent by email, and verification and session records. Information comes from you, an optional sign-in provider or our account systems. |
| Emails | The language for your emails, which emails about your account and plan we sent and when, whether delivery failed, and your product-news choice with the wording you saw and when and where you made it. |
| Content transferred to us | Uploaded content, Folder and Thread metadata, references, timestamps, revisions and authorised recovery copies, supplied by you, enabled devices or a client you authorise. |
| Connections | Client identity, permissions, content scope, connection status, protected authorisation records, operation outcomes and change history, and each connection's recent activity: a content-free record of what it read and changed; for webhooks, endpoints and Requests you set up, their destinations, protected secrets, delivery attempts and outcomes and, for a short time, copies of the content being delivered. |
| Shared places | For a place you share: the people you added, their email addresses and levels, how and when they joined, whether they left or were removed, and the link settings. For a place shared with you: your name and email address, which its owner sees; your name, shown to the people of the place and next to what you add or edit; and when you last opened each Thread, so we can mark what is new for you. Invitation addresses come from the owner who adds them. |
| Sharing security records | Actions such as a link turned on, a person added or removed, or a refused write: identifiers, times, outcomes and, for abuse limits, a keyed digest of the IP address. They contain no place names, note text, email addresses or link secrets. |
| Community | If you post, comment, vote or follow posts in Community: your public name, which is the name on your account; your posts and comments, when you wrote and edited them, the earlier versions of what you edited, which only the team can see, and the language of the interface you used; your votes and the posts you follow; your **Community updates** choice; and our moderation records about your content or account, such as what we removed, the rule and the reason, and whether your account can post. To apply rate limits in Community, keyed digests of the account and network address that send requests to it. |
| Agreements and notices | The document versions and acceptance wording presented, your affirmative action, relevant account or browser reference, server timestamps, and records of sending a contractual notice or confirming a request. Opening a page is not recorded as proof that you read or agreed to it. |
| Billing | Subscription status, billing periods, checkout and transaction identifiers, and information needed for support, reconciliation and legal records, supplied by you or Paddle. |
| Withdrawal from a purchase | When you use **Withdraw from contract here**, the name and the confirmation email address you enter, the contract you withdraw from, the amount paid, when we received your statement and a keyed digest of the IP address it came from. |
| Plan, trial and storage administration | Plan and trial status and dates, storage usage and reservations, the applicable allowance, minimal operation identifiers and outcomes, confirmed subscription changes and, where applicable, the date a cloud copy became read-only and any notice we sent. These records are generated by the service and payment integration and do not include Note text, image content or assistant prompts. |
| Technical and security | IP address, request time, browser or device information, status codes and relevant diagnostic or security records. |
| Support and reports | Messages; reports about content, with the reason, the explanation, where the content is and, if given, the reporter's name and email address; copyright notices and counter-notices, including the names and contact details in them; contact details and attachments you choose to send. |
| Optional analytics | Pseudonymous browser and visit identifiers and limited usage or performance events collected after permission, as explained below. |

A sign-in provider supplies the identity information allowed by its sign-in process. Signing in does not authorise us to read your email, contacts or cloud documents.

Paddle and its payment providers handle payment details entered at checkout. Our application’s payment integration does not receive or store full card numbers or card security codes. Do not send those details, passwords or unrelated sensitive documents to support.

To decide whether a Pro trial is available, we check whether another account with the same email address, compared as described in section 7 of our [Terms of Service](/terms), has already had a trial or a paid subscription. For this we keep and compare keyed fingerprints of the address, calculated with a secret key, rather than the address itself, and we check only after you have confirmed that you control the address. We do this on the basis of our legitimate interest in offering the free trial once per email address (section 4); you can object as described in section 11.

## 4. Purposes and legal bases

Where data-protection law requires a legal basis, we use these bases for processing we control:

| Purpose | Legal basis |
|---|---|
| Create an account, provide requested features and answer service questions | Contract performance or steps you request before a contract; legitimate interests for administering an organisation’s account through its representatives. |
| Store and deliver requested content and execute permitted operations | Contract performance; where we act as processor, the customer’s documented instructions under the applicable processing agreement. |
| Prevent abuse, enforce access and investigate failures | Legitimate interests in a secure, reliable service, balanced against your rights; a legal obligation where applicable. |
| Reconcile subscriptions, handle disputes and keep required records | Contract administration, relevant legal obligations and legitimate interests in resolving claims. |
| Administer your plan, trial and storage limits, avoid duplicate operations and payments, and resolve billing or usage enquiries | Contract performance where necessary to provide a service you request; legitimate interests in proportionate security and abuse prevention; legal obligations for required financial records. |
| Record and confirm a withdrawal from a purchase and refund it | Legal obligations under consumer withdrawal rules; legitimate interests in being able to prove what we received and when, if it is disputed. |
| Record agreements, demonstrate your privacy choices and deliver contractual notices | Contract administration, applicable accountability obligations and legitimate interests in documenting agreements and resolving disputes. Optional analytics themselves remain consent-based. |
| Send emails about your account and plan: sign-in codes, a welcome when you create an account, plan confirmations, renewal reminders, notices when Pro is cancelled or ends, and legal notices | Contract performance; legal obligations for notices the law requires, such as renewal reminders; legitimate interests for the single welcome email after you create an account. |
| Optional product news by email | Consent, which you can withdraw at any time with the unsubscribe link in every news email or in **Account → Email**. Withdrawing does not affect emails about your account and plan. |
| Provide shared places: show a place to the people its owner chose, show authors' names and limit abuse | Contract performance for the owner and for participants who signed in; legitimate interests for reading through a link. |
| Send one invitation to a person by email, and honour a decline or a request to stop all invitations | Legitimate interests, ours, the inviting owner's and the invited person's, in delivering the access the owner asked for with one neutral email. You can object at any time with Decline or by writing to us. |
| Provide Community: publish your posts and comments under your public name, count your votes, keep your follows and send you Community updates | Contract performance. |
| Keep a post's title, votes, comments and our answer in Community after its author deletes it, and keep posts and comments in Community after their author closes the account, shown as **Former member** | Legitimate interests, ours and those of the people who took part, in keeping discussions complete and understandable. You can delete your content, choose deletion when you close your account, or object as section 11 explains. |
| Moderate Community: remove posts and comments that are illegal or break the rules in our Terms of Service, stop accounts from posting, tell the authors why and keep records of our decisions | Legal obligations under rules on illegal content, such as the EU Digital Services Act and the UK Online Safety Act; legitimate interests in keeping Community on topic, lawful and safe and in establishing or defending claims. |
| Review reports and notices about content, decide on them, tell the people concerned and report crimes where the law requires it | Legal obligations under rules on illegal content, such as the EU Digital Services Act and the UK Online Safety Act; legitimate interests in keeping the service lawful and safe and in establishing or defending claims. |
| Optional product analytics | Consent, which you may withdraw. |
| Respond to legal or data-protection requests | Applicable legal obligations and, where relevant, legitimate interests in establishing or defending claims. |

A record of accepting Terms is not consent to all personal-data processing. A record that a Privacy Policy was made available is a transparency record, not a statement that you agreed to optional processing. A cryptographic content fingerprint helps establish which text was used; it does not by itself identify a person or prove that the text was read.

We may be unable to supply a feature without the account, security or billing information it reasonably requires. Optional analytics are not required for using local Notes, creating an account or subscribing.

Plan, trial and storage records are separate from optional product analytics. Refusing or withdrawing optional analytics does not disable the minimum records needed to deliver your plan and protect the service. We do not use these records to introduce an undisclosed request charge for Pro.

We do not sell personal information, share it for cross-context behavioural advertising, or use Note content, including content in shared places, for targeted advertising or to train our own general-purpose AI models. An external AI provider you authorise has its own terms and settings for the information it receives.

## 5. Browser storage and analytics

Cookies and browser storage support sign-in, request security, local content, offline operation, language and interface preferences, and your privacy choice. Blocking or clearing necessary storage can sign you out, reset settings or remove local work.

Optional product analytics use **PostHog’s EU service** and remain off until you allow them in **Privacy preferences**. Refusal or withdrawal does not remove application features.

When permitted, analytics record broad page categories, selected actions, application readiness, the outcome and timing of a Note-creation operation, selected layouts, broad search-result counts and performance measurements. The event payload excludes Note text, images, Folder or Thread names, search terms, email addresses and account identifiers. We do not use session replay or automatic recording of editor contents.

A random browser identifier is pseudonymous, not necessarily anonymous. Network providers can process the IP address of an incoming request even though the application omits it from analytics event properties and disables IP-based enrichment.

Withdrawing permission stops future optional collection and clears analytics identifiers in that browser. It does not automatically erase previously received events. Contact us to request deletion; locating a pseudonymous record may require limited additional information. Use **Privacy preferences**, rather than clearing all site data, when you only intend to disable analytics.

The permission request identifies the optional purpose and the relevant notice. We may ask again when a proposed change is outside the permission you gave. A formatting change to the Privacy Policy does not by itself reset your choice, and refusing optional analytics does not prevent you from accepting the Terms.

A shared place opened through its link without signing in sends no analytics. In that view, the notes that are new to you are remembered only in that browser tab and are forgotten when you close it.

In Community, a post or comment you have not sent yet is kept only in that browser tab, until you send it, empty it or sign out, or the tab is closed. If you vote before signing in, that tab remembers the vote for up to 30 minutes so that it can be added after you sign in.

Necessary service and payment processing is separate from the analytics switch. Paddle explains the technologies of its checkout and of the card-update form on our billing page in its own privacy notice.

ThreadPage does not change how it works in response to a browser’s “Do Not Track” signal, because optional analytics stay off unless you allow them in **Privacy preferences**. Apart from Paddle’s checkout and its card-update form on our billing page, which Paddle’s privacy notice describes, we do not let other companies collect information about your activity over time and across other websites through ThreadPage.

The emails we send ourselves contain no tracking pixels, and their links are not rewritten to track clicks, so we do not record whether you opened an email or which link you followed. Product news comes about once a month at most and only if you turn it on.

## 6. Providers and disclosures

Depending on the feature used, these providers receive information:

| Provider | Operational purpose |
|---|---|
| Cloudflare, including R2 | Network delivery and security; private storage of images and support screenshots; encrypted backups and our records of deletions. |
| Render | Application, backend and background-process hosting. |
| Supabase | Managed database services for account and cloud data. |
| PowerSync | Delivery of authorised account changes to application devices. |
| Resend | Emails about your account and plan, including verification, sign-in codes, password recovery, sharing invitations, Community updates and our emails about reports, and product news if you turn it on. |
| Google Workspace | Support and business correspondence. |
| PostHog | Optional product analytics. |
| Paddle | Payment, subscription, reseller and billing-support activities; when a renewal payment fails, payment-recovery emails in our name from support@thread.page and the card-update form on our billing page. |

Providers receive information relevant to their functions under applicable service arrangements. Paddle is a separate controller for its payment and reseller activities, described in its [Privacy Notice](https://www.paddle.com/legal/privacy). We do not send Note content to Paddle to process a subscription.

When you share a place, its content and the names of the people who added or edited its notes are disclosed to the people you share it with, to anyone with its link while link access is on, and to your connections that can access it. The section “Shared places” explains what participants see about each other.

What you post in Community is public. Your posts and comments, with your public name and when you wrote and edited them, are disclosed to everyone who opens Community, to the people who follow a post, through our emails, and to search engines. We do not disclose your email address, your votes or the posts you follow. The section “Community” explains what is public and what is not.

When we act on a report, we tell the owner and, where it is their content, the author what was reported and what we did, without the reporter's name or contact details unless the reporter agreed. A copyright notice is an exception: we send it, including the sender's name and contact details, to the person who added the material, and we send a counter-notice to the person who sent the notice. Where the law requires it, we report suspected crimes and child sexual exploitation and abuse material to the competent authorities.

Necessary disclosures may also be made to advisers subject to confidentiality duties, or authorities where legally required. A genuine business transfer may involve information under applicable privacy protections and notice requirements; it does not authorise unrelated use of private Notes. If ThreadPage moves to a new operator, we tell you in advance as the section “Operator and scope” of our [Terms of Service](/terms#operator-and-scope) describes, and the new operator must keep the protections of this policy.

## 7. External assistants and MCP

Connecting a client lets it receive account content and metadata within your approved permissions. Depending on its permissions, it can submit changes and access supported images or versions belonging to authorised Notes. A connection does not expose excluded content, unpublished Drafts or private Recovery material.

Review whether access covers the Workspace, selected Folders or Threads, and future content. Changing or revoking access in **Connections** affects subsequent requests, not copies already retained by the external provider.

Each connection's details show its recent activity: what its token or assistant read and changed (the action, the Thread, Note or folder it touched, how many times, first and last time) and your own changes to that connection. This record contains no Note text, search text, URLs, IP address or browser details; we keep it so that you can review what a connection does with your workspace, including after you disconnect it.

In a place you share, your connections that can access it also receive what participants add and, within their permissions, can change it. Participants' notes are marked as theirs. A participant's own connections cannot access a place shared with them.

That provider may process data abroad and apply its own retention and AI-training rules. Review its privacy notice and settings before connecting. Changing a ThreadPage setting cannot guarantee deletion of its independent copy. Connecting an assistant is optional.

Webhooks, endpoints and Requests you set up send content to, or accept content from, the services you choose; those services process it under their own terms.

## 8. International processing

Our operator is registered in and works from Ukraine, and our application and database are hosted in Frankfurt, Germany. Our providers process information in the places the table shows. Paddle processes payment information in the countries its Privacy Notice lists. Ukraine has no adequacy decision of the European Commission, the UK government or the Swiss Federal Council; access from Ukraine is limited to what operating, supporting and securing the service requires. An EU-hosted component does not establish that all support, access or onward processing is EU-only.

| Provider | Where it processes information | Safeguard for transfers |
|---|---|---|
| Render | Frankfurt, Germany | Hosting in the EEA; EU–US Data Privacy Framework for access from the United States |
| Supabase | Frankfurt, Germany | Hosting in the EEA; the provider's data processing agreement with standard contractual clauses for onward transfers |
| Cloudflare, including R2 | Network requests through its worldwide network; images and support screenshots in a location it selects, normally in Eastern Europe; backups and our records of deletions in the European Union | EU–US Data Privacy Framework and standard contractual clauses |
| PowerSync | European Union | Hosting in the EEA; the provider's data processing agreement with standard contractual clauses for onward transfers |
| Resend | Emails are sent from Ireland; Resend keeps email metadata, logs and our account records in the United States | EU–US Data Privacy Framework and standard contractual clauses |
| Google Workspace | United States and other countries where Google operates | EU–US Data Privacy Framework |
| PostHog | Frankfurt, Germany | Hosting in the EEA |

Where data-protection law restricts a transfer to one of our providers, we rely on an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified, or on the standard contractual clauses in the provider’s data processing agreement. For personal data in content you process for your work or business, which we access from Ukraine, we sign standard contractual clauses with you on request, as the paragraph “Business use” of our [Terms of Service](/terms#your-content-and-connected-assistants) explains. We do not treat agreement to these Terms or use of cloud storage as a general waiver of transfer protections. Contact us for the safeguards relevant to your data and information about obtaining a copy, with appropriate redaction. Courts, police and security authorities in the countries named in this section may be able to access information held there under their laws.

An external provider you connect is separately responsible for its own processing and transfers.

## 9. Retention and deletion

We keep personal data for a defined purpose, not simply because storage is available. The following schedule governs information under our control. A shorter deletion right is respected where applicable. A longer exception must be supported by a specific legal obligation, a documented claim or a necessary security investigation; it is limited to the relevant records and reviewed.

| Information | Retention rule |
|---|---|
| Local Notes and exports | Controlled by your browser, device and your own copies. We cannot remotely guarantee their availability or deletion. |
| Account content and account settings | Kept to provide your requested account functions until valid deletion or account closure, subject to the separate history and recovery rules. Cancelling a subscription is not itself an instruction to delete content. |
| Plan, trial and storage administration records | While the account exists, because trial eligibility and the account's plan history depend on them. After account closure, only what is needed as agreement, payment or accounting evidence remains, under those rules, apart from the trial fingerprint in the next row. |
| Trial fingerprint (the keyed fingerprint of an email address described in section 3) | Kept while an account that had a trial or a paid subscription exists. When an account that had a trial is closed, its fingerprint is kept for 12 months after closure, stored separately with only its deletion date, without the email address or any identifier of the closed account, only to prevent another free trial for that address. It is then deleted. |
| Superseded server Note versions | Ordinary recovery retention of up to 90 days after supersession. A valid erasure or permanent-content-deletion instruction can require earlier removal. |
| External-operation conflict Recovery | Ordinary retention of up to 30 days after creation. This does not set a new automatic expiry for a person's active Draft or other human Recovery copy. |
| Unreferenced image originals | Eligible for cleanup after 30 continuous days without a retained reference. An image still used by another Note or valid retained version remains necessary for that use. Erasure requests are handled separately. |
| Terms acceptance, contractual-notice and request-resolution evidence | While the arrangement or request is active and, normally, for three years after it ends or is finally resolved. Records are limited to relevant versions, dates, identifiers and actions and, for a withdrawal, the name and email address given in it and a keyed digest of the IP address it came from; they never include Note content or reusable credentials. |
| Optional-consent evidence | While we rely on that consent and, normally, for three years after withdrawal or the end of the relevant processing, solely to demonstrate and respect the choice or resolve a claim. |
| Product news delivery records (which issue was sent to which account and when) | Up to 24 months after sending, and deleted when you close your account. Your product-news choice and its history follow the optional-consent evidence rule above; after account closure that history keeps no email address. |
| Records of the emails we sent about your account and plan (which email, when, and a fingerprint of its text) | As contractual-notice evidence, under the “Terms acceptance, contractual-notice and request-resolution evidence” row above. |
| Raw optional product-analytics events | Up to 13 months from collection, subject to an applicable earlier erasure request. Genuinely anonymous statistics may remain without a link back to you. |
| Connection recent activity (the content-free record shown in a connection's details) | Each record, including your changes to the connection, is deleted 90 days after its latest activity, also after you disconnect the connection. At most 1,000 of a connection's own records are kept; your changes are not counted in that limit. Erased with the connection when your account is closed. |
| Webhook, endpoint and Request records | Copies of content waiting for delivery: up to 10 days after the event. Content-free events, delivery attempts and finished Requests: 90 days. Outcomes of events received through an endpoint: 30 days. |
| Invitation by email (the address, the level and who invited) | Until the person opens it, and at most 30 days after we send it. When the person opens it and signs in, it becomes the access record below. |
| Shared place access records (people, levels and link settings) | While the place is shared. A removed person's record is kept while the place stays shared, so that the removal keeps working. These records are deleted within 30 days after sharing stops or the place is erased. |
| Declined and stopped invitations | If a person declines invitations to a place, we keep a coded form of the address (a keyed digest, not the address itself), bound to that place, while the place exists, so that we send no further invitations for it. If you ask us to stop all invitations to your address, we keep a coded form of it for that purpose until you ask us to remove it. |
| What you last opened in a shared place (for marking what is new) | While you have access to the place. |
| Content participants add to a shared place | Part of the owner's account content and follows the rules for it above, including history. |
| Sharing security records | Up to 30 days. |
| Community posts and comments, with the earlier versions of what you edited | While they are in Community; earlier versions are deleted with the post or comment or when you remove your details from a post. A comment you delete is deleted. A post you delete is deleted or, if others took part, your name and the details you wrote are deleted and its title stays with the discussion. After you close your account, they stay and show **Former member**, unless you chose to delete them. |
| Community posts and comments we removed | Kept hidden, with the rule and the reason, for up to three years after the removal, so that a challenge can be reviewed and the decision explained, also if their author closes the account or asks us to delete them; longer only where a legal obligation requires it, as in the row on reports to law enforcement. After that, only the rule and the dates of the removal remain. A Community ban is kept while it lasts and for three years after it ends, whether it is lifted or the account is closed. |
| Community votes, follows and update emails | Records of the Community updates we emailed you: 90 days after sending, or until you close your account. Votes while your account exists; after you close it, only the vote count remains, without any link to you. Follows, and your choice to stop updates about a post, until you close your account; a follow without that choice also ends when you take back your vote on a post you did not write or comment on. |
| Keyed digests used for Community rate limits | Deleted within about an hour after the limit period ends; no limit period is longer than one day. |
| Routine application access and diagnostic logs | Up to 30 days. Relevant extracts needed for a specific security investigation may be retained up to 180 days from preservation, or longer only under a documented legal or claim-related hold. |
| Reports and notices about content, our decisions, reviews and related correspondence, including copyright notices and counter-notices | Three years after we receive the report or notice, unless a longer legal obligation or a claim requires more. |
| Content and records we must keep for a report to law enforcement | For the period the law requires, for example one year for content reported to the UK National Crime Agency and five years for the report reference. Access is limited to that purpose. |
| Routine support correspondence | Up to 24 months after the enquiry closes. Contractual disputes and rights-request outcomes follow their applicable evidence schedule; unnecessary attachments are removed earlier. |
| Payment, accounting and tax records | For the legally required period, calculated from the relevant filing or statutory event, including legally required extensions. Ordinary product-log deletion rules do not erase required accounting records. Paddle controls its own records. |

An account or content erasure request is handled without undue delay. For information we must erase, our operational target is removal from active systems within 30 days of the request, after only proportionate verification where needed, unless a lawful reason requires a different response. This target does not extend a shorter legal deadline. We tell you what has been completed and explain a lawful exception rather than claiming that every copy disappeared immediately.

Restricted backups are replaced or expire within 90 days after deletion from active systems, unless a specific legal hold applies. They are not available for ordinary account use. A restore must reapply deletion instructions before affected data become available again. This backup cycle does not justify retaining a separate live copy.

If we remove an over-limit cloud copy under our [Terms of Service](/terms), its restricted backup copies are placed beyond ordinary use and removed within the same backup cycle; a backup is not an available recovery feature. Temporary archives generated for a backup download are removed within a short period after generation; removing an archive does not remove the underlying content.

Trashing content can leave recoverable versions. A valid permanent-deletion or erasure instruction covers the relevant content, history and recovery in our systems, and our providers' copies within the deletion cycles of their agreements, subject to rights of other persons and lawful exceptions. An image used in several Notes remains only while another authorised, non-erased use requires it.

Closing an account can leave a limited, pseudonymous agreement or payment record for the purposes above. Pseudonymous does not necessarily mean anonymous: any remaining linkage remains protected. We remove unnecessary account and session links and never keep private Notes just to prove that Terms were accepted.

Closing an account that had a trial also leaves its trial fingerprint for the 12 months stated above. It is stored separately from the closed account's other records and does not contain your email address, which cannot be read back from it. We do not use it to identify the closed account; we use it only to decide whether an account can have a free trial.

A minimal content-free deletion record can remain while needed to prevent an old device or operation from recreating erased data. Retaining such an identifier does not permit us to retain the deleted text or image. We cannot recall copies held by an independent assistant provider or guarantee immediate erasure on an offline device. Contact [support@thread.page](mailto:support@thread.page) for a request concerning your data or an explanation of a specific retention exception.

## 10. Security

Measures include encrypted network connections, encrypted backups, authentication and access restrictions. Only we, people we authorise for a specific and limited task, and our providers’ staff to the extent their data processing agreements allow, can access production systems. We do not look at the content of your Notes except to answer your own request, to handle a report about that content, to investigate a security incident or to meet a legal obligation. Automated operations, such as backups, restore checks and migrations, process content without anyone reading it.

ThreadPage is not presented as an end-to-end encrypted or zero-knowledge service. Cloud functions may require our systems and authorised providers to process readable content. No system can guarantee absolute security. Protect your devices, review connection permissions and keep independent backups appropriate to your needs.

## 11. Your rights

Depending on the applicable law, you may request access, correction, erasure, restriction or portability of personal data and withdraw consent. Withdrawal does not invalidate earlier lawful processing.

**Right to object:** You may object to processing based on legitimate interests for reasons relating to your circumstances. You may object to direct marketing at any time: unsubscribing from product news takes effect immediately.

Send requests to **[support@thread.page](mailto:support@thread.page)**. We may reasonably verify identity to protect your information. Where GDPR deadlines apply, we respond within one month unless a permitted extension is necessary; we will explain an extension within the initial period. Section 14 gives other deadlines that apply in some places. No self-service button is required to make a request.

You may complain to a competent data-protection authority, including an applicable EEA authority, the UK Information Commissioner, the Ukrainian Parliament Commissioner for Human Rights or an authority named in section 14. Contacting us first is optional.

Where we act as a customer’s processor, we may refer the request to that customer and assist it; a request to erase what you added to a place someone else owns follows section 13, and a request to erase your posts and comments in Community follows section 15. Paddle and independent providers handle requests about data they control.

We do not use your Note content for solely automated decisions producing legal or similarly significant effects about you. Automated security and access checks may occur. External providers explain their own systems separately.

## 12. Children and changes

ThreadPage is intended for adults and is not directed to children under 18. If we learn that someone under 18 has an account, we close it and delete their account, their content, including what they added to places other people own, and their posts and comments in Community with our moderation records about them, except records the law requires us to keep; messages they sent to support and reports they made are kept only for the periods in section 9; where other people took part in one of their posts, only its title stays, without their name. We do not knowingly collect personal information from children under 13. Contact us if you think a child has given us personal information. We do not claim to verify every visitor’s age. Joining a shared place also needs an account and the age of 18. Reading a shared place through a link needs no account, and we do not check readers' age. Anyone can read Community without an account, and we do not check readers' age; posting, commenting and voting in Community need an account and the age of 18.

We identify published versions and their dates and keep a public [version history](/legal/updates). Updates to this notice describe our processing; they do not themselves give us a new legal basis.

We will explain a material change in an appropriate notice before starting the changed processing where required. If a new purpose or other change requires consent beyond your existing permission, the affected optional processing will not start until that permission is obtained. A new processor used within an existing purpose does not automatically require consent, but still requires the necessary contractual, security, transfer and transparency measures. Refusing or withdrawing optional consent does not prevent you from reading your Notes or exercising your privacy rights.

Editorial corrections that do not change processing do not require a new permission. An acknowledgement that a notice was shown or an email was delivered is not treated as proof that you read it or consented to it.

## 13. Shared places

**What others see about you:** When you join a place, its owner sees your name and email address, and the people of the place see your name in its list of people, whatever your level. Everyone with access sees your name next to the notes you add or edit, including anyone with the link while link access is on. The owner's connected tools, such as an assistant the owner connects, can read what you add; they are the owner's tools, not ours, and the owner is responsible for how they are used. Before you join a place or first open it from an invitation, we tell you this. Inside the place you can see whether link access is on.

**What participants never see:** Participants never see the owner's Drafts, Recovery material, Trash, other Threads and Folders, image library and the history of a note from before it became available to them.

**Invitations:** When an owner adds you by email, the owner gives us your address. We use it only to send you one invitation naming the owner, the place and your level, and to let you open the place when you sign in with that address. The invitation tells you who we are, why you received it, how long we keep it and how to decline. It contains no message from the owner and no promotion, and we send no reminder. If you do not open it within 30 days it expires and we delete it. Decline stops further invitations to that place; write to [support@thread.page](mailto:support@thread.page) to stop all invitations from ThreadPage to your address.

**Images:** Images that participants add are stored without location and camera details. Participants and readers receive every image in a place without those details. The owner's original files stay unchanged and only the owner can open them.

**Reading through a link:** The owner does not see who read a place through its link. Reading is not anonymous: our routine logs and abuse limits process your IP address as described in sections 3 and 9. The page asks search engines not to index it.

**Unsent text:** If you write in a shared place and your access ends before the text is saved, the text stays only in that browser. It is not published or synced.

**Leaving and closing your account:** Leaving a place, being removed or closing your account does not remove what you added, because it is part of a shared work in the owner's place. While your account exists, your contributions show the name currently on your account: we do not store a copy of it with them, so when you change your name in Account, every place shows the new one. After you close your account, they stay and show as added by a former participant: we do not keep your name with them. This does not make them anonymous: the text itself can still identify you. The rest of your account's data is handled as section 9 describes.

**Erasing your contributions:** You can ask us to erase what you added to a place someone else owns, whether or not your account is still open: write to [support@thread.page](mailto:support@thread.page), name the place and, if you can, the notes. If your account is open, we verify through your signed-in account that you are the author; if it is closed, we ask you to confirm the address you used and, if that is not enough, other proof that you wrote them, so it is easier to ask before you close your account. We reply within 30 days. Notes that only you wrote, and images you added, we erase from the place, its history and Recovery material, and from backups within the cycle in section 9. Where your text is mixed with other people's work, for example a note others edited or answered in a way that depends on it, we remove what we can separate; what we cannot separate stays only where another person's rights or a legal obligation require it, and we tell you which parts and why. We tell the owner what changed in their place, not why you asked. We do not remove your name from the contributions of an account that still exists, because the name shown is always your current account name: you can change it in Account, or close your account so that your contributions show as added by a former participant. Copies people already made, such as exports or copied text, are outside our control.

**Reports:** When you report a place or a note, we use what you send to review the report and to tell you our decision. We tell the owner and the author what was reported and what we did, without your name or contact details unless you agreed, except for a copyright notice, which we forward with your name and contact details as the [Copyright complaints](/help/copyright) page explains.

## 14. Information for some regions

We apply this policy to everyone, wherever they live. This section adds details that the law of some places expects. Where it differs from another section, the statement that protects you more applies.

**United States.** We do not sell personal information and we do not share it for cross-context behavioural advertising, as US state privacy laws define those terms. We use the content of your Notes only to provide the features you use, to handle reports about it and to meet our legal obligations. If you live in a US state whose law gives you rights to access, correct, delete or receive a copy of your personal information, write to [support@thread.page](mailto:support@thread.page). If we decline your request, you can appeal by replying with “Appeal”; we answer in writing within 60 days and explain our decision. We do not treat you worse for using these rights.

**Canada and Québec.** We follow Canada’s Personal Information Protection and Electronic Documents Act and, for people in Québec, the Act respecting the protection of personal information in the private sector. Our person in charge of the protection of personal information (responsable de la protection des renseignements personnels) is the operator named in section 1; send access requests, questions and complaints to [support@thread.page](mailto:support@thread.page). We collect information from you; from the owner of a shared place when they enter your email address to invite you; from the sign-in provider you choose; and through your browser or device when it contacts our servers. We ask for your consent for optional analytics and for product-news email; you can withdraw it at any time in **Privacy preferences** or **Account**. We do not use technology to identify, locate or profile you. Your information can be communicated outside Québec and outside Canada, to the providers and places in sections 6 and 8. Before we communicate personal information outside Québec, we assess how sensitive it is, why we use it, the protections that apply, including contract terms, and the law of the destination. You can ask us to confirm that we hold information about you, to give you access and a copy, to correct it, to stop using it for a purpose you withdrew consent for and, where the law allows, to stop disseminating it or to de-index a link to it. Information you gave us in computerized form can be given to you in a structured, commonly used format: use **Export backup**, or ask us for your account data. We answer in writing within 30 days. We do not make decisions about you based exclusively on automated processing; automated security checks, such as rate limits, can block requests temporarily, and a person reviews any restriction of your account on request. We keep a register of confidentiality incidents, and if an incident presents a real risk of significant harm or a risk of serious injury, we notify the authority and the people concerned without delay. The person in charge approves how we keep and destroy information (section 9), handles complaints, keeps the incident register and assesses privacy factors before new features that handle personal information and before communicating information outside Québec. You can complain to the Office of the Privacy Commissioner of Canada ([priv.gc.ca](https://www.priv.gc.ca)) or, in Québec, to the Commission d’accès à l’information ([cai.gouv.qc.ca](https://www.cai.gouv.qc.ca)).

**Switzerland.** For the Swiss Federal Act on Data Protection, the controller is the operator named in section 1. We answer a request for access within 30 days. Where Swiss law requires a safeguard for a disclosure outside Switzerland, we rely on a decision of the Swiss Federal Council that the destination offers adequate protection, which covers the EEA countries and the United Kingdom, and recipients in the United States certified under the Swiss–US Data Privacy Framework, or on standard contractual clauses recognised by the Federal Data Protection and Information Commissioner, with the Swiss adaptations. You may complain to the Federal Data Protection and Information Commissioner.

**New Zealand.** You may ask us for the personal information we hold about you and ask us to correct it; we answer within 20 working days. Our privacy officer is the operator named in section 1. If someone gave us your email address so that we can send you an invitation, our email tells you who gave it to us, why, who receives it and how to see or correct it. You may complain to the Office of the Privacy Commissioner.

**Australia.** You may ask us for access to your personal information and for its correction at [support@thread.page](mailto:support@thread.page); we answer within one month.

**Norway, Iceland and Liechtenstein.** The GDPR applies there through the EEA Agreement, so the parts of this policy that refer to the GDPR and to an EEA authority apply to you. You may complain to Datatilsynet (Norway), Persónuvernd (Iceland) or the Datenschutzstelle (Liechtenstein).

## 15. Community

**What is public:** Your posts and comments in Community are public, with your public name, when you wrote and edited them and the language of the interface you used. Anyone can read them without an account, link to them and quote them, and search engines may show them. We ask search engines not to index posts about problems, posts the team has not yet answered or given a status, and merged posts. Before your first post or comment, we show you the name that will appear and let you change it. Changing the name on your account changes it on everything you posted. A post or comment the team removed is replaced by a notice with the rule it broke, without your name.

**What is not public:** Your email address, your votes, the posts you follow and the reports you send. We show only the number of votes on a post.

**Emails:** When you write, comment on or vote for a post, you follow it, and we email you when the team answers there and, as a rule, when its status changes. Each email lets you stop updates about that post; **Community updates** in **Account → Email** stops them for all posts. Once you stop updates about a post, commenting or voting later does not start them again. These emails contain no advertising and no tracking.

**Deleting your posts and comments:** You can delete them at any time, except a post or comment the team removed. A comment you delete is deleted. A post you delete is deleted if nobody else commented on it, no other post was merged into it and the team neither answered it nor gave it a status; otherwise we delete your name and the details you wrote and keep the title, so that the votes, the comments and the team's answer still make sense; your own comments on it keep your name until you delete them. If you want us to remove more, write to [support@thread.page](mailto:support@thread.page): we weigh your request against the interests of the other people in the discussion and tell you what we removed and why anything stays. Copies that other people or search engines made before you deleted it can remain outside our control.

**Closing your account:** Your posts and comments stay in Community and show **Former member** instead of your name, unless you tick **Delete my Community posts and comments** when you close your account; then each post is handled as if you deleted it, and your comments are deleted. We do not keep your name with what stays. This does not make it anonymous: the text itself can still identify you. Your votes stay only in the vote counts, and your follows are deleted. Posts and comments the team removed are kept hidden for the time in section 9, also after you close your account or ask us to delete them.

**Reports:** When you report a post or comment in Community, we use what you send to review the report, to tell you our decision and to keep a record of it. If you are signed in, your report comes from your account, and we use its name and email address instead of asking for them. We tell the author what was reported and what we did, without your name or contact details unless you agreed, except for a copyright notice, which we forward with your name and contact details as the [Copyright complaints](/help/copyright) page explains.

**Moderation and rate limits:** A person reviews every report and decides on removals and restrictions; we use no automated tools to judge posts, comments or accounts. The team gets a daily email that lists new posts and comments, with their public names, and new reports; we keep it as routine support correspondence (section 9), also after a post or comment is deleted. To limit spam and abuse, we count the posts, comments, votes and other requests that each account and network address sends to Community, using keyed digests that we delete soon after each limit period ends. A limit only delays what you do next; it never removes anything.