Privacy Policy

1. Who is responsible

ThreadPage is operated by Nazarii Olehovych Leus, an individual entrepreneur registered in Ukraine, trading as ThreadPage.

Ukrainian taxpayer identification number (RNOKPP): 3591414557
Registered business address: 32 Shkilna Street, Apartment 7, Bershad, Haisynskyi District, Vinnytsia Region, 24400, Ukraine.
Privacy contact: [email protected]

This policy covers our website, web application and associated services. It explains our processing; it is not a request for blanket consent.

We are controller for account administration, our security operations, support and optional product analytics. When we process personal data in business content solely on a customer’s instructions, that customer acts as controller and we act as processor. Appropriate contractual terms are required for that processing; this policy does not replace a data processing agreement. Contact us before using cloud features for processing that requires such an agreement.

Paddle and external services you choose have separate responsibilities for their own processing.

2. Local content and cloud content

Local workspace: Notes, images, Drafts and related data created in local-only mode are stored in your browser. We do not receive their content simply because you write locally. Browser storage can be cleared or lost and is not a separate backup.

Cloud features: When you use an enabled cloud feature and complete the applicable account and source-confirmation process, we receive the content and metadata needed to deliver it. This can include Folders, Threads, Notes, images, references, revisions and owner-private Draft or Recovery data covered by that feature. Eligible Pro activation can start Sync automatically for established same-owner content unless you have chosen Sync Off.

Separate actions: Signing in is not permission to claim someone else’s browser content. Turning Sync off does not erase server copies. Signing out may keep that account’s local data for a later sign-in. Account erasure does not delete an export or guarantee immediate deletion on an offline device.

Even with local-only Notes, our website and infrastructure process information necessary to deliver network requests, including an IP address. Local-only content does not mean that no personal data are processed.

3. Information we process

A sign-in provider supplies the identity information allowed by its sign-in process. Signing in does not authorise us to read your email, contacts or cloud documents.

Paddle and its payment providers handle payment details entered at checkout. Our application’s payment integration does not receive or store full card numbers or card security codes. Do not send those details, passwords or unrelated sensitive documents to support.

4. Purposes and legal bases

Where data-protection law requires a legal basis, we use these bases for processing we control:

A record of accepting Terms is not consent to all personal-data processing. A record that a Privacy Policy was made available is a transparency record, not a statement that you agreed to optional processing. A cryptographic content fingerprint helps establish which text was used; it does not by itself identify a person or prove that the text was read.

We may be unable to supply a feature without the account, security or billing information it reasonably requires. Optional analytics are not required for using local Notes, creating an account or subscribing.

We do not sell personal information, use private Notes for targeted advertising or train our own general-purpose AI models on them. An external AI provider you authorise has its own terms and settings for the information it receives.

5. Browser storage and analytics

Cookies and browser storage support sign-in, request security, local content, offline operation, language and interface preferences, and your privacy choice. Blocking or clearing necessary storage can sign you out, reset settings or remove local work.

Optional product analytics use PostHog’s EU service and remain off until you allow them in Privacy preferences. Refusal or withdrawal does not remove application features.

When permitted, analytics record broad page categories, selected actions, application readiness, the outcome and timing of a Note-creation operation, selected layouts, broad search-result counts and performance measurements. The event payload excludes Note text, images, Folder or Thread names, search terms, email addresses and account identifiers. We do not use session replay or automatic recording of editor contents.

A random browser identifier is pseudonymous, not necessarily anonymous. Network providers can process the IP address of an incoming request even though the application omits it from analytics event properties and disables IP-based enrichment.

Withdrawing permission stops future optional collection and clears analytics identifiers in that browser. It does not automatically erase previously received events. Contact us to request deletion; locating a pseudonymous record may require limited additional information. Use Privacy preferences, rather than clearing all site data, when you only intend to disable analytics.

The permission request identifies the optional purpose and the relevant notice. We may ask again when a proposed change is outside the permission you gave. A formatting change to the Privacy Policy does not by itself reset your choice, and refusing optional analytics does not prevent you from accepting the Terms.

Necessary service and payment processing is separate from the analytics switch. Paddle explains its checkout technologies in its own privacy notice.

6. Providers and disclosures

Depending on the feature used, recipients include:

Providers receive information relevant to their functions under applicable service arrangements. Paddle is a separate controller for its payment and reseller activities, described in its Privacy Notice. We do not send Note content to Paddle to process a subscription.

Necessary disclosures may also be made to advisers subject to confidentiality duties, or authorities where legally required. A genuine business transfer may involve information under applicable privacy protections and notice requirements; it does not authorise unrelated use of private Notes.

7. External assistants and MCP

Connecting a client lets it receive account content and metadata within your approved permissions. Depending on its permissions, it can submit changes and access supported images or versions belonging to authorised Notes. A connection does not expose excluded content, unpublished Drafts or private Recovery material.

Review whether access covers the Workspace, selected Folders or Threads, and future content. Changing or revoking access in Connections affects subsequent requests, not copies already retained by the external provider.

That provider may process data abroad and apply its own retention and AI-training rules. Review its privacy notice and settings before connecting. Changing a ThreadPage setting cannot guarantee deletion of its independent copy. Connecting an assistant is optional.

8. International processing

Our operator is registered in Ukraine and providers operate internationally. Depending on the feature, information may be processed in the EEA, the United Kingdom, the United States, Ukraine or other provider locations. An EU-hosted component does not establish that all support, access or onward processing is EU-only.

Where a transfer is legally restricted, an applicable transfer mechanism and safeguards must be in place, such as an adequacy decision or approved contractual clauses with additional safeguards when needed. We do not treat agreement to these Terms or use of cloud storage as a general waiver of transfer protections. Contact us for the safeguards relevant to your data and information about obtaining a copy, with appropriate redaction.

An external provider you connect is separately responsible for its own processing and transfers.

9. Retention and deletion

Retention depends on the purpose, use of the relevant feature, deletion instructions, recovery needs, unresolved security incidents or claims, and binding recordkeeping obligations. We do not retain information simply because storage is available.

Local content remains subject to your browser and device controls. We cannot set a remote erasure deadline for an export or an offline device. Browser cleanup may be irreversible.

Account content is retained to supply requested account functions until deletion or closure, subject to recovery settings and lawful retention needs. Trash is not necessarily permanent erasure. Earlier versions and Recovery may contain previous content. Images may remain necessary for another Note or retained version.

Account and connection records are retained while needed to maintain the account, enforce permissions, prevent repeated operations or resolve a relevant security incident or claim. Revoking access does not necessarily erase the minimal security record of that connection.

Agreement and notice records are retained while needed to administer the relevant arrangement, demonstrate choices on which processing relies, handle a withdrawal or establish or defend a legal claim, under a documented retention schedule. The applicable contract, claim periods and specific legal obligations determine the retention period. We minimise these records: agreement evidence does not require copies of private Notes, payment-card data or session credentials. A limited record of withdrawal or refusal may be retained where necessary to respect that choice. A legal hold is limited to a documented purpose and reviewed; it is not a reason to retain all account content.

Support and diagnostic records are retained to resolve the enquiry or fault and any associated complaint, security issue or legal claim. Optional analytics are retained for consent-based product measurement, subject to applicable deletion requests and the provider’s configured retention. Payment and tax records follow the periods required by applicable law; this does not justify keeping unrelated Notes. Paddle controls retention of its own records.

Valid erasure requests may require removal from active content, history, recovery and processor systems. Product recovery settings do not override that right. Minimal deletion or operation records may remain to stop stale devices recreating content or repeating actions; such records must not retain deleted Note text or image content merely for convenience.

Backups may retain restricted copies until their replacement or deletion cycle. They are not normal user-accessible storage. Relevant deletion instructions must be reapplied following a restore. Any retention for a legal hold or security investigation must be limited to that purpose.

Contact us for the retention criteria relevant to your data. We will explain a lawful reason for retaining information that you have asked us to erase.

10. Security

Measures include encrypted network connections, authentication and access restrictions. Operator or provider access must be limited to authorised operational, support, security or legal needs.

ThreadPage is not presented as an end-to-end encrypted or zero-knowledge service. Cloud functions may require our systems and authorised providers to process readable content. No system can guarantee absolute security. Protect your devices, review connection permissions and keep independent backups appropriate to your needs.

11. Your rights

Depending on the applicable law, you may request access, correction, erasure, restriction or portability of personal data and withdraw consent. Withdrawal does not invalidate earlier lawful processing.

Right to object: You may object to processing based on legitimate interests for reasons relating to your circumstances. You may also object to direct marketing wherever that right applies.

Send requests to [email protected]. We may reasonably verify identity to protect your information. Where GDPR deadlines apply, we respond within one month unless a permitted extension is necessary; we will explain an extension within the initial period. No self-service button is required to make a request.

You may complain to a competent data-protection authority, including an applicable EEA authority, the UK Information Commissioner or the Ukrainian Parliament Commissioner for Human Rights. Contacting us first is optional.

Where we act as a business customer’s processor, we may refer the request to that customer and assist it. Paddle and independent providers handle requests about data they control.

We do not use your Note content for solely automated decisions producing legal or similarly significant effects about you. Automated security and access checks may occur. External providers explain their own systems separately.

12. Children and changes

ThreadPage is intended for adults and is not directed to children under 18. Contact us if a child has supplied personal information in breach of this rule so we can assess and address it. We do not claim to verify every visitor’s age.

We identify published versions and their dates and keep a public version history. Updates to this notice describe our processing; they do not themselves give us a new legal basis.

We will explain a material change in an appropriate notice before starting the changed processing where required. If a new purpose or other change requires consent beyond your existing permission, the affected optional processing will not start until that permission is obtained. A new processor used within an existing purpose does not automatically require consent, but still requires the necessary contractual, security, transfer and transparency measures. Refusing or withdrawing optional consent does not prevent you from reading your Notes or exercising your privacy rights.

Editorial corrections that do not change processing do not require a new permission. An acknowledgement that a notice was shown or an email was delivered is not treated as proof that you read it or consented to it.