Privacy Policy

1. Who is responsible

ThreadPage is operated by Nazarii Olehovych Leus, an individual entrepreneur registered in Ukraine, trading as ThreadPage.

Ukrainian taxpayer identification number (RNOKPP): 3591414557
Registered business address: 32 Shkilna Street, Apartment 7, Bershad, Haisynskyi District, Vinnytsia Region, 24400, Ukraine.
Privacy contact: [email protected]. The operator is also our person in charge of the protection of personal information and our privacy officer.

This policy covers our website, web application and associated services. It explains our processing; it is not a request for blanket consent.

We are the controller of personal data that we process for our own purposes, such as account administration and sign-in, security and abuse prevention, support and reports, billing records, optional product analytics, invitations, and the operation of shared places, including what participants see about each other.

For the content of your Folders, Threads and Notes, our role depends on how you use ThreadPage. If you use it for purely personal or household purposes, for example with your family, we process that content as controller, only to provide what you ask for, such as storing, syncing, sharing, recovering and securing it, to handle reports about it and to meet our legal obligations. If you use ThreadPage for your work or business, you, or the organisation you act for, are the controller of other people’s personal data in your content, and we process it as your processor. The paragraph “Business use” in the section “Your content and connected assistants” of our Terms of Service sets out our commitments as your processor; where data-protection law requires a separate written agreement, we sign one with you on our standard terms on request. If you use ThreadPage for your work or business under an earlier version of our Terms of Service, we give you the same commitments as your processor from the date this policy was published; the limits of liability of the version you accepted continue to apply to them.

What participants add to a place is part of the owner's content. The owner decides who has access and why. Sharing a place does not make us a joint controller of that content.

Paddle and external services you choose have separate responsibilities for their own processing.

2. Local content and cloud content

Local workspace: Notes, images, Drafts and related data created in local-only mode are stored in your browser. We do not receive their content simply because you write locally. Browser storage can be cleared or lost and is not a separate backup.

Cloud features: When you use an enabled cloud feature and complete the applicable account and source-confirmation process, we receive the content and metadata needed to deliver it. This can include Folders, Threads, Notes, images, references, revisions and owner-private Draft or Recovery data covered by that feature. Eligible Pro activation can start Sync automatically for established same-owner content unless you have chosen Sync Off.

Separate actions: Signing in is not permission to claim someone else’s browser content. Turning Sync off does not erase server copies. Signing out may keep that account’s local data for a later sign-in. Account erasure does not delete an export or guarantee immediate deletion on an offline device.

Even with local-only Notes, our website and infrastructure process information necessary to deliver network requests, including an IP address. Local-only content does not mean that no personal data are processed.

3. Information we process

A sign-in provider supplies the identity information allowed by its sign-in process. Signing in does not authorise us to read your email, contacts or cloud documents.

Paddle and its payment providers handle payment details entered at checkout. Our application’s payment integration does not receive or store full card numbers or card security codes. Do not send those details, passwords or unrelated sensitive documents to support.

To decide whether a Pro trial is available, we check whether another account with the same email address, compared as described in section 7 of our Terms of Service, has already had a trial or a paid subscription. For this we keep and compare keyed fingerprints of the address, calculated with a secret key, rather than the address itself, and we check only after you have confirmed that you control the address. We do this on the basis of our legitimate interest in offering the free trial once per email address (section 4); you can object as described in section 11.

4. Purposes and legal bases

Where data-protection law requires a legal basis, we use these bases for processing we control:

A record of accepting Terms is not consent to all personal-data processing. A record that a Privacy Policy was made available is a transparency record, not a statement that you agreed to optional processing. A cryptographic content fingerprint helps establish which text was used; it does not by itself identify a person or prove that the text was read.

We may be unable to supply a feature without the account, security or billing information it reasonably requires. Optional analytics are not required for using local Notes, creating an account or subscribing.

Plan, trial and storage records are separate from optional product analytics. Refusing or withdrawing optional analytics does not disable the minimum records needed to deliver your plan and protect the service. We do not use these records to introduce an undisclosed request charge for Pro.

We do not sell personal information, share it for cross-context behavioural advertising, or use Note content, including content in shared places, for targeted advertising or to train our own general-purpose AI models. An external AI provider you authorise has its own terms and settings for the information it receives.

5. Browser storage and analytics

Cookies and browser storage support sign-in, request security, local content, offline operation, language and interface preferences, and your privacy choice. Blocking or clearing necessary storage can sign you out, reset settings or remove local work.

Optional product analytics use PostHog’s EU service and remain off until you allow them in Privacy preferences. Refusal or withdrawal does not remove application features.

When permitted, analytics record broad page categories, selected actions, application readiness, the outcome and timing of a Note-creation operation, selected layouts, broad search-result counts and performance measurements. The event payload excludes Note text, images, Folder or Thread names, search terms, email addresses and account identifiers. We do not use session replay or automatic recording of editor contents.

A random browser identifier is pseudonymous, not necessarily anonymous. Network providers can process the IP address of an incoming request even though the application omits it from analytics event properties and disables IP-based enrichment.

Withdrawing permission stops future optional collection and clears analytics identifiers in that browser. It does not automatically erase previously received events. Contact us to request deletion; locating a pseudonymous record may require limited additional information. Use Privacy preferences, rather than clearing all site data, when you only intend to disable analytics.

The permission request identifies the optional purpose and the relevant notice. We may ask again when a proposed change is outside the permission you gave. A formatting change to the Privacy Policy does not by itself reset your choice, and refusing optional analytics does not prevent you from accepting the Terms.

A shared place opened through its link without signing in sends no analytics. In that view, the notes that are new to you are remembered only in that browser tab and are forgotten when you close it.

Necessary service and payment processing is separate from the analytics switch. Paddle explains the technologies of its checkout and of the card-update form on our billing page in its own privacy notice.

ThreadPage does not change how it works in response to a browser’s “Do Not Track” signal, because optional analytics stay off unless you allow them in Privacy preferences. Apart from Paddle’s checkout and its card-update form on our billing page, which Paddle’s privacy notice describes, we do not let other companies collect information about your activity over time and across other websites through ThreadPage.

The emails we send ourselves contain no tracking pixels, and their links are not rewritten to track clicks, so we do not record whether you opened an email or which link you followed. Product news comes about once a month at most and only if you turn it on.

6. Providers and disclosures

Depending on the feature used, these providers receive information:

Providers receive information relevant to their functions under applicable service arrangements. Paddle is a separate controller for its payment and reseller activities, described in its Privacy Notice. We do not send Note content to Paddle to process a subscription.

When you share a place, its content and the names of the people who added or edited its notes are disclosed to the people you share it with, to anyone with its link while link access is on, and to your connections that can access it. The section “Shared places” explains what participants see about each other.

When we act on a report, we tell the owner and, where it is their content, the author what was reported and what we did, without the reporter's name or contact details unless the reporter agreed. A copyright notice is an exception: we send it, including the sender's name and contact details, to the person who added the material, and we send a counter-notice to the person who sent the notice. Where the law requires it, we report suspected crimes and child sexual exploitation and abuse material to the competent authorities.

Necessary disclosures may also be made to advisers subject to confidentiality duties, or authorities where legally required. A genuine business transfer may involve information under applicable privacy protections and notice requirements; it does not authorise unrelated use of private Notes. If ThreadPage moves to a new operator, we tell you in advance as the section “Operator and scope” of our Terms of Service describes, and the new operator must keep the protections of this policy.

7. External assistants and MCP

Connecting a client lets it receive account content and metadata within your approved permissions. Depending on its permissions, it can submit changes and access supported images or versions belonging to authorised Notes. A connection does not expose excluded content, unpublished Drafts or private Recovery material.

Review whether access covers the Workspace, selected Folders or Threads, and future content. Changing or revoking access in Connections affects subsequent requests, not copies already retained by the external provider.

Each connection's details show its recent activity: what its token or assistant read and changed (the action, the Thread, Note or folder it touched, how many times, first and last time) and your own changes to that connection. This record contains no Note text, search text, URLs, IP address or browser details; we keep it so that you can review what a connection does with your workspace, including after you disconnect it.

In a place you share, your connections that can access it also receive what participants add and, within their permissions, can change it. Participants' notes are marked as theirs. A participant's own connections cannot access a place shared with them.

That provider may process data abroad and apply its own retention and AI-training rules. Review its privacy notice and settings before connecting. Changing a ThreadPage setting cannot guarantee deletion of its independent copy. Connecting an assistant is optional.

Webhooks, endpoints and Requests you set up send content to, or accept content from, the services you choose; those services process it under their own terms.

8. International processing

Our operator is registered in and works from Ukraine, and our application and database are hosted in Frankfurt, Germany. Our providers process information in the places the table shows. Paddle processes payment information in the countries its Privacy Notice lists. Ukraine has no adequacy decision of the European Commission, the UK government or the Swiss Federal Council; access from Ukraine is limited to what operating, supporting and securing the service requires. An EU-hosted component does not establish that all support, access or onward processing is EU-only.

Where data-protection law restricts a transfer to one of our providers, we rely on an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified, or on the standard contractual clauses in the provider’s data processing agreement. For personal data in content you process for your work or business, which we access from Ukraine, we sign standard contractual clauses with you on request, as the paragraph “Business use” of our Terms of Service explains. We do not treat agreement to these Terms or use of cloud storage as a general waiver of transfer protections. Contact us for the safeguards relevant to your data and information about obtaining a copy, with appropriate redaction. Courts, police and security authorities in the countries named in this section may be able to access information held there under their laws.

An external provider you connect is separately responsible for its own processing and transfers.

9. Retention and deletion

We keep personal data for a defined purpose, not simply because storage is available. The following schedule governs information under our control. A shorter deletion right is respected where applicable. A longer exception must be supported by a specific legal obligation, a documented claim or a necessary security investigation; it is limited to the relevant records and reviewed.

An account or content erasure request is handled without undue delay. For information we must erase, our operational target is removal from active systems within 30 days of the request, after only proportionate verification where needed, unless a lawful reason requires a different response. This target does not extend a shorter legal deadline. We tell you what has been completed and explain a lawful exception rather than claiming that every copy disappeared immediately.

Restricted backups are replaced or expire within 90 days after deletion from active systems, unless a specific legal hold applies. They are not available for ordinary account use. A restore must reapply deletion instructions before affected data become available again. This backup cycle does not justify retaining a separate live copy.

If we remove an over-limit cloud copy under our Terms of Service, its restricted backup copies are placed beyond ordinary use and removed within the same backup cycle; a backup is not an available recovery feature. Temporary archives generated for a backup download are removed within a short period after generation; removing an archive does not remove the underlying content.

Trashing content can leave recoverable versions. A valid permanent-deletion or erasure instruction covers the relevant content, history and recovery in our systems, and our providers' copies within the deletion cycles of their agreements, subject to rights of other persons and lawful exceptions. An image used in several Notes remains only while another authorised, non-erased use requires it.

Closing an account can leave a limited, pseudonymous agreement or payment record for the purposes above. Pseudonymous does not necessarily mean anonymous: any remaining linkage remains protected. We remove unnecessary account and session links and never keep private Notes just to prove that Terms were accepted.

Closing an account that had a trial also leaves its trial fingerprint for the 12 months stated above. It is stored separately from the closed account's other records and does not contain your email address, which cannot be read back from it. We do not use it to identify the closed account; we use it only to decide whether an account can have a free trial.

A minimal content-free deletion record can remain while needed to prevent an old device or operation from recreating erased data. Retaining such an identifier does not permit us to retain the deleted text or image. We cannot recall copies held by an independent assistant provider or guarantee immediate erasure on an offline device. Contact [email protected] for a request concerning your data or an explanation of a specific retention exception.

10. Security

Measures include encrypted network connections, encrypted backups, authentication and access restrictions. Only we, people we authorise for a specific and limited task, and our providers’ staff to the extent their data processing agreements allow, can access production systems. We do not look at the content of your Notes except to answer your own request, to handle a report about that content, to investigate a security incident or to meet a legal obligation. Automated operations, such as backups, restore checks and migrations, process content without anyone reading it.

ThreadPage is not presented as an end-to-end encrypted or zero-knowledge service. Cloud functions may require our systems and authorised providers to process readable content. No system can guarantee absolute security. Protect your devices, review connection permissions and keep independent backups appropriate to your needs.

11. Your rights

Depending on the applicable law, you may request access, correction, erasure, restriction or portability of personal data and withdraw consent. Withdrawal does not invalidate earlier lawful processing.

Right to object: You may object to processing based on legitimate interests for reasons relating to your circumstances. You may object to direct marketing at any time: unsubscribing from product news takes effect immediately.

Send requests to [email protected]. We may reasonably verify identity to protect your information. Where GDPR deadlines apply, we respond within one month unless a permitted extension is necessary; we will explain an extension within the initial period. Section 14 gives other deadlines that apply in some places. No self-service button is required to make a request.

You may complain to a competent data-protection authority, including an applicable EEA authority, the UK Information Commissioner, the Ukrainian Parliament Commissioner for Human Rights or an authority named in section 14. Contacting us first is optional.

Where we act as a customer’s processor, we may refer the request to that customer and assist it; a request to erase what you added to a place someone else owns follows section 13. Paddle and independent providers handle requests about data they control.

We do not use your Note content for solely automated decisions producing legal or similarly significant effects about you. Automated security and access checks may occur. External providers explain their own systems separately.

12. Children and changes

ThreadPage is intended for adults and is not directed to children under 18. If we learn that someone under 18 has an account, we close it and delete the personal information we hold about them, including what they added to places other people own, except records the law requires us to keep. We do not knowingly collect personal information from children under 13. Contact us if you think a child has given us personal information. We do not claim to verify every visitor’s age. Joining a shared place also needs an account and the age of 18. Reading a shared place through a link needs no account, and we do not check readers' age.

We identify published versions and their dates and keep a public version history. Updates to this notice describe our processing; they do not themselves give us a new legal basis.

We will explain a material change in an appropriate notice before starting the changed processing where required. If a new purpose or other change requires consent beyond your existing permission, the affected optional processing will not start until that permission is obtained. A new processor used within an existing purpose does not automatically require consent, but still requires the necessary contractual, security, transfer and transparency measures. Refusing or withdrawing optional consent does not prevent you from reading your Notes or exercising your privacy rights.

Editorial corrections that do not change processing do not require a new permission. An acknowledgement that a notice was shown or an email was delivered is not treated as proof that you read it or consented to it.

13. Shared places

What others see about you: When you join a place, its owner sees your name and email address, and the people of the place see your name in its list of people, whatever your level. Everyone with access sees your name next to the notes you add or edit, including anyone with the link while link access is on. The owner's connected tools, such as an assistant the owner connects, can read what you add; they are the owner's tools, not ours, and the owner is responsible for how they are used. Before you join a place or first open it from an invitation, we tell you this. Inside the place you can see whether link access is on.

What participants never see: Participants never see the owner's Drafts, Recovery material, Trash, other Threads and Folders, image library and the history of a note from before it became available to them.

Invitations: When an owner adds you by email, the owner gives us your address. We use it only to send you one invitation naming the owner, the place and your level, and to let you open the place when you sign in with that address. The invitation tells you who we are, why you received it, how long we keep it and how to decline. It contains no message from the owner and no promotion, and we send no reminder. If you do not open it within 30 days it expires and we delete it. Decline stops further invitations to that place; write to [email protected] to stop all invitations from ThreadPage to your address.

Images: Images that participants add are stored without location and camera details. Participants and readers receive every image in a place without those details. The owner's original files stay unchanged and only the owner can open them.

Reading through a link: The owner does not see who read a place through its link. Reading is not anonymous: our routine logs and abuse limits process your IP address as described in sections 3 and 9. The page asks search engines not to index it.

Unsent text: If you write in a shared place and your access ends before the text is saved, the text stays only in that browser. It is not published or synced.

Leaving and closing your account: Leaving a place, being removed or closing your account does not remove what you added, because it is part of a shared work in the owner's place. While your account exists, your contributions show the name currently on your account: we do not store a copy of it with them, so when you change your name in Account, every place shows the new one. After you close your account, they stay and show as added by a former participant: we do not keep your name with them. This does not make them anonymous: the text itself can still identify you. The rest of your account's data is handled as section 9 describes.

Erasing your contributions: You can ask us to erase what you added to a place someone else owns, whether or not your account is still open: write to [email protected], name the place and, if you can, the notes. If your account is open, we verify through your signed-in account that you are the author; if it is closed, we ask you to confirm the address you used and, if that is not enough, other proof that you wrote them, so it is easier to ask before you close your account. We reply within 30 days. Notes that only you wrote, and images you added, we erase from the place, its history and Recovery material, and from backups within the cycle in section 9. Where your text is mixed with other people's work, for example a note others edited or answered in a way that depends on it, we remove what we can separate; what we cannot separate stays only where another person's rights or a legal obligation require it, and we tell you which parts and why. We tell the owner what changed in their place, not why you asked. We do not remove your name from the contributions of an account that still exists, because the name shown is always your current account name: you can change it in Account, or close your account so that your contributions show as added by a former participant. Copies people already made, such as exports or copied text, are outside our control.

Reports: When you report a place or a note, we use what you send to review the report and to tell you our decision. We tell the owner and the author what was reported and what we did, without your name or contact details unless you agreed, except for a copyright notice, which we forward with your name and contact details.

14. Information for some regions

We apply this policy to everyone, wherever they live. This section adds details that the law of some places expects. Where it differs from another section, the statement that protects you more applies.

United States. We do not sell personal information and we do not share it for cross-context behavioural advertising, as US state privacy laws define those terms. We use the content of your Notes only to provide the features you use, to handle reports about it and to meet our legal obligations. If you live in a US state whose law gives you rights to access, correct, delete or receive a copy of your personal information, write to [email protected]. If we decline your request, you can appeal by replying with “Appeal”; we answer in writing within 60 days and explain our decision. We do not treat you worse for using these rights.

Canada and Québec. We follow Canada’s Personal Information Protection and Electronic Documents Act and, for people in Québec, the Act respecting the protection of personal information in the private sector. Our person in charge of the protection of personal information (responsable de la protection des renseignements personnels) is the operator named in section 1; send access requests, questions and complaints to [email protected]. We collect information from you; from the owner of a shared place when they enter your email address to invite you; from the sign-in provider you choose; and through your browser or device when it contacts our servers. We ask for your consent for optional analytics and for product-news email; you can withdraw it at any time in Privacy preferences or Account. We do not use technology to identify, locate or profile you. Your information can be communicated outside Québec and outside Canada, to the providers and places in sections 6 and 8. Before we communicate personal information outside Québec, we assess how sensitive it is, why we use it, the protections that apply, including contract terms, and the law of the destination. You can ask us to confirm that we hold information about you, to give you access and a copy, to correct it, to stop using it for a purpose you withdrew consent for and, where the law allows, to stop disseminating it or to de-index a link to it. Information you gave us in computerized form can be given to you in a structured, commonly used format: use Export backup, or ask us for your account data. We answer in writing within 30 days. We do not make decisions about you based exclusively on automated processing; automated security checks, such as rate limits, can block requests temporarily, and a person reviews any restriction of your account on request. We keep a register of confidentiality incidents, and if an incident presents a real risk of significant harm or a risk of serious injury, we notify the authority and the people concerned without delay. The person in charge approves how we keep and destroy information (section 9), handles complaints, keeps the incident register and assesses privacy factors before new features that handle personal information and before communicating information outside Québec. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, to the Commission d’accès à l’information (cai.gouv.qc.ca).

Switzerland. For the Swiss Federal Act on Data Protection, the controller is the operator named in section 1. We answer a request for access within 30 days. Where Swiss law requires a safeguard for a disclosure outside Switzerland, we rely on a decision of the Swiss Federal Council that the destination offers adequate protection, which covers the EEA countries and the United Kingdom, and recipients in the United States certified under the Swiss–US Data Privacy Framework, or on standard contractual clauses recognised by the Federal Data Protection and Information Commissioner, with the Swiss adaptations. You may complain to the Federal Data Protection and Information Commissioner.

New Zealand. You may ask us for the personal information we hold about you and ask us to correct it; we answer within 20 working days. Our privacy officer is the operator named in section 1. If someone gave us your email address so that we can send you an invitation, our email tells you who gave it to us, why, who receives it and how to see or correct it. You may complain to the Office of the Privacy Commissioner.

Australia. You may ask us for access to your personal information and for its correction at [email protected]; we answer within one month.

Norway, Iceland and Liechtenstein. The GDPR applies there through the EEA Agreement, so the parts of this policy that refer to the GDPR and to an EEA authority apply to you. You may complain to Datatilsynet (Norway), Persónuvernd (Iceland) or the Datenschutzstelle (Liechtenstein).