1. Who is responsible
ThreadPage is operated by Nazarii Olehovych Leus, an individual entrepreneur registered in Ukraine, trading as ThreadPage.
Ukrainian taxpayer identification number (RNOKPP): 3591414557
Registered business address: 32 Shkilna Street, Apartment 7, Bershad, Haisynskyi District, Vinnytsia Region, 24400, Ukraine.
Privacy contact: support@thread.page
This policy covers our website, web application and associated services. It explains our processing; it is not a request for blanket consent.
We are controller for account administration, our security operations, support and optional product analytics. When we process personal data in business content solely on a customer’s instructions, that customer acts as controller and we act as processor. Appropriate contractual terms are required for that processing; this policy does not replace a data processing agreement. Contact us before using cloud features for processing that requires such an agreement.
Paddle and external services you choose have separate responsibilities for their own processing.
2. Local content and cloud content
Local workspace: Notes, images, Drafts and related data created in local-only mode are stored in your browser. We do not receive their content simply because you write locally. Browser storage can be cleared or lost and is not a separate backup.
Cloud features: When you use an enabled cloud feature and complete the applicable account and source-confirmation process, we receive the content and metadata needed to deliver it. This can include Folders, Threads, Notes, images, references, revisions and owner-private Draft or Recovery data covered by that feature. Eligible Pro activation can start Sync automatically for established same-owner content unless you have chosen Sync Off.
Separate actions: Signing in is not permission to claim someone else’s browser content. Turning Sync off does not erase server copies. Signing out may keep that account’s local data for a later sign-in. Account erasure does not delete an export or guarantee immediate deletion on an offline device.
Even with local-only Notes, our website and infrastructure process information necessary to deliver network requests, including an IP address. Local-only content does not mean that no personal data are processed.
3. Information we process
| Category | Information and source |
|---|---|
| Account and sign-in | Email, account ID, optional display name, password hash for password login, and verification and session records. Information comes from you, an optional sign-in provider or our account systems. |
| Content transferred to us | Uploaded content, Folder and Thread metadata, references, timestamps, revisions and authorised recovery copies, supplied by you, enabled devices or a client you authorise. |
| Connections | Client identity, permissions, content scope, connection status, protected authorisation records, operation outcomes and change history. |
| Agreements and notices | The document versions and acceptance wording presented, your affirmative action, relevant account or browser reference, server timestamps, and records of sending a contractual notice or confirming a request. Opening a page is not recorded as proof that you read or agreed to it. |
| Billing | Subscription status, billing periods, checkout and transaction identifiers, and information needed for support, reconciliation and legal records, supplied by you or Paddle. |
| Plan, trial and storage administration | Plan and trial status and dates, storage usage and reservations, the applicable allowance, minimal operation identifiers and outcomes, confirmed subscription changes and, where applicable, the date a cloud copy became read-only and any notice we sent. These records are generated by the service and payment integration and do not include Note text, image content or assistant prompts. |
| Technical and security | IP address, request time, browser or device information, status codes and relevant diagnostic or security records. |
| Support | Messages, contact details and attachments you choose to send. |
| Optional analytics | Pseudonymous browser and visit identifiers and limited usage or performance events collected after permission, as explained below. |
A sign-in provider supplies the identity information allowed by its sign-in process. Signing in does not authorise us to read your email, contacts or cloud documents.
Paddle and its payment providers handle payment details entered at checkout. Our application’s payment integration does not receive or store full card numbers or card security codes. Do not send those details, passwords or unrelated sensitive documents to support.
4. Purposes and legal bases
Where data-protection law requires a legal basis, we use these bases for processing we control:
| Purpose | Legal basis |
|---|---|
| Create an account, provide requested features and answer service questions | Contract performance or steps you request before a contract; legitimate interests for administering an organisation’s account through its representatives. |
| Store and deliver requested content and execute permitted operations | Contract performance; where we act as processor, the customer’s documented instructions under the applicable processing agreement. |
| Prevent abuse, enforce access and investigate failures | Legitimate interests in a secure, reliable service, balanced against your rights; a legal obligation where applicable. |
| Reconcile subscriptions, handle disputes and keep required records | Contract administration, relevant legal obligations and legitimate interests in resolving claims. |
| Administer your plan, trial and storage limits, avoid duplicate operations and payments, and resolve billing or usage enquiries | Contract performance where necessary to provide a service you request; legitimate interests in proportionate security and abuse prevention; legal obligations for required financial records. |
| Record agreements, demonstrate your privacy choices and deliver contractual notices | Contract administration, applicable accountability obligations and legitimate interests in documenting agreements and resolving disputes. Optional analytics themselves remain consent-based. |
| Optional product analytics | Consent, which you may withdraw. |
| Respond to legal or data-protection requests | Applicable legal obligations and, where relevant, legitimate interests in establishing or defending claims. |
A record of accepting Terms is not consent to all personal-data processing. A record that a Privacy Policy was made available is a transparency record, not a statement that you agreed to optional processing. A cryptographic content fingerprint helps establish which text was used; it does not by itself identify a person or prove that the text was read.
We may be unable to supply a feature without the account, security or billing information it reasonably requires. Optional analytics are not required for using local Notes, creating an account or subscribing.
Plan, trial and storage records are separate from optional product analytics. Refusing or withdrawing optional analytics does not disable the minimum records needed to deliver your plan and protect the service. We do not use these records to introduce an undisclosed request charge for Pro.
We do not sell personal information, use private Notes for targeted advertising or train our own general-purpose AI models on them. An external AI provider you authorise has its own terms and settings for the information it receives.
5. Browser storage and analytics
Cookies and browser storage support sign-in, request security, local content, offline operation, language and interface preferences, and your privacy choice. Blocking or clearing necessary storage can sign you out, reset settings or remove local work.
Optional product analytics use PostHog’s EU service and remain off until you allow them in Privacy preferences. Refusal or withdrawal does not remove application features.
When permitted, analytics record broad page categories, selected actions, application readiness, the outcome and timing of a Note-creation operation, selected layouts, broad search-result counts and performance measurements. The event payload excludes Note text, images, Folder or Thread names, search terms, email addresses and account identifiers. We do not use session replay or automatic recording of editor contents.
A random browser identifier is pseudonymous, not necessarily anonymous. Network providers can process the IP address of an incoming request even though the application omits it from analytics event properties and disables IP-based enrichment.
Withdrawing permission stops future optional collection and clears analytics identifiers in that browser. It does not automatically erase previously received events. Contact us to request deletion; locating a pseudonymous record may require limited additional information. Use Privacy preferences, rather than clearing all site data, when you only intend to disable analytics.
The permission request identifies the optional purpose and the relevant notice. We may ask again when a proposed change is outside the permission you gave. A formatting change to the Privacy Policy does not by itself reset your choice, and refusing optional analytics does not prevent you from accepting the Terms.
Necessary service and payment processing is separate from the analytics switch. Paddle explains its checkout technologies in its own privacy notice.
6. Providers and disclosures
Depending on the feature used, recipients include:
| Provider | Operational purpose |
|---|---|
| Cloudflare, including R2 | Network delivery and security; private image storage. |
| Render | Application, backend and background-process hosting. |
| Supabase | Managed database services for account and cloud data. |
| PowerSync | Delivery of authorised account changes to application devices. |
| Resend | Transactional emails, including verification and password recovery. |
| Google Workspace | Support and business correspondence. |
| PostHog | Optional product analytics. |
| Paddle | Payment, subscription, reseller and billing-support activities. |
Providers receive information relevant to their functions under applicable service arrangements. Paddle is a separate controller for its payment and reseller activities, described in its Privacy Notice. We do not send Note content to Paddle to process a subscription.
Necessary disclosures may also be made to advisers subject to confidentiality duties, or authorities where legally required. A genuine business transfer may involve information under applicable privacy protections and notice requirements; it does not authorise unrelated use of private Notes.
7. External assistants and MCP
Connecting a client lets it receive account content and metadata within your approved permissions. Depending on its permissions, it can submit changes and access supported images or versions belonging to authorised Notes. A connection does not expose excluded content, unpublished Drafts or private Recovery material.
Review whether access covers the Workspace, selected Folders or Threads, and future content. Changing or revoking access in Connections affects subsequent requests, not copies already retained by the external provider.
That provider may process data abroad and apply its own retention and AI-training rules. Review its privacy notice and settings before connecting. Changing a ThreadPage setting cannot guarantee deletion of its independent copy. Connecting an assistant is optional.
8. International processing
Our operator is registered in Ukraine and providers operate internationally. Depending on the feature, information may be processed in the EEA, the United Kingdom, the United States, Ukraine or other provider locations. An EU-hosted component does not establish that all support, access or onward processing is EU-only.
Where a transfer is legally restricted, an applicable transfer mechanism and safeguards must be in place, such as an adequacy decision or approved contractual clauses with additional safeguards when needed. We do not treat agreement to these Terms or use of cloud storage as a general waiver of transfer protections. Contact us for the safeguards relevant to your data and information about obtaining a copy, with appropriate redaction.
An external provider you connect is separately responsible for its own processing and transfers.
9. Retention and deletion
We keep personal data for a defined purpose, not simply because storage is available. The following schedule governs information under our control. A shorter deletion right is respected where applicable. A longer exception must be supported by a specific legal obligation, a documented claim or a necessary security investigation; it is limited to the relevant records and reviewed.
| Information | Retention rule |
|---|---|
| Local Notes and exports | Controlled by your browser, device and your own copies. We cannot remotely guarantee their availability or deletion. |
| Account content and account settings | Kept to provide your requested account functions until valid deletion or account closure, subject to the separate history and recovery rules. Cancelling a subscription is not itself an instruction to delete content. |
| Plan, trial and storage administration records | While the account exists, because trial eligibility and the account's plan history depend on them. After account closure, only what is needed as agreement, payment or accounting evidence remains, under those rules. |
| Superseded server Note versions | Ordinary recovery retention of up to 90 days after supersession. A valid erasure or permanent-content-deletion instruction can require earlier removal. |
| External-operation conflict Recovery | Ordinary retention of up to 30 days after creation. This does not set a new automatic expiry for a person's active Draft or other human Recovery copy. |
| Unreferenced image originals | Eligible for cleanup after 30 continuous days without a retained reference. An image still used by another Note or valid retained version remains necessary for that use. Erasure requests are handled separately. |
| Terms acceptance, contractual-notice and request-resolution evidence | While the arrangement or request is active and, normally, for three years after it ends or is finally resolved. Records are limited to relevant versions, dates, identifiers and actions, not Note content or reusable credentials. |
| Optional-consent evidence | While we rely on that consent and, normally, for three years after withdrawal or the end of the relevant processing, solely to demonstrate and respect the choice or resolve a claim. |
| Raw optional product-analytics events | Up to 13 months from collection, subject to an applicable earlier erasure request. Genuinely anonymous statistics may remain without a link back to you. |
| Routine application access and diagnostic logs | Up to 30 days. Relevant extracts needed for a specific security investigation may be retained up to 180 days from preservation, or longer only under a documented legal or claim-related hold. |
| Routine support correspondence | Up to 24 months after the enquiry closes. Contractual disputes and rights-request outcomes follow their applicable evidence schedule; unnecessary attachments are removed earlier. |
| Payment, accounting and tax records | For the legally required period, calculated from the relevant filing or statutory event, including legally required extensions. Ordinary product-log deletion rules do not erase required accounting records. Paddle controls its own records. |
An account or content erasure request is handled without undue delay. For information we must erase, our operational target is removal from active systems within 30 days of the request, after only proportionate verification where needed, unless a lawful reason requires a different response. This target does not extend a shorter legal deadline. We tell you what has been completed and explain a lawful exception rather than claiming that every copy disappeared immediately.
Restricted backups are replaced or expire within 90 days after deletion from active systems, unless a specific legal hold applies. They are not available for ordinary account use. A restore must reapply deletion instructions before affected data become available again. This backup cycle does not justify retaining a separate live copy.
If we remove an over-limit cloud copy under our Terms of Service, its restricted backup copies are placed beyond ordinary use and removed within the same backup cycle; a backup is not an available recovery feature. Temporary archives generated for a backup download are removed within a short period after generation; removing an archive does not remove the underlying content.
Trashing content can leave recoverable versions. A valid permanent-deletion or erasure instruction covers the relevant content, history, recovery and processor systems, subject to rights of other persons and lawful exceptions. Shared images remain only while another authorised, non-erased use requires them.
Closing an account can leave a limited, pseudonymous agreement or payment record for the purposes above. Pseudonymous does not necessarily mean anonymous: any remaining linkage remains protected. We remove unnecessary account and session links and never keep private Notes just to prove that Terms were accepted.
A minimal content-free deletion record can remain while needed to prevent an old device or operation from recreating erased data. Retaining such an identifier does not permit us to retain the deleted text or image. We cannot recall copies held by an independent assistant provider or guarantee immediate erasure on an offline device. Contact support@thread.page for a request concerning your data or an explanation of a specific retention exception.
10. Security
Measures include encrypted network connections, authentication and access restrictions. Operator or provider access must be limited to authorised operational, support, security or legal needs.
ThreadPage is not presented as an end-to-end encrypted or zero-knowledge service. Cloud functions may require our systems and authorised providers to process readable content. No system can guarantee absolute security. Protect your devices, review connection permissions and keep independent backups appropriate to your needs.
11. Your rights
Depending on the applicable law, you may request access, correction, erasure, restriction or portability of personal data and withdraw consent. Withdrawal does not invalidate earlier lawful processing.
Right to object: You may object to processing based on legitimate interests for reasons relating to your circumstances. You may also object to direct marketing wherever that right applies.
Send requests to support@thread.page. We may reasonably verify identity to protect your information. Where GDPR deadlines apply, we respond within one month unless a permitted extension is necessary; we will explain an extension within the initial period. No self-service button is required to make a request.
You may complain to a competent data-protection authority, including an applicable EEA authority, the UK Information Commissioner or the Ukrainian Parliament Commissioner for Human Rights. Contacting us first is optional.
Where we act as a business customer’s processor, we may refer the request to that customer and assist it. Paddle and independent providers handle requests about data they control.
We do not use your Note content for solely automated decisions producing legal or similarly significant effects about you. Automated security and access checks may occur. External providers explain their own systems separately.
12. Children and changes
ThreadPage is intended for adults and is not directed to children under 18. Contact us if a child has supplied personal information in breach of this rule so we can assess and address it. We do not claim to verify every visitor’s age.
We identify published versions and their dates and keep a public version history. Updates to this notice describe our processing; they do not themselves give us a new legal basis.
We will explain a material change in an appropriate notice before starting the changed processing where required. If a new purpose or other change requires consent beyond your existing permission, the affected optional processing will not start until that permission is obtained. A new processor used within an existing purpose does not automatically require consent, but still requires the necessary contractual, security, transfer and transparency measures. Refusing or withdrawing optional consent does not prevent you from reading your Notes or exercising your privacy rights.
Editorial corrections that do not change processing do not require a new permission. An acknowledgement that a notice was shown or an email was delivered is not treated as proof that you read it or consented to it.