Privacy Policy

1. Scope

This Policy describes how Thread Mind ("we", "us") collects, uses, and shares information when you use our Chrome extension, website, and related services (the "Service"). For full service terms, see our Terms of Service and Refund Policy.

2. Information We Collect

• Account data: email address, sign-in provider ID, display name, and settings.
• Content you choose to process: the text you select, plus any rewrite request you type, so we can generate a reply, summary or rewrite. We do not sell it, and we do not store your selected text or the generated results (see AI Processing and Data Retention below).
• Templates: rewrite templates you choose to save in your account.
• Usage & event data: token usage per request (how many tokens were used, and when), feature usage, coarse diagnostics, crash logs.
• Device/technical data: browser version, OS family, locale, extension version.
• Payment data: subscription status and identifiers handled by our payment processor Paddle. We do not store full card numbers. All payments and refunds are subject to Paddle's Checkout Buyer Terms.
• Support communications: messages you send us and related metadata.

3. How We Use Information

• Provide core functionality (reply generation, summaries and rewriting) and maintain the Service.
• Authenticate users and manage subscriptions.
• Monitor, prevent, and detect fraud, abuse, or security incidents.
• Improve features, performance, and user experience.
• Comply with legal obligations and enforce our Terms.
• Communicate service updates and respond to support requests.

4. Legal Bases (EEA/UK)

Where GDPR/UK GDPR applies, we rely on one or more of the following legal bases:

• Contract: to provide the Service you requested.
• Legitimate interests: to secure, improve, and operate the Service (balanced with your rights).
• Consent: where required for specific processing (e.g., certain cookies).
• Legal obligation: to comply with laws (e.g., tax, accounting, compliance requests).

5. Sharing & Disclosures

We do not sell your personal data. We may share information with:

• Service providers: payment processing (e.g., Paddle), cloud hosting, logging/diagnostics, and analytics. These providers process data on our behalf under appropriate safeguards.
• Authorities: when required by law or to protect rights, safety, and security.
• Business transfers: in connection with a merger, acquisition, or asset sale, in which case reasonable notice will be provided.

6. Cookies & Tracking

Our website may use first-party cookies and similar technologies for essential functions (e.g., session) and optional analytics. You can control cookies through your browser settings. The Chrome extension itself does not use third-party tracking scripts in-page; it operates within the browser context.

7. AI Processing

When you ask Thread Mind for a reply, summary or rewrite, the text you selected (and your rewrite request, if any) is sent over an encrypted connection to our servers and from there to an AI service provider that generates the result. The text is used only to produce that result. We do not store it or the generated result, and we keep it out of our server logs; we only record how many tokens the request used. We implement technical and contractual safeguards to protect confidentiality and prohibit providers from using your data to train models without permission.

8. Data Retention

We retain information only as long as necessary to provide the Service, resolve disputes, enforce agreements, or comply with legal obligations. Typical retention examples:

• Selected text and generated results: not stored by us. Rewrite templates you save are kept until you delete them or your account.
• Account and subscription records: for the duration of your account and as required by tax and accounting laws.
• Operational logs and diagnostics: short-term rolling windows unless required for security investigations.
• Support communications: until resolved and for limited archival purposes.

9. Security

We employ safeguards such as encryption in transit, access controls, least-privilege practices, and monitoring. No method of transmission or storage is 100% secure; we strive to continuously improve our protections.

10. Your Rights

Depending on your location, you may have rights to request access, correction, deletion, portability, or restriction of your personal data, and to object to certain processing. You can also withdraw consent where processing is based on consent.

To exercise rights, contact [email protected]. We may need to verify your identity. If we do not resolve your concern, you may have the right to contact your local data protection authority.

11. International Transfers

We may process data in countries outside your own. Where required, we rely on appropriate safeguards (e.g., standard contractual clauses) to protect personal data transferred internationally.

12. Children

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction). If you believe a child has provided personal data, contact us and we will take appropriate steps.

13. Changes

We may update this Policy from time to time. If changes are material, we will provide reasonable notice (e.g., via the website or in-product notice). Your continued use of the Service after changes take effect signifies acceptance.

14. Contact

If you have questions or requests regarding this Policy, please contact us at [email protected].

For payment and refund questions, see our Refund Policy or contact Paddle support via your order confirmation or Paddle Checkout Buyer Terms.