Privacy Policy

This policy applies to Threadline Technologies, Inc. and the Threadline websites, dashboard, managed Threadline Comments service, and related services that link to this policy. The open-source Threadline Identity Protocol (TIP) may be used independently by third parties; their deployments are responsible for their own privacy practices.

Account information: email address, display name, profile information, authentication credentials, account preferences, and related security records. Passwords are stored as one-way password hashes rather than plaintext.

Comments and identity: comments, replies, reactions, votes, favorites, reports, moderation actions, profile/handle information, and the page or thread URL associated with a comment.

Publisher information: site name, domain, site configuration, embed settings, moderation settings, usage/pageview information, and other information needed to operate a publisher account.

Billing information: plan, payment status, transaction/subscription identifiers, amounts, dates, refunds, and billing-related records. Threadline does not receive or store full payment-card numbers through Threadline checkout; PayPal processes the payment transaction.

Communications: information you provide when contacting support, legal, privacy, or refund support.

Security and operational information: limited technical information used for authentication, abuse prevention, rate limiting, fraud/security investigation, and service reliability. IP addresses used for transient rate limiting are not intended to be stored as commenter analytics data. Administrative security/audit records may contain security-related request information.

Analytics: Threadline's publisher analytics may include aggregated pageviews, engagement, reactions, and other product metrics. The managed widget is designed not to create cross-site behavioral advertising profiles.

• Provide, authenticate, secure, and maintain Threadline accounts.
• Display comments and profiles and provide replies, reactions, moderation, reporting, and related features.
• Provide publishers with the analytics and controls included in their plan.
• Process paid subscriptions, payments, refunds, and billing support.
• Send transactional messages such as verification, password-reset, security, billing, and service notices.
• Prevent abuse, fraud, spam, unauthorized access, and attacks.
• Comply with legal obligations and establish, exercise, or defend legal claims.
• Improve reliability and the service using aggregated or appropriately limited operational information.

Where GDPR applies, the applicable legal basis depends on the activity. These may include performance of a contract (for accounts, comments, and paid services), legitimate interests (security, abuse prevention, service reliability, and limited product operations), compliance with legal obligations, and consent where consent is required.

We use service providers to operate Threadline. Depending on the service and feature used, these may include PayPal for payment processing, Resend for transactional email, Vercel for website hosting/analytics infrastructure, database and infrastructure providers, and security or monitoring providers. We disclose information to these providers only as needed for the services they perform, subject to their applicable terms and privacy practices.

We may also disclose information when required by law, to protect users or the service, to investigate abuse or security incidents, or in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets.

• We do not sell personal information as a business model.
• We do not use commenter data for cross-site behavioral advertising.
• We do not intentionally build advertising profiles from a reader's activity across unrelated publisher sites.
• We do not store full payment-card numbers in Threadline's application database.

Threadline uses essential cookies and similar technologies for authentication, security, signup flows, and necessary product functionality. Our managed widget is designed to avoid advertising and cross-site tracking cookies. The Threadline marketing site may also use Vercel's analytics technology for site-level measurement. See our Cookie Policy for the current inventory and publisher guidance.

When a publisher embeds Threadline, the publisher generally determines why and how visitor comment information is collected and displayed on its site. Depending on the processing activity and applicable law, the publisher may act as controller and Threadline as processor/service provider. Publishers are responsible for providing notices and obtaining any consent required for their own website and audience.

Our Data Processing Agreement is available for publishers that require processor terms.

Threadline and its service providers may process information in countries other than the country where you live. Where applicable, we use legally recognized transfer mechanisms and contractual safeguards for international transfers.

Account data: retained while the account is active and through the published account-deletion/recovery process.

Comments: may remain in conversation context in anonymized form after permanent account deletion, where necessary to preserve the integrity of a public discussion or comply with a publisher's instructions and applicable law.

Analytics: aggregated metrics may be retained for operational, reporting, and historical purposes.

Security and moderation records: may be retained for as long as reasonably necessary for security, abuse prevention, dispute handling, and legal obligations.

We periodically review retention practices and may retain information longer where required by law or necessary to establish, exercise, or defend legal claims.

Depending on where you live and whether a particular law applies, you may have rights to access, correct, delete, export, restrict, object to, or otherwise control certain personal information. You may also have rights relating to automated decision-making, sensitive information, or marketing/analytics processing.

For California residents, applicable California privacy laws may provide rights including the right to know, delete, correct, opt out of sale/sharing where applicable, limit certain uses of sensitive personal information, and receive equal treatment for exercising rights. Threadline does not sell personal information.

To exercise a privacy right, use the export/delete controls in your account where available or contact the Threadline team. We may need to verify a request before disclosing or deleting information.

Where GDPR applies, we generally respond to valid rights requests within one month, subject to lawful extensions or exceptions. Other jurisdictions may provide different statutory timelines.

Threadline accounts are not intended for children who are below the minimum age permitted by applicable law. If you believe a child has provided personal information to Threadline in circumstances where we should not have collected it, contact the Threadline team.

We use reasonable technical and organizational safeguards appropriate to the service, including TLS in transit, access controls, password hashing, authenticated sessions, database access controls, abuse prevention, and administrative audit mechanisms. No online service can guarantee absolute security.

We may update this policy as Threadline, its features, or applicable requirements change. We will update the effective date and, where appropriate, provide additional notice for material changes.

Privacy and data-subject requests: Contact the Threadline team
Legal questions: Contact the Threadline team