Privacy policy

1. Information we collect

• Account data — your name, email address and profile picture from Google sign-in.
• Threads data — when you connect a Threads account through Meta's authorization, we receive the data covered by the permissions you approve: profile details (user ID, username, name, picture, bio), your posts and their media, replies and mentions on your content, insights and metrics, and results of keyword searches and public profile lookups you run. We also store the access token Threads issues, encrypted.
• Content you create — drafts, scheduled posts, uploaded media, notes, brand settings, saved lists and automation rules.
• Workspace data — workspaces, members and roles, invitations, API keys (stored hashed) and an audit log of actions taken.
• Technical data — IP address, browser information and server logs needed to run and secure the Service, and a session cookie that keeps you signed in.

2. How we use your information

• To provide SuperThreads: publishing and scheduling, inbox and replies, analytics, research and AI features.
• To keep the Service secure, prevent abuse and enforce safety limits and Meta's platform rules.
• To send service emails such as invitations, alerts and reports you set up.
• To provide support and meet legal obligations.

We rely on performing our contract with you, our legitimate interest in running a secure service, and legal obligations. We do not sell or rent personal data, do not use it for advertising, and do not use your Threads data or content to train AI models. Data from a connected Threads account is visible only to members of the workspace it is connected to.

3. Meta and Threads data

Our use of data received from the Threads API complies with the Meta Platform Terms and Developer Policies. We access only the data needed for features you use, request only the permissions those features need, and stop accessing an account as soon as you disconnect it or remove SuperThreads from your Threads settings.

4. Who we share data with

We share data only with service providers that process it on our behalf to run SuperThreads:

• Meta (Threads API) — to publish, read and manage content on accounts you connect.
• Google — sign-in, and cloud infrastructure for background jobs.
• OpenAI — when you use AI features, the relevant text (for example a draft or the posts being analysed) is sent to generate a result. Data sent via the OpenAI API is not used to train their models.
• Cloudflare — storage and delivery of uploaded media.
• Database hosting and email delivery providers — to store application data and send service emails.

We may also disclose data when required by law, or as part of a merger or acquisition subject to this policy.

5. Data retention

• Account and workspace data: kept while your account is active.
• Threads access tokens: deleted immediately when you disconnect the account or remove SuperThreads in Threads settings.
• Threads data and content: deleted from our active systems within 30 days of a deletion request or account closure.
• Sign-in sessions: expire after 30 days.
• Deletion records: we keep the confirmation code, Threads user ID and status of each deletion request so you can check it and we can demonstrate compliance.

6. Deleting your data

You can delete your data at any time. See our Data deletion page for step-by-step instructions, including removing SuperThreads from your Threads settings.

7. Your rights

Depending on where you live (including under the GDPR), you have the right to access, correct, delete, export, restrict or object to processing of your personal data, and to withdraw consent. Email hello@superthreads.si and we will respond within one month; we may need to verify your identity. You may also complain to your local data protection authority.

8. Security

All traffic uses HTTPS. Threads access tokens are encrypted at rest and never logged; API keys are stored as hashes; Meta callbacks are verified with our app secret; and access is limited by workspace roles. No system is perfectly secure, but we work to protect your data and will notify you of a breach as required by law.

9. International transfers

Our providers may process data outside your country, including in the United States and the European Union. Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

10. Cookies

We use a strictly necessary, HttpOnly session cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

11. Children

SuperThreads is not intended for anyone under 18. We delete accounts of minors when we learn of them.

12. Changes to this policy

We will announce material changes by email or in the app at least 14 days before they take effect. The date at the top shows the latest version.

13. Contact

Forward Fastion — hello@superthreads.si