Privacy Policy

1. Who is responsible

The controller is Infinity Consciousness Europe SIA, Vēja iela 4 – 2, Ādaži, Ādažu novads, LV-2164, Latvia (registration no. 50203642241). Contact: hello@orbitthread.app.

2. Using Thread without an account

Without an account, everything you capture — notes, documents, files, search index and what Thread understood — is stored only in your browser’s storage on your device (IndexedDB and the origin-private file system). We do not receive that content. We record limited first-party product milestones such as opening the app, saving an item, successfully finding it and reopening its source, and which homepage button was used. These events use a random browser identifier and may include the page path, referral or campaign source, button, item type and result count; they never include note or file contents, search terms, prompts, answers or credentials. Our servers also process standard web logs (IP address, time, requested file, user agent) for security and keep them for a short period.

3. Account and sync (optional)

If you create an account we process your email address and a hashed password (or one-time sign-in codes) to authenticate you, via our hosting provider Supabase. If you turn on sync, the content of your synced workspace — except anything marked “Keep on this device only” — is stored in our database and file storage so it can reach your other devices.

• Hosting region: European Union (Ireland).
• Access is restricted per workspace by database access rules; files are private and only served to workspace members.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• We keep synced data until you delete it or your account. Items you delete or mark “Keep on this device only” are removed from the cloud on the next sync.

4. AI features (optional, off by default)

• Local AI (LM Studio, Ollama): model requests go directly from your browser to compatible software running on your own computer; those model requests are not sent to us.
• Your own API key: the key is stored encrypted on our server and never returned to your browser. When you use AI, the relevant excerpts are sent through our server to the provider you chose (e.g. Anthropic, OpenAI, Google), under your own agreement with that provider. We do not store the prompts or answers beyond what is needed to return them, and we log only usage metadata (time, provider, token counts).
• Items marked “Don’t use with AI” are not sent to a model. “Keep on this device only” prevents sync and cloud AI; compatible local models may still process the item unless “Don’t use with AI” is also set.
• We never use your content to train AI models.

5. Trial, subscription and payments

• For each account we store your trial start and end dates and your subscription state (plan, monthly/annual, status, current billing period, scheduled cancellation, seats) so we can grant the right access.
• Payments are handled by Paddle.com, our merchant of record, as an independent controller for payment processing, invoicing and tax. Paddle collects your payment details, billing address and tax information; we never receive or store card numbers. We receive and store Paddle identifiers (customer and subscription IDs), prices, status and billing periods via verified webhooks.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligations for accounting records (Art. 6(1)(c)). Billing records are kept as long as statutory retention periods require (in Latvia generally up to 10 years for accounting documents); other subscription data is deleted with your account.

6. Emails

We send transactional emails only: confirming your address, sign-in links and codes, password resets, email-change confirmations, contact and meeting confirmations, and — once billing emails are enabled — trial reminders (start, 7 days and 1 day before the end, end), subscription confirmations, cancellation confirmations and payment problems. Paddle sends receipts and invoices. No newsletters without your separate consent.

7. Cookies and local storage

Thread uses no advertising or third-party tracking cookies. It stores a random identifier in your browser for the limited first-party product milestones described above, and uses browser storage to hold your workspace, your session when signed in, and a cached copy of your plan status (so Thread keeps working offline). The service worker caches the app so it works offline. When you open the checkout, Paddle’s checkout window may set cookies necessary for payment and fraud prevention.

8. Processors and recipients

• Supabase Inc. — authentication, database and file storage (EU region).
• Our web hosting provider (Vercel) — delivery of the app and API.
• Paddle.com Market Ltd (Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom; UK VAT: GB990597143) — merchant of record for purchases (independent controller for payments and tax).
• Brevo — delivery of authentication, trial and billing emails.
• Only if you add your own key: the AI provider you chose, as your processor under your agreement.

8a. Contact and meeting requests

When you use the contact form or book a meeting, we store your name, email address, optional phone number and message, the selected meeting time and your browser time zone. We use this only to answer your request and manage the meeting (legal basis: steps at your request before a contract or our legitimate interest in responding to enquiries). The details are forwarded by email to our operator and kept only as long as needed for the enquiry.

8b. International transfers (EU ↔ UK)

Thread's sync infrastructure is hosted in the European Union (Ireland and Germany). Under the European Commission's adequacy decisions for the United Kingdom and the UK Data Protection Act 2018, personal data transfers between the United Kingdom and the European Economic Area are recognized as maintaining an essentially equivalent standard of protection, enabling seamless cross-border data transfer without requiring additional contractual transfer instruments.

9. Your rights (EU/EEA & UK)

As an individual in the European Economic Area (EEA) or the United Kingdom, you have the right to access, rectification, erasure, restriction, data portability and objection under EU GDPR, UK GDPR, and the Data Protection Act 2018. You also have the right to lodge a complaint with your competent supervisory authority:

You can export your records and the original file bytes available on this device from Settings → Data; Thread explicitly reports unavailable file bytes before calling an export complete (see Export & restore). To delete your account, contact us at hello@orbitthread.app.