Privacy Policy
Updated: 26 October 2026
What we receive
When you connect your Threads account we receive: your Threads user id and username, an access token, and the text of the public posts you add by their link and, once Meta permits automatic search, of posts found by your search phrases. We never receive your password - the connection is made through Meta’s own authorisation flow.
Your account on this service
To sign you in we store your email address and either a one-way hash of your password (never the password itself) or the identifier Google gives us if you sign in with Google; if you switch on two-factor sign-in, also an encrypted secret and hashes of the recovery codes. For each browser you sign in from we keep the text it calls itself (its user agent), when the session began, when it was last used and when it ended, so you can recognise a device in your settings and end it; these records are deleted when the session expires, about two weeks after sign-in, and with the account. If an email to your address is refused for good we note that fact and the time. We also keep short counters of recent wrong second-factor codes and of verification emails sent, only to limit abuse.
What we use it for
Only to check relevant public posts for you - those you add by link and, once Meta permits automatic search, those found by your phrases - and to publish replies from your account, and only when you have permitted it. We do not sell data, pass it to advertising networks, or use it to train our own models.
How tokens are stored
Access tokens are stored encrypted (AES-256-GCM). The encryption key is not kept in the database. Tokens are never written to logs.
Third-party data
We store the text of other people’s public posts that you add by link and, once Meta permits automatic search, of those found by your queries, so we can show them to you and draft a reply. We also read the replies other people write under your own posts (their username and text) so you can see who answered you; these are kept while the project exists. We do not collect their contact details, do not build profiles of them, and use the data for nothing else. Posts you dismissed, or that failed verification, are deleted after 90 days.
Counting visits
We count visits to this website without cookies and without identifying you: our own application adds one to a daily counter for the page, its language and a coarse source (a search engine, a social network or a direct visit), and the same for the steps of creating an account, a first project and a first added post, and it stores no cookie, visitor identifier, IP address, browser details or referring address and sends nothing to a third-party analytics service. Separately, our hosting provider (Google Cloud) records the IP address and browser details of each request in its ordinary request logs and keeps them for a limited period, and our server holds the address a request came from in memory for up to five minutes, only to slow down abuse.
Retention
Your account data is kept while the account is connected. On disconnection or deletion we remove tokens immediately and the remaining data within 30 days.
Your rights
You can revoke access in your Threads settings at any time, which immediately ends all activity on your account. You may request deletion of all your data, and we will complete it within 30 days.
Contact
For data questions, write to the address published on this site.