Privacy Policy
ThreadWeave stitches conversations from Reddit, RSS-backed forums, and the sources you connect into a single topic feed. This page explains what we collect, how we use it, and the choices you have. Questions can be sent to threadweave@polsia.app.
1. Information we collect
When you use ThreadWeave, we collect: (a) account information you provide at signup, such as your email address and authentication credentials; (b) OAuth tokens we receive when you connect a platform such as Google; we store these to keep your connection active and to fetch content on your behalf; (c) content you submit, including the topics you choose, the sources you opt in to follow, any feedback you send us, and posts and discussions we fetch from the platforms you choose to connect (we do not post on your behalf); (d) usage data, such as pages visited, summaries generated, and timestamps; and (e) technical data from your device, including IP address, browser type, and basic device identifiers required to operate and secure the Service. We use Stripe Checkout via Polsia's billing module to charge for paid plans — we never see full payment-card numbers; Stripe retains them on our behalf.
2. How we use information
We use the information we collect to operate and improve ThreadWeave — to authenticate you, deliver the topic summaries you request, personalize source recommendations, detect abuse, send service notifications, and respond to your support requests. We do not use the topics, sources, or summaries you submit to train third-party AI models. Where you have opted in, we may use aggregate, non-identifying usage patterns to improve ThreadWeave's own summarization quality.
3. Sharing and selling
We do not sell personal information, and we do not share it with third parties for their independent use. We share information only with: (a) service providers that operate the Service on our behalf — authentication, hosting, email delivery, database, sign-in, and payment processing — under written confidentiality obligations; (b) third-party sources you have chosen to connect, which receive only the minimum data needed to fetch the conversations you asked us to read; and (c) authorities where required by law or to protect the safety, rights, or property of our users or others. Our primary subprocessors are: authentication (Auth.js / Better Auth, session management), hosting (Render — US region), transactional email (delivered via Polsia's authenticated email proxy — no ad-network DSP or marketing ESP), primary database (Neon — managed Postgres, US region), and payment processing (Stripe, via Polsia's billing module). We additionally rely on sign-in and content-fetch subprocessors on your behalf: Google — sign-in (we receive name and email; we do not access your Gmail content); Hacker News — the Algolia HN Search API, used to fetch public Hacker News threads you ask us to summarize; and Reddit — OAuth-authenticated fetch of public posts from the communities you connect. X is reserved for fetch access only, enabled per-workspace and not opted in by default; we will email active subscribers at least 30 days before enabling any workspace in by default. We will notify active subscribers by email at least 30 days before adding a new subprocessor that handles personal information.
4. Cookies and analytics
We use cookies and similar storage only to keep you signed in, to remember your interface preferences (such as light/dark theme), and to attribute referrals from the marketing channels that brought you to the Service. We may use a privacy-respecting analytics tool to understand aggregate usage of the Service; any such tool is operated without persistent cross-site identifiers and, where required by law, is gated behind your consent. We do not use third-party advertising cookies, and we do not run Facebook Pixel, Google Ads tracking, or similar third-party advertising measurement on the Service.
5. Data retention
We keep your account information for as long as your account is active or as needed to provide the Service. On verified request we delete personal information within 30 days, except where retention is required by law — for example, tax and accounting records for paid subscriptions, which we keep for the period required by applicable tax law. Server logs and audit trails are retained for 30 days. Support correspondence is retained for as long as needed to resolve the underlying request and to maintain a record of our responses.
6. Your rights
Depending on where you live, you may have the right to access, correct, or delete the personal information we hold about you, to object to or restrict certain processing, and to request a portable copy of the data you submitted. If you are in California, the CCPA/CPRA grants you the right to know, delete, correct, and limit the use of sensitive personal information. If you are in the EEA, the UK, or Brazil, the GDPR/UK GDPR/LGPD grant you corresponding rights; we will respond within 30 days. Send deletion requests to threadweave@polsia.app with the email address on your account; we action them within 30 days and email a confirmation when complete. The same address handles access, correction, and data-portability requests.
7. Children’s privacy
ThreadWeave is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will delete it as soon as possible. If you believe a child has provided us with personal information, please contact us so we can delete it.
8. International transfers
The Service is operated from the United States. If you use the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States. Where required by law — for example, when transferring personal data from the EEA, the UK, or Switzerland — we rely on standard contractual clauses or other approved transfer mechanisms to protect your information during transit.
9. Changes to this policy
We may update this Privacy Policy from time to time. If we make a material change, we will notify active subscribers by email and post a notice in the Service at least 30 days before the change takes effect. The "Last updated" date at the bottom of this page reflects the most recent revision. Continued use of the Service after the effective date of the revised policy constitutes acceptance.
10. Contact
Questions about this Privacy Policy or our handling of your information can be sent to the operator at threadweave@polsia.app. We try to respond within five business days.