Threadbound is a local-first app: the novel data you create — threads, events, to-dos, manuscript text — is stored in your browser, on your own device, and is never sent to a Threadbound server. This page explains exactly what that means, what we hold if you buy a license, and what happens with the optional features that involve a third party: Google Drive backup and checkout.

Who we are. Threadbound is operated by Allay Society Pty Ltd, trading as Threadbound, of Shop 511 Arbour Ave, Robina QLD 4226, Australia. We are the controller of the personal data described on this page. You can contact us about privacy at threadboundapp@pm.me.

The short version

• Threadbound has no user accounts. There is nothing to sign up for, and your writing is never stored on our servers.
• If you buy a license, we keep a small record of it: your email address, your license key, and the devices it's active on. See "Purchases and license records" below.
• Your project data lives in your browser's local storage (IndexedDB) unless you explicitly export it or turn on Google Drive backup.
• We don't run analytics, tracking scripts, or advertising on the app or this website.
• Google Drive backup, if you turn it on, is a direct connection between your browser and your own Google Drive. We never see or hold a copy of it.
• The Feedback and Feature requests pages on this website store what you submit there: a name you choose and your message, so other visitors can see and vote on feature requests. No email or account is involved.
• Payments are handled entirely by Stripe, our merchant of record. We never see or hold your card details.

Data you create in the app

Everything you enter into Threadbound — thread names, plot events, manuscript scenes, to-dos, calendar settings — is stored using your browser's built-in IndexedDB storage. This data stays on your device. It isn't transmitted anywhere unless you take one of these actions yourself:

• Manual export — downloading a backup zip file to your own computer.
• Manual import — reading a backup zip file back in.
• Google Drive backup — described below.

Uninstalling the app, clearing your browser's site data, or switching browsers/devices will make this data inaccessible unless you've backed it up yourself. See the app's own documentation for backup recommendations.

Google Drive backup (optional)

Threadbound offers an optional feature (Settings → Cloud Backup) that keeps a backup copy of your project in your own Google Drive. This is entirely opt-in and off by default. Here's exactly how it works:

• Connecting uses Google's own sign-in flow. Threadbound requests the drive.file permission scope only — this limits access to files that Threadbound itself creates in your Drive. Threadbound cannot see, read, or modify any other file in your Google Drive.
• Backup files are uploaded directly from your browser to Google's servers using your Google account's own authorization. Threadbound has no server in this path — there is no intermediate service that receives, stores, or processes your data.
• We never receive a copy of your backup files, your Google account information beyond what's needed to complete the connection, or any other Drive contents.
• You can disconnect at any time from Settings → Cloud Backup, or by revoking Threadbound's access directly from your Google Account permissions page. Revoking access does not delete files already saved to your Drive — those are yours, and can be deleted from Drive like any other file.

Threadbound's use of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

Other backup options

We intend to offer Proton Drive as an alternative, privacy-focused backup destination once Proton's own developer platform supports the kind of third-party integration Threadbound needs. This isn't available yet — this policy will be updated with the same level of detail as the Google Drive section above once it ships.

Feedback and feature requests

This website (not the app) includes optional Feedback and Feature requests pages. Submitting something there is opt-in and entirely separate from everything above — it doesn't touch your local app data in any way.

• We don't ask for an email address on either page. The "name" field is whatever you choose to type — it isn't verified and isn't tied to an account.
• Feature requests, their upvotes/downvotes, and comments are public — visible to anyone who visits the page.
• Feedback submissions (the private form with the "Great / Needs work" rating) aren't shown publicly, but are stored the same way.
• This data is stored in a Cloudflare D1 database, written to by a Cloudflare Worker — Cloudflare is the only third party involved, under the same hosting relationship described below.
• To prevent spam and vote-stuffing, each connection can only submit or vote a limited number of times per minute. Cloudflare's rate limiter keeps that count using your IP address for about a minute. The IP address isn't stored in our database, isn't linked to anything you submit, and isn't used for anything else.
• Votes are tracked by a random, anonymous id stored in your browser's local storage, only to stop one browser voting twice on the same request — it isn't linked to your name or anything else identifying.

Website and hosting

This website and the app are hosted on Cloudflare Pages. Like virtually any web host, Cloudflare's infrastructure processes standard connection metadata (such as IP address, browser type, and request timestamps) to serve pages and for basic security purposes (e.g. abuse prevention). Threadbound does not itself collect, log, or have access to this information beyond what a normal web request involves, and does not use it for tracking or profiling. See Cloudflare's privacy policy for details on their handling of this data.

This site stores a few non-identifying preferences in your browser's local storage — your light/dark theme choice, and, if you use the Feedback or Feature requests pages, the name you typed (so you don't have to retype it) and a random anonymous id (so a vote isn't counted twice from the same browser). None of this leaves your browser except when you actually submit feedback, a request, a vote, or a comment.

No analytics, no advertising

Threadbound does not use Google Analytics, advertising pixels, or any third-party tracking or fingerprinting scripts, on either this website or in the app.

Both are served entirely from Threadbound's own domains, fonts included, so simply visiting this site or opening the app involves no third party other than our host, Cloudflare (see below). The only other exceptions are Google Drive backup, and the Stripe checkout page you're sent to when you choose to buy (see below). We don't use cookies for tracking or advertising.

Purchases and license records

Threadbound is a one-time purchase. Checkout is handled by Stripe (using its Managed Payments service), our merchant of record. Stripe, through its Link service (your receipt names the seller as Link, LLC), is the seller of record for your purchase and is an independent controller of the personal data you give it at checkout — your name, email, billing country or postcode, and payment details — under Stripe's privacy policy. Stripe also keeps the transaction and tax records the law requires it to. Threadbound never receives or stores your card details.

At checkout

• The price is set in US dollars on our site. Stripe may show it in your local currency and adds any sales tax or VAT at checkout.
• Clicking Buy takes you to a checkout page hosted by Stripe. Nothing from Stripe is loaded on our site before that. From then on, Stripe receives what you enter at checkout and your connection details.
• Checkout may offer to save your details in a Link account for faster checkout next time. That's optional and is between you and Link, under Stripe's privacy policy. We never receive it.
• When you click Buy, your browser creates a random secret, keeps it in its local storage, and passes only a one-way hash of it to Stripe, in the checkout link, as part of the purchase. It lets the page you land on after paying show your license key to the browser that bought it, and to nobody else.

What we store about a purchase

When Stripe tells us a purchase is complete, we create a license record in a database on Cloudflare (separate from the one used for feedback). It holds:

• the email address you gave Stripe (it comes in Stripe's purchase notification), and Stripe's identifiers for your checkout, payment and, where there is one, customer;
• your license key (kept so we can email it to you again) and a one-way hash of it;
• the license's status (active, refunded or revoked) and the dates it was created and, if it applies, refunded;
• whether your key email was delivered, and the error if it wasn't;
• the hash of the checkout secret described above;
• for each device you activate: a random device id the app generates, a device name such as "Chrome on Windows" (you can see it in Settings → License), and the dates it was activated and last checked.

We do not store your payment details, your billing address, or anything you write in Threadbound.

What the app sends us

The app talks to our license server only when you use the license feature: activating or deactivating a device, the roughly weekly re-check while you're online, and "Lost your key?". Each sends your license key (or, for "Lost your key?", your email address) and the device id and name, and nothing else. The free trial is tracked entirely on your device and involves no contact with us. Your projects are never sent.

Why we use your data, and our legal basis

• To provide your license — creating and emailing your key, activating devices, re-checking status, resending a lost key and handling a refund. Basis: performing our contract with you.
• To keep the license server secure — rate-limiting and preventing key guessing and abuse. Basis: our legitimate interest in keeping the service safe. The rate limiter counts requests by IP address for about a minute; the IP address isn't stored with your license record.
• To meet legal obligations and to handle disputes such as chargebacks. Basis: legal obligation and legitimate interests.
• We do not use it for marketing, profiling or analytics, and we don't sell it or share it for those purposes.

Who we share it with

• Stripe, as merchant of record, for the sale, payments, tax compliance, invoicing and refunds.
• Resend (privacy policy), our email provider. It receives your email address and the contents of the license email so it can deliver it. Open and click tracking is turned off, so it doesn't record whether you read the message.
• Cloudflare, which hosts this website, the app and the license database (see "Website and hosting").
• Professional advisers such as an accountant or lawyer, and authorities where the law requires it or to protect rights and safety.

International transfers

Stripe, Resend and Cloudflare operate internationally, so your data may be processed outside your country, including in the United States and the United Kingdom. Where you're in the UK or EEA, these providers rely on safeguards such as standard contractual clauses, adequacy decisions or the UK's international data transfer arrangements; see their own policies for details.

How long we keep it

We keep a license record for as long as the license exists, so you can get your key again and activate new devices. If a license is refunded or reversed we keep the record only as long as needed to stop the key working and deal with any dispute (up to 12 months), then delete or anonymise it. You can ask us to remove your data sooner (below). Stripe keeps its own records for as long as tax and accounting law requires.

Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another provider, and you can complain to your local data protection authority (in Australia, the Office of the Australian Information Commissioner; in the UK, the Information Commissioner's Office; in the EU, your national authority). To use any of these, email threadboundapp@pm.me from the address you bought with. We'll reply within one month.

Deleting your data. If you ask us to delete your license record, we remove your email address, your customer identifier, the stored copy of your key and the device names. The one-way key hash stays, so copies already activated on your devices keep working, but we can no longer email you the key. Stripe handles deletion of what it holds separately; see Stripe's privacy policy for how to ask it.

Security

License records sit in a Cloudflare database that only our license server can reach, over encrypted connections. The server checks Stripe's signature on every purchase notification, rate-limits every endpoint, and keeps its error logs free of license keys and email addresses. Access to the database and to our accounts with Stripe, Resend and Cloudflare is limited to us and protected with strong authentication.

Children's privacy

Threadbound is not directed at children and we do not knowingly collect personal information from anyone under the age of 13 (or the relevant minimum age in your jurisdiction).

Changes to this policy

If this policy changes, we'll update the "Last updated" date above. Since Threadbound has no accounts and no mailing list, we don't have a way to notify you directly — check back here if you want to review the current version.

Contact

Questions about this policy can be sent to threadboundapp@pm.me.