Version 2026-10-07.1. Effective when published and, for contract terms, accepted. Current beta operation; real-money billing is not available.
Reading-copy editorial notice (16 October 2026): this website reading copy incorporates a factual company-status correction only. THREADLINE LDA was incorporated in Portugal on 9 October 2026 (NIPC / matrícula 519681169). The title and version shown above identify the historical accepted document; this is not a new accepted version, agreement or novation, and the original accepted documents and acceptance evidence remain archived unchanged.
Extension sign in and account connections
Supplement ID 2026-10-12.1. Applies to extension 1.7.111; Store review and owner live checks are separate from backend/download deployment.
Extension 1.7.111 lets you sign up or log in directly with Google or your email and password. After required account setup and agreement steps, the extension connects automatically. You do not generate or paste a pairing code in this version. Your web dashboard uses the same Threadline account and can remain signed in separately.
Threadline authorizes one active extension login session per account. Signing in through another extension replaces the previous extension session and revokes its refresh session. Protected extension requests must match the currently authorized session. Multiple tabs in the same Chrome profile share that extension session. Teams members use their individual accounts and seats. You can sign out the active extension from Connection in the dashboard without signing out the dashboard. Account-level session revocation and deletion controls remain available. Work already started may finish; signing out does not erase information already displayed or copied.
To maintain this connection, the extension keeps its Auth access and refresh tokens and a random connection credential in local Chrome extension storage. Newly created connection credentials are not placed in Chrome sync storage. The existing internal storage key my_pairing_code now holds that opaque credential, not a code the user must enter. During unfinished setup, the pending Auth session and its activation credential are stored locally until connection completes or setup is signed out. A transient Chrome session-storage preference remembers whether you chose Sign up or Log in; it contains no credentials. The server stores a hash of the connection credential, the associated Auth session identifier, account identifier, connection status and timestamps. These are necessary authentication and account-access records; this change does not add hardware fingerprinting, location tracking or browser-history collection.
Active authorization is checked against the live Auth session. It ends when replaced, signed out, revoked, deleted with the account or no longer backed by a valid Auth session. Daily cleanup removes expired temporary handshakes and ended connection records while preserving a live connection. The old two-minute code lifetime does not expire an active extension login. Older extension versions retain a compatibility handshake during rollout and should be updated. A connection created before session binding may require a fresh sign-in; the account, company profile, plan, credits and saved research are preserved.
This control limits active login sessions. It does not identify a physical person or guarantee that deliberately copied authentication credentials cannot be shared. Keep your account credentials private and use the individual accounts or seats required by your plan.
Signing in, reconnecting or repeating setup neither consumes a Reveal nor grants another Free allowance. This release does not change prices, plan entitlements, credit/refund rules, AI providers or prompts, extension permissions, professional-data collection, marketing choices, customer rights or the separate real-payment activation gate. Accepted legal bundle 2026-10-07.1 and its acceptance history remain unchanged. This dated update supplements the previous authentication, storage and security descriptions; earlier notices remain historical where superseded.
For account or privacy assistance, contact [email protected].
Saveable copy: https://app.threadlinehq.io/legal/extension-signin-update-2026-10-12.1.html
Release and privacy status for extension 1.7.110
Supplement ID 2026-10-08.3. Status confirmed on 8 October 2026; privacy controls unchanged from 2026-10-08.2.
Extension 1.7.110 retains the privacy controls described in supplement 2026-10-08.2. The update clarifies the existing insufficient-signal Reveal message when a credit has been refunded. It does not change data collection, permissions, research decisions, credit or refund rules, browser storage, or the user journey.
On 8 October 2026, Threadline's founder confirmed that Google had reviewed, accepted and published extension 1.7.110, and that the installed-extension checks for Reveal, refunded credit balances and refresh had passed. These release confirmations supersede earlier pending Store and live-check status notes. Google review is separate from LinkedIn authorisation and is not a blanket legal or security certification.
The founder also confirmed completion of the outstanding supplier agreement, retention and transfer evidence and implementation of the restricted human-access procedure. Necessary operational records and provider-specific retention still exist. Access to specific extension-derived data remains subject to the applicable documented Limited Use exception; the closure does not create broader human access or a promise of zero retention.
This is a dated documentation and release-status update. It leaves accepted contract bundle 2026-10-07.1, prior acceptance evidence, customer rights, the existing processing purposes and published storage rules unchanged. Earlier notices below remain as history where their status statements have been superseded. The pre-existing provider-transfer and real-payment activation gate remains; no payment activation is announced by this update.
For privacy requests, including requests from prospects without an account, contact [email protected].
Save this dated update: HTML copy · Text copy.
Earlier dated notices and accepted text
Privacy update — extension 1.7.109 and aggregate founder reporting
Supplement ID 2026-10-08.2. Current control description for extension 1.7.109. Earlier accepted versions and the earlier same-day checkpoint are historical.
This update describes extension 1.7.109 and the matching backend and founder-reporting controls deployed on 8 October 2026. It supersedes the earlier 2026-10-08.1 checkpoint for these controls. Earlier notices and accepted contract versions are preserved as historical records; this update does not change contractual rights or create a new acceptance record.
In extension 1.7.109, opening a supported LinkedIn profile or the Threadline research panel reads the current professional profile locally for the existing interface. It does not send that currently viewed prospect's URL, name, company, profile identifier or profile-reference hash to Threadline merely because the page or panel opened. Account authentication, vendor settings, language, credit checks and an account-level download of previously saved Reveal results can still contact Threadline. The extension matches the current profile against those saved results locally; the lookup does not identify which profile is currently being viewed.
When you explicitly request Reveal, the professional profile information and company context required for the existing research and drafting feature are transmitted and processed normally. Previously requested in-flight Reveals can resume. Saved results, sources, generated content, explicit feedback, account access and credit/refund rules remain available under their existing controls. The change does not mean that Threadline collects no data.
Routine founder Analytics now provides aggregate usage and account administration separately. It does not expose named individual usage counts, activity times, per-person costs, prospect browsing history, individual-activity views or individual-usage exports. Small usage groups are suppressed, and account/company labels cannot be used to filter usage into individual reports. Account identity and ordinary account administration remain identifiable. Necessary raw product records and restricted operational access remain; aggregation and suppression are not an unconditional guarantee of anonymity. Human access to extension-derived data must be confined to a documented applicable Limited Use exception, such as the user's explicit consent to read specific data, necessary security work or a legal obligation.
Older extension installations can still send the earlier passive profile payload until updated. The deployed database guard continues to discard new passive profile-view inserts from those clients. Distribution of the verified 1.7.109 download does not establish Chrome Web Store review, publication or automatic installation; check the installed version. Earlier passive records were not deleted and retain the existing 180-day activity cleanup. Product/workspace records, private reporting facts, provider logs and backups have their separate retention rules. This update does not claim zero provider logging, immediate backup deletion, EU-only processing or completion of outstanding supplier/transfer evidence.
Threadline limits extension-data use to its disclosed research and drafting purpose and the related operation and security of that service. It does not sell extension data, use it for advertising or use it to determine creditworthiness. Final Chrome Web Store package/declaration reconciliation remains a separate verification step; this notice is not Chrome approval or a blanket legal-compliance certification.
For access, correction, deletion, restriction or objection requests, including requests from prospects without a Threadline account, contact [email protected]. Existing rights and contact routes continue to apply.
Save this dated update: https://app.threadlinehq.io/legal/privacy-update-2026-10-08.2.html. Download text: https://app.threadlinehq.io/legal/privacy-update-2026-10-08.2.txt.
Historical checkpoint and earlier accepted notice — preserved text
Privacy update — 8 October 2026
Supplement ID 2026-10-08.1. The existing version shown above and saved by the earlier-copy buttons is retained as the historical contract/notice version. This supplementary notice describes the current privacy change.
This dated update supplements the earlier notices reproduced below. It describes the backend privacy change deployed on 8 October 2026; it does not replace previously accepted contract versions or change your contractual rights.
When the Threadline research panel opens on a supported profile, the extension can still send the current prospect's profile URL, name and company to Threadline before you request a Reveal. From the backend update on 8 October 2026, Threadline discards these passive profile-view events before inserting them into its activity database. Transmission therefore still occurs; the update does not mean that collection starts only after Reveal.
Requested Reveal processing, saved prospects and outputs, explicit feedback, authentication and credit accounting are unchanged. Future passive panel openings no longer supply new activity records for dashboard company ranking, refresh decisions or fallback history. Existing saved prospect records remain available to the dashboard.
Earlier activity records were not deleted by this update and remain subject to the existing 180-day activity cleanup. Saved Reveal/workspace records have their separate retention rules. Provider request logs and backup copies have separate lifecycles; absence from the activity database is not a promise of zero provider logging or immediate backup deletion.
Private founder Analytics still includes identifiable account-linked usage, including activity times, feature counts and costs. Its fact dataset does not copy full prospect URLs, prompts or message content. Restricting access to founders does not make these records anonymous. The outstanding Chrome disclosure/choice and Limited Use human-access questions are not resolved by this storage change or by publishing this notice.
For access, correction, deletion, restriction or objection requests, including requests from prospects without an account, contact [email protected]. The existing rights and contact routes continue to apply.
Save this dated privacy update · Download the text copy
Earlier notice — preserved text
1 Scope
Threadline is currently operated jointly by Diogo Baptista and Pedro Castro. Correspondence address: Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. Contact: [email protected]. THREADLINE LDA was incorporated on 9 October 2026 (NIPC / matrícula 519681169); the effective transfer of the provider role to it has not yet been confirmed, so it is not the present contracting party.
This policy covers cookies, localStorage, sessionStorage, scripts and extension-managed browser storage used across the marketing website, web app, private Analytics and Chrome extension. The Privacy Notice explains server-side processing and your rights.
Strictly necessary storage can be used to provide a service you request or secure it where the legal exemption applies. Optional audience measurement, advertising or other non-essential access to your device requires prior consent where applicable. A tool being first-party or useful to Threadline does not by itself make it necessary.
2 Marketing website
The website is now delivered through Lovable hosting. The old WordPress, Jetpack, Gravatar and Cookiebot inventory does not describe the current website and has been removed from this version.
The 5 October review observed a __cf_bm security cookie with a lifetime of about 30 minutes and a __dpl hosting cookie with a lifetime of about one day. Exact behavior can vary by deployment and provider settings. The __cf_bm cookie supports bot/security protection. The precise purpose and necessity of __dpl are still being confirmed with the hosting provider; we do not claim a verified exemption for it. Contact [email protected] about this open item.
The sampled homepage review did not observe Google Analytics or Meta advertising trackers. This is not a guarantee about every route, sign-in state, embedded resource or future release. Fonts are served with the site files and do not require a browser request to Google Fonts. Website delivery and error-reporting providers can also receive request information.
There is no verified cookie-preferences panel on the reviewed website. This policy does not direct you to a control that does not exist. Optional technologies must remain disabled unless an appropriate choice and withdrawal mechanism is implemented before they run.
3 Web app storage
Authentication uses browser storage for the Supabase session, including the sb-qcesvtizjskieuxvyyqx-auth-token record. It enables sign-in and session refresh and remains subject to session expiry, sign-out, revocation or browser deletion. Do not share browser profiles containing a signed-in session.
The app stores interface language, requested preferences, pending checkout recovery and bounded dashboard/company caches. Examples include threadline.ui.language, threadline_onboarding_checkout_v1, threadline_refill_checkout_v1 and threadline.dashboardSignals records. Some entries expire or are removed by the relevant flow; others remain until reset or cleared. An exact per-key maximum and logout/account-deletion behavior must be recorded in the internal inventory rather than assuming all browser storage expires with server records.
Security gateways, if enabled, may set access-session cookies. A September observation of a Cloudflare access cookie is not treated as a verified current cookie name or expiry. Payment pages operated by Stripe use their own necessary payment/fraud technologies and provide their own disclosures.
4 Extension storage and permissions
The extension uses Chrome storage for access/refresh tokens, pairing/device state, language, launcher position, company/research caches and queued events. Values can persist until their individual expiry, reset, sign-out or uninstall. Some preferences can use Chrome synchronisation where configured.
Website cookie choices do not automatically control an extension’s collection. The Chrome Extension Privacy Disclosure explains the profile-view event on panel opening and the information processed by Reveal. Required prominent disclosure and user agreement must happen before the relevant collection, not merely through a link in a website footer.
5 Private Analytics
The founders’ private Analytics uses a secure, HttpOnly, SameSite session cookie with a 12-hour session lifetime. It enables authenticated administration. Account and usage information displayed in Analytics comes from server records and is described in the Privacy Notice; it is not made anonymous by being server-side.
Optional client telemetry and storage still require a separate necessity and consent assessment. The lawful basis for server-side processing does not remove applicable rules on accessing terminal equipment.
6 Your choices
You can inspect and delete cookies and site storage in your browser, and remove the extension through Chrome. Clearing necessary storage can sign you out or prevent requested functions. Uninstalling the extension or deleting local browser data does not delete data already sent to Threadline or providers.
Use available sign-out/device controls to end sessions. For access, correction, deletion or objection, contact [email protected]. No account is required for a privacy request. If optional tracking is introduced, the relevant interface must provide a clear prior choice and an equally accessible way to withdraw it.
7 Inventory and changes
The internal inventory records surface, provider, exact name, purpose, whether necessary, legal justification, configured duration and test evidence. It must cover logged-out and logged-in routes, checkout, shared briefs, Analytics and extension storage after material releases. This review does not certify that the complete consent implementation has been tested.
We update the public policy when actual technology or purposes change. New optional purposes require an appropriate fresh choice before collection.
Extension setup storage
The extension uses threadline_onboarding_session_v1 for a pending Supabase setup session and threadline_onboarding_draft_v1 for the account identifier and unfinished company-profile fields. No password or repeated-password value is stored in these records. Closing the panel preserves setup; session expiry can require another sign-in. The records are removed after browser pairing or when choosing a different account from setup. Chrome uninstall or clearing extension storage removes local copies. This necessary setup storage is separate from web-app sessions and browser synchronisation; the setup session and draft are not sent to Chrome sync.
Google sign-in state
When you choose Continue with Google after the visible new-account notice, the web application stores threadline_google_intent_v1 in that tab's sessionStorage. It contains a random verifier, state and creation time to bind the return to your browser. Attempts expire after 10 minutes; the item is removed when the return is processed, on a failed start or when an expired attempt is encountered, and by closing the tab. The extension holds corresponding transient values in its authentication flow; it does not put a Google password in storage. Google may use its own sign-in cookies on its account page, subject to Google's privacy information and your browser settings. The identity permission opens Chrome's authentication window and receives the permitted return; it does not grant access to your browser history or all Google services.