Version 2026-10-07.1. Effective when published and, for contract terms, accepted. Current beta operation; real-money billing is not available.
Reading-copy editorial notice (16 October 2026): this website reading copy incorporates a factual company-status correction only. THREADLINE LDA was incorporated in Portugal on 9 October 2026 (NIPC / matrícula 519681169). The title and version shown above identify the historical accepted document; this is not a new accepted version, agreement or novation, and the original accepted documents and acceptance evidence remain archived unchanged.
Research context and saved working drafts — Supplement 2026-10-19.1 (extension 1.7.123)
Supplement ID 2026-10-19.1 — 19 October 2026. Applies to extension 1.7.123.
When you explicitly request research, Threadline uses the visible professional profile, including current-role responsibilities and relevant professional posts, with your seller profile.
Saved edits and accepted translations keep the original and recent working versions in Chrome extension local storage, isolated by your Threadline account. These include message/email text, language and prospect/signal/channel identifiers. They are not synchronized across browsers or devices and saving does not send or publish a message.
Drafts and prospect language choices expire seven days after last save and are removed on next access; storage is limited to 40 drafts, 100 prospect language choices and approximately 2 MB, so older copies may be removed sooner. Signing out or changing extension accounts clears this cache. Browser storage is not end-to-end encrypted. Copied, sent or explicitly shared content has its own lifecycle.
Account writing language applies across prospects for new drafts unless overridden for one prospect; the override does not cover their company. Existing drafts are not automatically translated.
The dated notice does not change accepted contract 2026-10-07.1 or its history, providers, permissions, prices, credit rules or payment activation.
Saveable full notice: https://app.threadlinehq.io/legal/working-drafts-update-2026-10-19.1.html
Extension sign in and account connections
Supplement ID 2026-10-12.1. Applies to extension 1.7.111; Store review and owner live checks are separate from backend/download deployment.
Extension 1.7.111 lets you sign up or log in directly with Google or your email and password. After required account setup and agreement steps, the extension connects automatically. You do not generate or paste a pairing code in this version. Your web dashboard uses the same Threadline account and can remain signed in separately.
Threadline authorizes one active extension login session per account. Signing in through another extension replaces the previous extension session and revokes its refresh session. Protected extension requests must match the currently authorized session. Multiple tabs in the same Chrome profile share that extension session. Teams members use their individual accounts and seats. You can sign out the active extension from Connection in the dashboard without signing out the dashboard. Account-level session revocation and deletion controls remain available. Work already started may finish; signing out does not erase information already displayed or copied.
To maintain this connection, the extension keeps its Auth access and refresh tokens and a random connection credential in local Chrome extension storage. Newly created connection credentials are not placed in Chrome sync storage. The existing internal storage key my_pairing_code now holds that opaque credential, not a code the user must enter. During unfinished setup, the pending Auth session and its activation credential are stored locally until connection completes or setup is signed out. A transient Chrome session-storage preference remembers whether you chose Sign up or Log in; it contains no credentials. The server stores a hash of the connection credential, the associated Auth session identifier, account identifier, connection status and timestamps. These are necessary authentication and account-access records; this change does not add hardware fingerprinting, location tracking or browser-history collection.
Active authorization is checked against the live Auth session. It ends when replaced, signed out, revoked, deleted with the account or no longer backed by a valid Auth session. Daily cleanup removes expired temporary handshakes and ended connection records while preserving a live connection. The old two-minute code lifetime does not expire an active extension login. Older extension versions retain a compatibility handshake during rollout and should be updated. A connection created before session binding may require a fresh sign-in; the account, company profile, plan, credits and saved research are preserved.
This control limits active login sessions. It does not identify a physical person or guarantee that deliberately copied authentication credentials cannot be shared. Keep your account credentials private and use the individual accounts or seats required by your plan.
Signing in, reconnecting or repeating setup neither consumes a Reveal nor grants another Free allowance. This release does not change prices, plan entitlements, credit/refund rules, AI providers or prompts, extension permissions, professional-data collection, marketing choices, customer rights or the separate real-payment activation gate. Accepted legal bundle 2026-10-07.1 and its acceptance history remain unchanged. This dated update supplements the previous authentication, storage and security descriptions; earlier notices remain historical where superseded.
For account or privacy assistance, contact [email protected].
Saveable copy: https://app.threadlinehq.io/legal/extension-signin-update-2026-10-12.1.html
Release and privacy status for extension 1.7.110
Supplement ID 2026-10-08.3. Status confirmed on 8 October 2026; privacy controls unchanged from 2026-10-08.2.
Extension 1.7.110 retains the privacy controls described in supplement 2026-10-08.2. The update clarifies the existing insufficient-signal Reveal message when a credit has been refunded. It does not change data collection, permissions, research decisions, credit or refund rules, browser storage, or the user journey.
On 8 October 2026, Threadline's founder confirmed that Google had reviewed, accepted and published extension 1.7.110, and that the installed-extension checks for Reveal, refunded credit balances and refresh had passed. These release confirmations supersede earlier pending Store and live-check status notes. Google review is separate from LinkedIn authorisation and is not a blanket legal or security certification.
The founder also confirmed completion of the outstanding supplier agreement, retention and transfer evidence and implementation of the restricted human-access procedure. Necessary operational records and provider-specific retention still exist. Access to specific extension-derived data remains subject to the applicable documented Limited Use exception; the closure does not create broader human access or a promise of zero retention.
This is a dated documentation and release-status update. It leaves accepted contract bundle 2026-10-07.1, prior acceptance evidence, customer rights, the existing processing purposes and published storage rules unchanged. Earlier notices below remain as history where their status statements have been superseded. The pre-existing provider-transfer and real-payment activation gate remains; no payment activation is announced by this update.
For privacy requests, including requests from prospects without an account, contact [email protected].
Save this dated update: HTML copy · Text copy.
Earlier dated notices and accepted text
Privacy update — extension 1.7.109 and aggregate founder reporting
Supplement ID 2026-10-08.2. Current control description for extension 1.7.109. Earlier accepted versions and the earlier same-day checkpoint are historical.
This update describes extension 1.7.109 and the matching backend and founder-reporting controls deployed on 8 October 2026. It supersedes the earlier 2026-10-08.1 checkpoint for these controls. Earlier notices and accepted contract versions are preserved as historical records; this update does not change contractual rights or create a new acceptance record.
In extension 1.7.109, opening a supported LinkedIn profile or the Threadline research panel reads the current professional profile locally for the existing interface. It does not send that currently viewed prospect's URL, name, company, profile identifier or profile-reference hash to Threadline merely because the page or panel opened. Account authentication, vendor settings, language, credit checks and an account-level download of previously saved Reveal results can still contact Threadline. The extension matches the current profile against those saved results locally; the lookup does not identify which profile is currently being viewed.
When you explicitly request Reveal, the professional profile information and company context required for the existing research and drafting feature are transmitted and processed normally. Previously requested in-flight Reveals can resume. Saved results, sources, generated content, explicit feedback, account access and credit/refund rules remain available under their existing controls. The change does not mean that Threadline collects no data.
Routine founder Analytics now provides aggregate usage and account administration separately. It does not expose named individual usage counts, activity times, per-person costs, prospect browsing history, individual-activity views or individual-usage exports. Small usage groups are suppressed, and account/company labels cannot be used to filter usage into individual reports. Account identity and ordinary account administration remain identifiable. Necessary raw product records and restricted operational access remain; aggregation and suppression are not an unconditional guarantee of anonymity. Human access to extension-derived data must be confined to a documented applicable Limited Use exception, such as the user's explicit consent to read specific data, necessary security work or a legal obligation.
Older extension installations can still send the earlier passive profile payload until updated. The deployed database guard continues to discard new passive profile-view inserts from those clients. Distribution of the verified 1.7.109 download does not establish Chrome Web Store review, publication or automatic installation; check the installed version. Earlier passive records were not deleted and retain the existing 180-day activity cleanup. Product/workspace records, private reporting facts, provider logs and backups have their separate retention rules. This update does not claim zero provider logging, immediate backup deletion, EU-only processing or completion of outstanding supplier/transfer evidence.
Threadline limits extension-data use to its disclosed research and drafting purpose and the related operation and security of that service. It does not sell extension data, use it for advertising or use it to determine creditworthiness. Final Chrome Web Store package/declaration reconciliation remains a separate verification step; this notice is not Chrome approval or a blanket legal-compliance certification.
For access, correction, deletion, restriction or objection requests, including requests from prospects without a Threadline account, contact [email protected]. Existing rights and contact routes continue to apply.
Save this dated update: https://app.threadlinehq.io/legal/privacy-update-2026-10-08.2.html. Download text: https://app.threadlinehq.io/legal/privacy-update-2026-10-08.2.txt.
Historical checkpoint and earlier accepted notice — preserved text
Privacy update — 8 October 2026
Supplement ID 2026-10-08.1. The existing version shown above and saved by the earlier-copy buttons is retained as the historical contract/notice version. This supplementary notice describes the current privacy change.
This dated update supplements the earlier notices reproduced below. It describes the backend privacy change deployed on 8 October 2026; it does not replace previously accepted contract versions or change your contractual rights.
When the Threadline research panel opens on a supported profile, the extension can still send the current prospect's profile URL, name and company to Threadline before you request a Reveal. From the backend update on 8 October 2026, Threadline discards these passive profile-view events before inserting them into its activity database. Transmission therefore still occurs; the update does not mean that collection starts only after Reveal.
Requested Reveal processing, saved prospects and outputs, explicit feedback, authentication and credit accounting are unchanged. Future passive panel openings no longer supply new activity records for dashboard company ranking, refresh decisions or fallback history. Existing saved prospect records remain available to the dashboard.
Earlier activity records were not deleted by this update and remain subject to the existing 180-day activity cleanup. Saved Reveal/workspace records have their separate retention rules. Provider request logs and backup copies have separate lifecycles; absence from the activity database is not a promise of zero provider logging or immediate backup deletion.
Private founder Analytics still includes identifiable account-linked usage, including activity times, feature counts and costs. Its fact dataset does not copy full prospect URLs, prompts or message content. Restricting access to founders does not make these records anonymous. The outstanding Chrome disclosure/choice and Limited Use human-access questions are not resolved by this storage change or by publishing this notice.
For access, correction, deletion, restriction or objection requests, including requests from prospects without an account, contact [email protected]. The existing rights and contact routes continue to apply.
Save this dated privacy update · Download the text copy
Earlier notice — preserved text
1 Developer and scope
Threadline is currently operated jointly by Diogo Baptista and Pedro Castro. Correspondence address: Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. Contact: [email protected]. THREADLINE LDA was incorporated on 9 October 2026 (NIPC / matrícula 519681169); the effective transfer of the provider role to it has not yet been confirmed, so it is not the present contracting party.
This disclosure describes the reviewed extension behavior and its related backend processing. It must match the package distributed to users, its store listing and its first-use interface. A privacy page alone does not establish Chrome Web Store compliance.
2 Collection begins before Reveal in the current flow
Threadline displays a panel on supported LinkedIn pages. Opening the panel can send a profile-view activity event containing the current prospect’s profile URL, name and company before you request a Reveal. A Reveal then reads selected visible professional information, such as name, role, employer, location, profile/company URL, biography, work history and professional activity, to generate the requested research and drafts.
A page you can view while signed in, including Sales Navigator, is not necessarily public to everyone. Threadline does not open other LinkedIn profiles in the background or automatically send LinkedIn messages, invitations, comments or likes. Public-web monitoring of companies selected in the web app is a separate service function.
3 What is sent and where
Selected profile and company information, supplied vendor settings, custom instructions and relevant context are processed by the Threadline Supabase backend and sent to OpenAI for AI-assisted research and drafts. Vendor information can be confidential and user-entered. Public sources and source links can be included in the research.
The service stores requested prospects, outputs and workspace records. Technical events can include actions, timestamps, extension version, performance, errors and request identifiers. Some activity records contain full prospect URLs, names and companies; describing all telemetry as anonymous or hashed would be inaccurate.
Private founder Analytics shows account email/company and service-usage metrics, but does not copy full prospect URLs, prompts or message content into its fact dataset. Internal account-created and setup-completed emails are sent through Resend to the founders’ business inboxes. These account notifications are separate from prospect collection.
4 Browser storage and permissions
- storage: session tokens, pairing/device state, preferences, caches and queued events in Chrome storage.
- activeTab: interaction with the active tab in relevant user-triggered flows.
- scripting: injection or execution of the extension’s interface/content scripts for supported features.
- clipboardWrite: copying selected or generated content when requested.
- LinkedIn host access: displaying the interface and processing the supported page context, including the panel-opening activity event described above.
- Threadline Supabase host access: authentication and authorised backend calls.
The reviewed manifest does not request the browser history or cookies permission. That does not mean the extension sends no page-derived information. Browser storage is not end-to-end encrypted, and uninstalling does not erase previously transmitted server data.
5 Purposes retention and rights
Data supports the requested research/drafting/workspace features, authentication, security, troubleshooting and the account operations described in the Privacy Notice. Raw reveal records normally expire after 7 days, company caches after 5 days, interaction events after 90 days and product activity/AI usage records after 180 days, subject to the next successful cleanup. Private Analytics has a separate history window of up to 400 days. Saved workspace content and account information have their own lifecycle. Founder-notification records currently have no age-based purge; mailbox/provider copies are separate.
Sign out, revoke a paired device or remove the extension to stop its authorised use. Contact [email protected] for access, correction, erasure, restriction or objection, including if you are a prospect without an account. Self-service exports include private Analytics and application notification records; mailbox and provider records may require a separate response.
6 AI provider handling
OpenAI states API data is not used for model training by default. Threadline does not train a general-purpose model using extension user data. Standard provider abuse-monitoring retention can include inputs/outputs for up to 30 days, subject to provider exceptions and law. store:false is not a Zero Data Retention guarantee. AI output requires human checking.
7 Chrome Limited Use requirements
Chrome Web Store requirements apply to both raw and derived extension user data. Use and transfers must remain within permitted purposes, including the prominently disclosed user-facing feature and permitted security or legal purposes. Extension user data must not be sold, used for personalised advertising or transferred for unrelated credit/lending decisions.
Human reading is subject to Chrome’s specific exceptions: explicit consent to read specific data, necessary security investigation, legal requirements, or appropriately aggregated and anonymised internal operations. Need-to-know access alone is not the same as aggregated and anonymised data. Named per-user adoption monitoring must be assessed against these restrictions rather than presumed compliant.
The reviewed implementation still requires a release check of prominent disclosure before panel-opening collection, affirmative agreement where required, exact store declarations and the boundary between account administration and extension-derived analytics. These are open product/Store items in the readiness register; this document update does not claim to have implemented them.
8 Proposed first-use disclosure text for the product team
When you open Threadline on a supported profile, it may send the prospect’s URL, name and company to Threadline as a profile-view event. When you request a Reveal, it processes selected visible professional information and company context with Threadline’s backend and OpenAI to create research and drafts. Account and feature-use records support service administration, security and usage analysis as described in our Privacy Notice. Session tokens, settings and caches are stored in Chrome. Threadline does not automatically send LinkedIn messages or invitations. Read the Privacy Notice before choosing whether to enable collection.
Implementation requirement: present the final, accurate disclosure before the relevant data is collected, provide a real decline path and record the appropriate agreement. This proposed text does not assert that an “I agree” screen is already deployed, and user agreement is not the prospect’s GDPR consent.
9 LinkedIn independence
LinkedIn does not sponsor or approve Threadline. Its agreements restrict certain browser-plugin copying, scraping and overlays. User initiation does not establish permission. Users and Threadline must comply with their own applicable obligations; neither this notice nor the existence of similar extensions is a platform approval.
Extension-first Free registration
A Chrome-owned side panel lets you register with email and password, repeat the password locally, sign in to an existing account, or use a pairing code. A new extension account activates immediately. Resend sends an acknowledgement; no signup code or activation-link step is required. This does not verify ownership of the mailbox. The extension and dashboard use the same account, saved company profile and one-time five-Reveal Free allowance. The dashboard requires ordinary sign-in; paid upgrades and payment details stay in the web app.
The additional sidePanel permission displays the packaged account and company-setup interface on an extension origin, separate from a third-party webpage. It does not install another extension. The browser controls which side displays the panel. Account credentials are sent securely to Threadline authentication, never inserted into the LinkedIn page. A pending session and company draft are stored locally to resume setup, then removed on pairing or when leaving setup for another account. Passwords are not saved in drafts.
Company-profile generation sends the company inputs to the existing backend and OpenAI; users review and edit suggestions before saving. The signup endpoint keeps pseudonymous rate-limit buckets for 24 hours, and registration acknowledgement outbox records for 30 days or until earlier account deletion, subject to scheduled cleanup. These are separate from founder-alert records and provider/mailbox copies. The new forms do not change the existing prospect-collection, reveal or analytics behavior described above, and do not resolve the separate open Store/platform items.
Continue with Google
The optional Google button is available on registration and sign-in. A compact, visible new-account notice links to the Terms and Privacy Notice beside the account-entry actions. Creating an account by continuing after that notice accepts the Terms without separate checkboxes. Existing users with current or explicitly compatible agreements sign in without another acceptance. Marketing emails and opt-ins are disabled; service emails remain available. The identity permission opens Google's own authentication window and receives the return through Chrome's identity API. You return to this same extension's company setup or connection step; no second extension is installed. The flow requests only identity, email and basic profile. Threadline does not receive your Google password or request Gmail, contacts, Drive or calendar access.
The backend validates Google's identity assertion and a single-use, browser-bound attempt before issuing a normal Threadline session. The one-time Free allowance, company profile, paid entitlements and manual pairing protocol remain shared with the dashboard. A new Google account receives the same service acknowledgement. The Privacy Notice and Cookie and Local Storage Policy describe Google identity records, the 10-minute sign-in attempt, account lifecycle and provider handling. This authentication addition does not expand prospect collection.
Company case studies and use-case links — 26 October 2026
Supplement 2026-10-26.1
This notice describes the case-study library introduced with Threadline 1.7.146. It takes effect for this functionality when the corresponding app and backend are released. It does not change earlier accepted terms or record a new agreement.
When you generate your company profile, Threadline uses the company name, product or service category and website to find public customer stories and use-case pages on that website and through web search. You can also submit public page links. This work continues in the background and does not require uploading a document. The search and extraction use OpenAI; the saved library is held in Threadline’s Supabase backend. No additional provider or Chrome permission is introduced by this feature.
Threadline reads public pages and stores their source links, titles, customer and industry names, stated teams and responsibilities, a short description of the problem and use case, reported outcomes, a short supporting excerpt and source/check dates where available. Pages are processed to extract these facts; full source documents are not retained as library attachments. Public source material can contain professional names or quotations. Source facts and AI summaries may be incomplete or inaccurate. The source link remains available for review.
Your company library is associated with your account. In a managed Teams workspace, members use the workspace owner’s company library; the owner manages its links. The library is not a public directory. When you request a new message or regenerate one, Threadline may supply a limited set of previously read facts to the existing writing model. The model decides whether they are relevant. It does not search case-study pages during Reveal, and a missing or unavailable library does not prevent writing. Saving case studies or generating a draft does not send outreach.
You can remove links in the Library tab during setup or on the web app’s Library page. Removal excludes the related evidence from future library inputs and prevents a discovery job already in progress from adding that removed link back. It does not rewrite earlier saved messages or retract text you copied or sent. Changing the company identity replaces its active library. Account deletion removes the account’s library; providers’ logs and backups follow their separate retention schedules. Facts checked more than 90 days ago are excluded from writing, which is a freshness limit rather than automatic deletion. Regenerating a profile can refresh a library older than 30 days, and the Find links again control requests a refresh subject to service limits.
Existing rights, security controls, provider disclosures and contact routes continue to apply. Contact [email protected] for data-rights requests or concerns about a source.
Spoken call playbooks and personal call settings — supplement 2026-10-28.1
From extension 1.7.151, the cold-call playbook has Open, Ask then listen, Brush-off and Close. Rep dialogue is separate from hypothetical prospect answers and coaching. The existing AI writing request generates the message and its playbook together. Regenerating a message also updates its playbook. An explicit playbook refresh uses the full current LinkedIn draft, supplied profile and signal, seller evidence, and available account intelligence. It preserves that draft. Existing bounded provider/error recovery still applies. These are generated suggestions, not verified prospect statements or guaranteed outcomes.
My opener is optional personal text saved to the signed-in Threadline account in Supabase and displayed verbatim. It is not generated, included in the playbook AI request, or included in a shared brief. The rep can replace it or save an empty value. It is available when the same account opens a brief on another device.
The optional sent declaration records that the rep says they sent a specific LinkedIn message, with a chosen date. Copying, generating or editing a draft does not mark it sent. The saved record contains account and prospect identifiers, a SHA-256 message fingerprint, sent date, revision and update time; this new table does not retain another copy of the message body. It is account-scoped and draft-specific. Clearing the declaration removes the date while retaining the fingerprint and revision to prevent stale writes. The declaration does not verify delivery and does not send, read or monitor LinkedIn messages.
Saved call settings and declaration records persist until replaced or account deletion; they are included in the existing account export and removed by the account purge/deletion flow. Previously generated drafts, shared copies, provider records and backups retain their existing lifecycle. Sent status can affect the opening and email brush-off only after the rep explicitly refreshes the playbook. Refresh is available on Starter and above under the existing regeneration entitlement.
This update adds no Chrome permission, provider, automatic outreach, live call recording or microphone access. Existing privacy and AI disclosures continue to apply. Accepted contract text and acceptance history remain unchanged. Contact [email protected] for privacy assistance.
Save this call playbook notice
Simplified call playbook — supplement 2026-10-28.2
From extension 1.7.153, the cold-call playbook displays only Open, Ask then listen, Brush-off and Close. My opener, the sent-message checkbox/date, save controls and separate playbook refresh controls are removed. The updated extension does not read or write those personal call settings. Opening the playbook or editing a draft does not trigger an extra AI request. Normal message generation and regeneration continue to generate the message and playbook together.
New playbook generation does not use saved sent declarations or claim that a message was already sent. Existing saved wording is retained until normal regeneration. Earlier opener and sent-declaration records are not deleted by this interface update; they retain the existing account-scoped protection, export and account deletion/purge lifecycle described in supplement 2026-10-28.1. Older installed versions may still expose their previous controls until updated.
This supplement supersedes the earlier description of available call settings in the updated extension. It introduces no new provider, data category, purpose, retention period, Chrome permission, outreach automation, pricing or contract acceptance. AI output remains suggested wording for the rep to review.
Save this simplified playbook notice
Manual Library use cases — Supplement 2026-10-29.1
From Threadline 1.7.156, the Library also accepts a title and plain text for a case study or use case that is not available online. A public link, uploaded document and team tags are not required. Threadline stores the supplied text in its Supabase backend. Saving or editing this text does not ask an AI model to extract or rewrite it. Ready means saved and available for generation; it does not mean independently verified. Manual entries are labelled Added by you.
The existing writing model may receive saved manual entries alongside public Library evidence when you request a new message or regenerate one. Their contents are seller-supplied information, not instructions. A general use case does not establish an actual customer relationship or achieved result. Only add information you are entitled to use, and anonymize anything you do not want included in generated outreach. Library text can contain business-confidential information or professional personal data if you choose to enter it. The Library is not a public directory, but details used in a draft may appear in text you copy, send or deliberately share. Saving an entry does not send outreach.
An account controls its own Library. In a managed Teams workspace, members can use the owner's Library and only the owner can add, edit or remove entries. Manual entries are stored separately from website discovery and are not overwritten by Find links again. Unlike retrieved public facts, they do not expire after the public evidence freshness interval; the owner maintains them until removal, replacement of the active company identity, product-data purge or account deletion. An account's own Library is included in its data export. Provider logs and backups retain their existing schedules.
Edits and removals affect future Library inputs. They do not rewrite saved drafts, cached signal packages or previously shared snapshots, and do not retract copied or sent text. To use changed Library information in an existing draft, request normal regeneration where available. The feature introduces no new AI provider, Chrome permission, outreach automation, price or acceptance event. It supplements the URL-only Library description in notice 2026-10-26.1; earlier accepted contract text and acceptance records remain unchanged. Contact [email protected] for data-rights requests.