Privacy Policy

Account information. When you connect Gmail, we receive your email address and display name from your Google profile, and we store them so we know whose inbox we are watching.

Gmail data. With your permission, we read threads from the last 30 days: subjects, participants, snippets, and message bodies. We use exactly two Google permissions, and nothing broader:

• gmail.readonly — to find threads that have gone quiet, unanswered proposals, and promised follow-ups.
• gmail.send — used only when you tap send on a draft inside the Threadbump dashboard. Threadbump never sends email on its own.

App data. We store the working state of the service: thread stages and statuses, AI flags and their reasons, draft subjects and bodies, your snooze/dismissal preferences, and whether your morning digest is on. We also store a session cookie (see “Security” below) and your timezone, so the digest arrives in the morning where you are.

Billing data. Payments are handled by Stripe. Card numbers go directly to Stripe through Stripe Checkout and the Stripe Customer Portal — they never touch our servers. We store only your Stripe customer and subscription identifiers and your subscription status.

• Detect threads that need a follow-up and explain why.
• Draft follow-up replies in your voice for you to review.
• Send your morning digest email to your own address.
• Send replies you explicitly approve, inside existing threads.
• Operate your account, billing, and support.

We do not use your email content to train AI models, and we do not use it for advertising or for any purpose outside operating Threadbump for you.

To detect follow-ups and draft replies, thread content (subjects, participants, and message text) is sent to our AI provider, Anthropic, which processes it solely to perform the analysis and drafting you asked for. Anthropic does not receive your Gmail credentials, and your Google account is never shared with it.

We share data only with the service providers needed to run Threadbump, and only the data each one needs:

• Google — Gmail API access, under the two permissions above.
• Anthropic — AI analysis and drafting.
• Neon — database hosting for your account, threads, flags, and preferences.
• Resend — delivery of your morning digest email.
• Stripe — subscription billing and the customer portal.
• Vercel — hosting for the Threadbump web app.

We do not sell, rent, or trade your personal data, and we do not share it with data brokers or advertisers.

Your Gmail connection is protected in three ways: the OAuth refresh token that keeps you connected is encrypted at rest with AES-256-GCM; your session lives in an httpOnly cookie that JavaScript cannot read and expires after 30 days; and all traffic to Threadbump uses TLS. No system is perfectly secure, and you should keep your Google account itself protected with two-factor authentication.

We keep your data while your account is active, because the service needs your thread history and preferences to work. If you delete your account (see below), we delete your stored Gmail connection, threads, flags, and preferences. Billing records may be kept as required for accounting and tax purposes.

• Revoke Google access at any time at myaccount.google.com/permissions — Threadbump stops working for that inbox immediately, and you can reconnect later.
• Sign out from the dashboard at any time, which ends your session.
• Snooze, dismiss, or turn off the digest from the dashboard; dismissed threads and senders stay dismissed.
• Export or delete your data by emailing threadbumpjt@gmail.com. We will confirm and carry out deletion requests promptly.

Threadbump is a business tool and is not directed at children under 13. We do not knowingly collect personal data from children under 13.

If we change this policy in a material way, we will post the new version here and note the new date above. Continued use of Threadbump after a change means you accept the updated policy.

Questions about this policy or your data: email threadbumpjt@gmail.com.