THREADLOCKThreadlock ("we," "us," "our") is an independent, privately-owned company. This Privacy Policy explains what information we collect, how we use it, and — importantly — how much of your data we cannot access at all, by design.
The short version: your content (messages, files, notes, passwords) is encrypted on your device before it reaches us. We can't read it. We collect only the minimum needed to run your account and keep the service working.
1. Information we collect
Account information. When you create an account, we collect a username and email address. The email is used to operate your account, send important notices, and help with account recovery.
Encrypted content. We store your messages, files, notes, and vault entries only in encrypted form. These are scrambled on your device before upload. We hold the locked data; we do not hold the keys to open it.
Basic operational data. To run the service safely we store limited data such as account roles, security settings, ban/moderation status, and timestamps (e.g. last login).
We do not collect: we do not sell your data, run advertising, or build advertising profiles about you.
2. What we cannot see
Because of our zero-knowledge, end-to-end encryption architecture, we cannot access:
- The contents of your messages
- Your files, notes, or vault entries
- Your passwords or the encryption keys that unlock your data
These are encrypted on your device with keys derived from your passcode, which never leaves your device and is never transmitted to us.
3. How we use your information
- To create, operate, and secure your account
- To send you important service and security notices
- To help you recover access to your account
- To detect, prevent, and respond to abuse, fraud, and security threats
- To comply with legal obligations
4. How we share information
We do not sell your personal information. We may share limited data with service providers who help us operate (for example, our hosting and email-delivery providers), only as needed to run the service. We may disclose information if required by law — but because your content is encrypted and we don't hold the keys, a legal request generally cannot compel us to produce readable content we cannot access.
5. Data retention
We keep your account information for as long as your account is active. You may request deletion of your account, after which we remove your account data, subject to any limited retention required by law.
6. Your rights
Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to certain processing. To exercise these rights, contact us (see below). If you are in the EU/UK (GDPR) or California (CCPA/CPRA), additional rights may apply.
7. Security
We use industry-standard encryption (including AES-256) and secure practices to protect your data. No system is perfectly secure, and we will never claim otherwise — but our architecture is designed so that the most sensitive data (your content) is never readable by us or by anyone who might breach our systems.
8. Children
Threadlock is not directed to children under 13, and we do not knowingly collect personal information from them.
9. Changes to this policy
We may update this policy from time to time. We'll update the "last updated" date above and, for significant changes, notify you.
10. Contact
Questions about this policy? Reach us at [email protected] or through our community Discord.