Privacy Policy

ThreadRecap is designed to minimize data collection. Here is what we handle:

• Chat Files (Temporary): When you upload a WhatsApp export, the file is parsed in your browser. Only the text content needed for AI analysis is sent to our servers. If you save the analysis, the chat text is stored (encrypted at rest) to power the interactive AI chat feature. You can delete it at any time from your dashboard.
• Audio & Video: If you include voice messages or videos, the audio is extracted locally in your browser and sent to our transcription provider — the video file itself is never uploaded, only its audio track. That audio is then stored with your recap so you can play it back alongside its transcript. You can permanently delete the audio on its own, or delete the recap, at any time.
• Account Information: If you create an account, we store your email address and basic profile information through our authentication provider (Clerk). We also store your credit balance and saved analysis results (encrypted at rest).
• Usage Data: We collect limited operational telemetry about how the app is used (such as pages visited and features used) to operate, secure, and improve the service. When an account is deleted, we remove its direct identity from data we retain.
• Integration Tokens: When you connect third-party services (Notion, Google Calendar, Trello), we store OAuth tokens encrypted at rest. These tokens are used solely to maintain your connections and are deleted immediately when you disconnect an integration or delete your account.

Your data is used solely to provide the service:

• Processing chat content through AI to generate insights and summaries
• Transcribing voice messages and video audio using AI transcription
• Authenticating your account and managing your credits
• Saving analysis results to your dashboard (only when you choose to)
• Improving the service based on anonymous usage patterns
• Answering follow-up questions about your analysis results via AI Chat
• Exporting analysis results to connected third-party services at your request

We do not sell, rent, or share your personal information with third parties for marketing purposes.

We implement industry-standard security measures:

• All data transmission uses TLS/SSL encryption
• Saved chat content is encrypted at rest in the database
• Saved analysis results are encrypted at rest in the database
• Authentication is handled by Clerk, a dedicated identity provider
• We regularly audit our systems for security vulnerabilities
• Private audio and export files are served only through authenticated application endpoints

We use the following third-party services:

• AI Analysis (Anthropic): We use Claude by Anthropic to analyze your chat content. The content is sent securely for processing.
• Transcription (OpenAI): Selected voice messages and audio tracks your browser extracts from selected videos are transcribed using OpenAI's audio transcription API. Only audio is sent securely; the video file and visual content stay on your device.
• Authentication (Clerk): Account creation and login are handled by Clerk, which manages your credentials securely.
• Payments (Stripe): Credit purchases are processed by Stripe. We never see or store your full payment details.
• Payments in the Android app (Google Play): In-app credit purchases are processed by Google Play, which is the seller of record for them. We receive a purchase receipt and the amount charged, never your payment details.
• Hosting (Vercel): Our service is hosted on Vercel with data centers that comply with industry security standards.
• Private Object Storage (Cloudflare R2): Audio, exports, and job files are stored privately in Cloudflare R2. We do not publish a public bucket or permanent public URLs for these files.
• Analytics: We use Vercel Analytics to understand usage patterns. This data is anonymized.
• Integrations (Notion, Google Calendar, Trello): Data is exported to these services only when you initiate it. OAuth tokens are stored encrypted. Once exported, your data is governed by each service's own privacy policy.
• Email (Resend): Transactional emails (welcome, analysis complete, etc.) are sent via Resend. We do not send marketing emails without your explicit consent.

The ThreadRecap app for Android handles some things differently from the website, because a phone can do work a browser cannot:

• Conversations you share into the app: When you share a WhatsApp export to ThreadRecap, the archive is opened, read and redacted on your phone. Photos and videos are never uploaded. Only the text needed for the analysis, and the voice-message audio you chose to include, is sent to our servers — the same rule the website follows. If you select a video, your browser extracts and sends only its audio track for transcription; the video and its visual content stay on your device.
• Your contacts (never collected): If you allow it, the app reads your address book to put names to phone numbers in a conversation. That comparison happens entirely on your phone. No contact name, phone number or any other address-book field is ever sent to our servers, to our AI providers, or to anyone else, and we keep no copy of it. Turn the permission off and the app keeps working; the participants simply stay as the export wrote them.
• Files kept on your phone: The app can keep its own copy of an export so a conversation can be re-opened after the sending app releases the file. Those copies live only on your phone, are listed in the app's storage screen, and are deleted when you delete them or uninstall the app.
• Purchases through Google Play: Credits bought inside the app are sold and charged by Google Play. We never see or store your payment details. Google gives the app a purchase receipt, and the app sends that receipt to us so the credits can be added to your account. Along with it we receive the product bought, the price Google charged and its currency, which we store as the record of the sale.
• Diagnostics: The app reports errors and crashes so faults can be found and fixed, and the same limited usage telemetry the website collects. Neither carries conversation content or contact data.
• Deleting your account from the app: The app has a direct account-deletion entry in the profile screen, and it deletes the same things the website does. See the account deletion page for what is removed and what is retained.

We retain minimal data for the shortest time necessary:

• Voice-message audio is stored with the recap it belongs to, and is deleted when you delete the audio, the recap, or your account
• Unsaved analysis results exist only in your browser session
• Saved analyses and chat text are stored in your account until you delete them
• Account data is retained until you request deletion
• After you explicitly confirm deletion of a recap or account, it is immediate and irreversible. We remove stored recap content, messages, audio, documents, exports, and job files. If object storage is temporarily unavailable, we retain an encrypted deletion request and retry until the storage service confirms deletion.
• We retain financial transaction records and limited operational telemetry only as necessary for accounting, fraud prevention, security, and service operations. These records are not used to restore your recap or chat content.
• Integration tokens are deleted immediately when you disconnect a service or delete your account

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent for data processing
• Export your data in a portable format

To exercise any of these rights, please contact us at support@threadrecap.com.

We may update this privacy policy from time to time. We will notify you of any significant changes by posting a notice on our website or sending you an email (if you have an account).

Your continued use of ThreadRecap after changes are posted constitutes acceptance of the updated policy.