Privacy policy

Last updated 24 August 2026

Who runs ThreadNotes

ThreadNotes is a personal project, built and run by one person in the United Kingdom. It is not a registered company.

For UK data protection purposes that person is the data controller for the personal data described here. If you need their name — to make a formal data protection request, or to raise a complaint — email support@threadnotes.co.uk and we will provide it.

For anything else, that address is the fastest way to reach us.

What this policy covers

This policy covers two separate things:

• This website (www.threadnotes.co.uk) — the marketing pages you are reading now.
• The ThreadNotes app — the workspaces and notes product, which is not yet open. Accounts cannot currently be created.

Where the two differ, we say so.

What this website collects

This website sets no cookies, uses no analytics, and stores nothing in your browser. There are no tracking pixels, no advertising tags and no third-party scripts beyond the one described below.

Two things still happen automatically whenever you load any website, including this one:

• Hosting logs. The site is served by Google Firebase Hosting, which records standard request information such as your IP address, the page requested, and your browser type. We do not use these logs to identify or profile anyone.
• Google Fonts. Typefaces are loaded from Google's servers (fonts.googleapis.com and fonts.gstatic.com). Your browser contacts Google to fetch them, which means Google receives your IP address. Google states it does not use Google Fonts requests to build advertising profiles.

What the app will collect

When accounts open, using ThreadNotes will involve:

• Your email address, so you can sign in and we can contact you about your account. Passwords are handled by Firebase Authentication and are stored hashed — we never see or store your password.
• A display name, if you choose to set one. This is shown to other members of any workspace you join.
• Your notes and workspaces — the content you write, the folders you create, the links between notes, and who each note is shared with.
• Basic usage records such as when a note was last edited and by whom, which is what makes real-time collaboration and permissions work.

We do not ask for your postal address, telephone number, date of birth, or any demographic information, and we do not process payments.

Why we use it

Under UK GDPR we rely on the following lawful bases:

• Performance of a contract — to give you an account, store your notes, and share them with the people you choose.
• Legitimate interests — to keep the service secure, prevent abuse, diagnose faults, and respond when you contact support.
• Legal obligation — where we are required to retain or disclose information by law.

We do not sell your data, we do not share it with advertisers, and we do not use your notes to train machine-learning models.

Who we share it with

We use a small number of service providers who process data on our behalf:

• Google (Firebase) — authentication, database storage and website hosting. Google acts as our processor under its data processing terms.

Beyond that, we share personal data only where we are legally required to, or where it is necessary to protect the rights and safety of users.

Note that anything you put in a shared workspace is visible to the other members of that workspace, subject to the per-note permissions you set. That sharing is a feature of the product, not a disclosure by us.

Where your data is stored

Our Firebase databases are configured in Google's europe-west1 region (Belgium). Google may nonetheless process some data — particularly authentication and operational logging — outside the UK and EEA. Where that happens, Google relies on safeguards such as Standard Contractual Clauses and the UK International Data Transfer Addendum.

How long we keep it

• Account data and notes are kept for as long as your account exists.
• If you delete your account, we delete the personal data associated with it. Notes you contributed to a shared workspace may remain visible to that workspace, because they form part of other people's records.
• Hosting logs are retained by Google according to its own retention schedule, which is measured in months rather than years.
• Support emails are kept for up to two years.

Your rights

Under UK GDPR you have the right to:

• ask what personal data we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• ask us to restrict or stop certain processing;
• receive your data in a portable format;
• object to processing carried out on the basis of legitimate interests.

Email support@threadnotes.co.uk and we will respond within one month. Your notes are stored as plain text with Markdown formatting, so an export is straightforward.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Children

ThreadNotes is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will remove it.

Security

Access to notes is enforced by per-note permissions and server-side security rules, traffic is served over HTTPS, and passwords are hashed by Firebase Authentication. No service can promise perfect security, and ThreadNotes is beta software — please do not store anything in it that would cause you serious harm if it were lost or exposed.

Changes to this policy

If we change this policy we will update the date at the top of this page. If the change is significant, and we hold an email address for you, we will tell you directly.

Contact us

Questions, requests or complaints: support@threadnotes.co.uk.