Cookies and similar technologies

The short version

The Thred app doesn't use traditional browser cookies. Instead it uses your browser's local storage and session storage, which work similarly: small pieces of data kept on your device rather than sent to us automatically with every request. The UK's data protection regulator (the ICO) treats these "similar technologies" the same way it treats cookies, so we're covering them here with the same level of detail a cookie policy would normally give.

The only cookies we use are Google Analytics cookies on our public pages (the homepage, the pages about Thred's features, About, Pricing and our policies), and only if you say yes. They never run inside the app or on a summary someone has shared with their therapist.

Strictly necessary

These are the ones that make Thred work at all. Under UK rules, strictly necessary storage doesn't require your prior consent, but we're listing it in full anyway:

• —Signed-in session (managed by our backend provider, Supabase): keeps you signed in between visits. Persists on your device until you sign out or the session expires.
• —App-lock unlock state (app_unlocked_this_session): remembers that you've entered your PIN for the current browser session, so you're not asked again on every screen. Cleared when you close your browser.
• —Pending consent record (thred_pending_data_consent): if you give consent during signup before your account technically exists yet, this briefly holds that choice until it's saved to your account. Removed once that happens.
• —Crisis support banner timing (thred_show_support_banner): if an entry triggers our crisis-language detection, this keeps the right local support number visible on screen for a few minutes afterwards. Used for up to 5 minutes, cleared when you close your browser.
• —Approximate country cache (thred_geo_country): caches your approximate country for your browsing session, so we can show the correct local crisis line without re-detecting it on every screen. Cleared when you close your browser.
• —Country saved for this session (thred_country_saved): notes that your approximate country has already been saved on your account this session, so the app doesn't save it again on every screen. Cleared when you close your browser.
• —Duplicate-request guard (reanalysis_swept_v1): a technical flag that stops a background maintenance check from running more than once per session. Cleared when you close your browser.
• —Analytics consent choice (thred_analytics_consent): remembers whether you've accepted or declined analytics (see below), so we don't ask you every time. Persists on your device until you clear your browser data or change your answer.
• —Public pages analytics choice (thred_marketing_analytics_consent): remembers whether you've accepted or declined Google Analytics on our public pages (see below). Persists on your device until you clear your browser data or change your answer.

Functional

These make the experience smoother but aren't essential to the service working. We treat them as low-risk and don't gate them behind a consent prompt, in line with common practice for this category, but you're free to clear them at any time (see below):

• —Install prompt state (thred_install_prompt, thred_visit_count): remembers whether you've dismissed the "add Thred to your home screen" prompt, and roughly how many times you've visited, so we don't show it repeatedly. Persists on your device until you clear your browser data.

How you found Thred

When you visit our homepage without being signed in, we keep a note of how you got there, so we can tell which of our outreach brings people to Thred:

• —Arrival source (thred_pending_acquisition): the campaign link you arrived through, if any (for example a link in one of our Instagram posts). Otherwise, only the name of the website that sent you (such as instagram.com), or a note that there wasn't one. It never holds the full address of the page you came from or anything you searched for. When you first sign in, it's saved to your account and removed from your device. If you never sign in, it stays on your device until you clear your browser data, and it's never sent to us.

Once it's part of your account, it's covered by our Privacy Policy: it's used to see which channels bring people to Thred, isn't shared with anyone, and is deleted along with your account. If you'd rather we didn't keep it, email [email protected] and we'll remove it.

Analytics in the app

We use TelemetryDeck, a privacy-focused, EU-hosted analytics provider, to understand basic product usage (for example, that a recording was completed) in aggregate. It only activates once you're signed in, not while you're browsing anonymously. Your identifier is hashed on your device before it's sent, then hashed again on TelemetryDeck's servers with their own separate key, which is designed so that neither we nor TelemetryDeck can trace an event back to a specific person. We never use it for advertising.

We ask your permission for this. The first time you sign in, we ask whether you're happy with this via a small banner, and analytics only activates if you accept. Declining, or not answering at all, keeps it off.

Analytics on our public pages

To count how many people visit our public pages, and which ones, we use Google Analytics, run by Google. It only runs if you accept it on the small banner those pages show you. Declining, or not answering at all, keeps it off, and nothing is loaded from Google. It never runs once you're signed in, inside the app, on the sign-in and sign-up pages, or on a summary someone has shared with their therapist.

If you accept, Google Analytics receives the address of each public page you view (without anything after a "?" in it), the page that sent you there, and general details about your browser and device. Google uses your IP address to estimate a broad location and doesn't keep it. We've switched off Google signals and ad personalisation, our Google Analytics account isn't linked to any advertising service, and visit data is kept for two months. It sets these cookies:

• —Visitor identifier (_ga): a random number that lets Google Analytics tell one visitor's page views from another's, without knowing who you are. Lasts up to 2 years.
• —Visit state (_ga_10YKBBE3SR): keeps track of your current visit, so page views in the same visit are counted together. Lasts up to 2 years.

You haven't chosen yet, so Google Analytics is off. Turn it off

How to control this yourself

Every browser lets you view, block, or clear cookies, local storage and session storage for a website, usually from its site settings or privacy settings. If you clear Thred's storage, you'll be signed out, the app-lock unlock state will reset, country detection for crisis resources will re-run on your next visit, and any arrival source not yet saved to an account is removed. None of this deletes your account or the data held on our servers, which is covered separately in our Privacy Policy.

Signing out of Thred ends your session but doesn't automatically clear every item listed above (for example, the install-prompt or visit-count entries stick around, since they're tied to your device, not your account). Clearing your browser's site data is the way to remove everything at once.

Changes to this policy

If what we store changes in a way that matters, we'll update this page and, for anything significant, let you know directly rather than only updating quietly here.

Contact us

Questions about this policy, or want us to exclude your account from analytics: [email protected].