Your privacy, in plain terms

Who we are

Thred is provided by Naustec Ltd, a company registered in the United Kingdom. We're the "data controller" for the personal information described in this policy: the organisation responsible for deciding how and why it's used.

• —Registered office: Brunel House, Stephenson Road, Basingstoke, England, RG21 6XR
• —ICO registration number: ZC218761
• —Privacy contact: [email protected]

Why we're telling you all this

Thred exists to help you reflect between therapy sessions, which means the information you share with it is often more personal than what a typical app collects. We think that means you deserve more clarity about your data, not less. This policy is written to actually be read, not just filed away.

The information we collect

Depending on how you use Thred, we collect:

• —Your voice recordings and written entries: what you record or type is sent for transcription (voice only) and analysis. Audio is deleted automatically once it's been transcribed and analysed; we don't keep a copy.
• —The transcript and AI-generated reflection: themes, emotional tone, a notable moment, and the emotion you named before recording, so we can show it back to you and build your weekly/monthly summaries.
• —People you mention: Thred tracks recurring people in your entries (e.g. "my sister") so it can reflect on your relationships over time, if you confirm them.
• —Account information: your email address and, if you choose to give it, your first name.
• —How you found Thred: if you arrive through one of our campaign links (for example from one of our Instagram posts or a postcard), we note which campaign and channel it was. If you arrive any other way, we note only the name of the website that sent you (for example instagram.com or google.com), or that there wasn't one. We never record the full address of the page you came from, or anything you searched for. This is saved to your account when you first sign in.
• —Basic usage data: pseudonymous product-analytics events (e.g. "a recording was completed") via TelemetryDeck, which is designed so that even TelemetryDeck cannot trace an event back to you. See Cookies and similar technologies below.
• —Visits to our public pages: only if you allow it on the banner, Google Analytics records which of our public pages you view (the homepage, feature pages, About, Pricing and our policies), the page that sent you, and general browser and device details, linked to a random identifier in a cookie. It never runs once you're signed in, inside the app, or on a shared summary.

Why some of this is 'special category' data

Information about your mental or emotional state (which is most of what Thred processes) is treated by UK data protection law as special category data, the same higher standard applied to health information. We only process it because you give us your explicit consent to do so, which we ask for clearly when you create your account (and which you can withdraw at any time; see Your rights below).

How we use your information

• —To transcribe (voice only) and analyse your entries, and generate your reflections.
• —To track recurring people and themes across your entries, so reflections get more specific over time.
• —To build the weekly, two-week, and monthly summaries you can view in the app.
• —To let you share a summary with your therapist, only when you choose to.
• —To detect language suggesting you may be in distress, so we can show you the right support resources; see Automatic analysis and crisis support below.
• —To send account-related emails (e.g. reminders), and to keep the service secure and working.
• —To understand product usage in aggregate, so we can improve Thred, never to build an advertising profile of you; we don't do advertising.
• —To count visits to our public pages, if you allow it, so we know which ones people find useful.
• —To see which of our outreach (social posts, campaigns, partners) brings people to Thred, so we can focus on what actually helps people find us. We look at this mostly as totals per channel, and it never affects how Thred works for you.

Our legal basis for using it

UK GDPR requires us to have a specific legal reason for each way we use your data:

• —Contract: processing needed to actually provide Thred to you (transcription, analysis, summaries).
• —Explicit consent: for the special category (mental health) data itself, given at signup and withdrawable at any time.
• —Consent: for Google Analytics on our public pages, which only runs if you accept it and which you can turn off at any time from our Cookie Policy.
• —Legitimate interests: for basic security, fraud prevention, aggregate/pseudonymous product analytics, and understanding how people find Thred, balanced against your right to privacy.

Who we share it with

We use a small number of specialist providers to run Thred. Each only processes what they need to do their specific job, under a data processing agreement:

• —Supabase: our database, authentication, and file storage, hosted in the UK/EU.
• —Google Cloud (Vertex AI): transcribes voice recordings and generates your AI reflection. See Where your data is processed below.
• —Resend: sends account-related emails (e.g. sign-in links, reminders).
• —TelemetryDeck: pseudonymous, EU-hosted product analytics.
• —Google (Google Analytics): counts visits to our public pages, only if you allow it. Google acts as our processor under its data processing terms, with Google signals and ad personalisation switched off, so this data isn't used for advertising. See Where your data is processed below.
• —Cloudflare: hosts and delivers the Thred web app.

Your approximate country: when you open Thred, Cloudflare, which already delivers the app to you, tells us which country your connection is coming from. We use it only to show you the right local support numbers, and we save it on your account so it's ready if you ever need them. No other company receives your IP address for this, and we don't save your IP address with your account or your recordings.

Your therapist is not a service provider of ours. If you generate a share link, you're choosing to send them a structured summary directly. They never receive your raw recordings or transcripts, and we don't hold a data-sharing agreement with them because it's your share, not ours.

We never sell your data, and we never use your recordings or reflections to train AI models for any purpose beyond generating your own reflection.

Where your data is processed

Your account data, recordings, and reflections are stored on servers in the UK/EU via Supabase. Transcription and AI analysis, however, are performed by Google Cloud's Vertex AI in the United States. This is a genuine international transfer of your data, and we want to be upfront about it rather than imply everything stays in the UK/EU. It's covered by Google's standard Data Processing Addendum, which incorporates the UK's International Data Transfer Addendum as a legal safeguard for this kind of transfer. Resend (our email provider) is also US-based and covered the same way.

If you allow Google Analytics on our public pages, that visit data is also processed by Google in the United States, under Google's data processing terms for Google Analytics, which include the same UK transfer safeguard. It's kept for two months, then deleted.

How long we keep it

We keep your data for as long as your account is active, plus one year of inactivity. If you haven't used Thred in 365 days, we'll email you to let you know your account will be deleted in 30 days unless you return. After that grace period, your account and all associated data are permanently deleted. You can also delete your account immediately at any time from Settings; see Your rights.

Keeping it safe

• —Data is encrypted in transit and at rest.
• —Your app-lock PIN is stored as a one-way hash; we never store it, or could recover it, in plain text.
• —Every user's data is isolated at the database level, so one account can never read another's.
• —No Naustec staff member reviews or has routine access to your recordings, transcripts, or reflections; they're processed automatically.

Automatic analysis and crisis support

Thred's AI looks for language suggesting elevated distress or crisis and, if it finds any, shows you country-specific support resources (helplines, emergency numbers). To choose them, we use the approximate country saved on your account (see Who we share it with). That's the only thing this detection does: it doesn't notify anyone, restrict your account, or take any other action, and it's never reviewed by a person unless you choose to share it.

If you're under 18

Thred can be used from age 13, in line with UK data protection law, because we want younger people to be able to reach reflection and support tools too. If you're under 18, we take extra care: we don't build advertising profiles of you (we don't do advertising at all), we only collect what's needed to run the service, and we'd encourage involving a parent, guardian, or another trusted adult, especially if anything you're going through feels heavy or urgent.

Cookies and similar technologies

The Thred app doesn't use traditional browser cookies. Our public pages use Google Analytics cookies, only if you accept them. The app does use your device's local storage for things like keeping you signed in, remembering your app-lock preference, and caching your approximate country (used only to show the right local crisis line, if needed). It also briefly holds how you found Thred, described above, until you first sign in. Our Cookie Policy covers this in full detail, including what's essential versus optional and how to control it: read the Cookie Policy.

Your rights

Under UK GDPR, you have the right to:

• —Access the personal data we hold about you.
• —Correct anything that's inaccurate or incomplete.
• —Delete your account and all associated data. Do this any time from Settings, no questions asked.
• —Export your data in a portable format (also available from Settings).
• —Withdraw consent at any time, which will stop future processing and prompt account deletion (since consent is what makes the service possible in the first place).
• —Object to or restrict certain processing, e.g. the aggregate product analytics, or our record of how you found Thred, which we'll remove from your account if you ask.
• —Complain to the ICO, the UK's data protection regulator, if you think we've got something wrong: ico.org.uk or 0303 123 1113. We'd genuinely rather you came to us first at [email protected] so we can put it right, but this right is yours regardless.

Changes to this policy

If we make a material change to how we handle your data, we'll let you know, by email or an in-app notice, before it takes effect, not just by quietly updating this page.

Contact us

Questions, requests, or concerns about your data: [email protected].