Threadlane privacy policy
Last updated: 2026-10-05

Threadlane adds annotations and a message queue to ChatGPT, Claude, and Gemini.

Information used
The extension reads supported conversation page content, conversation and message identifiers, composer contents, and send/response state to attach notes and deliver queued messages. Saved notes include the selected quote, comment, nearby text needed to locate a highlight, a short message excerpt, identifiers, and a timestamp. Queued messages include text, order, pause state, identifiers, and delivery/edit coordination state.

It does not collect general browsing history, passwords, authentication cookies, payment details, or account profiles. Notes and messages may contain personal information you choose to include. The extension does not run on unrelated websites.

Local storage and sharing
Notes and queues are stored in extension-owned IndexedDB databases in your current browser profile. They are shared between tabs of the same conversation in that profile but do not sync to other browsers, profiles, or devices. There is no publisher-operated cloud storage, analytics, advertising, or telemetry. Notes and queue contents are not sent to the publisher.

Older versions stored notes in the supported site’s local storage. Threadlane imports these into its own database and removes the old local copy only after a successful import. If import fails, the original remains for a later retry.

When you choose Insert, annotation text enters the provider’s native composer. Queued messages send through the same composer to OpenAI for ChatGPT, Anthropic for Claude, or Google for Gemini. The provider’s terms and privacy policy govern that submitted content. Threadlane does not call a separate AI API. Automatic sending in this release requires a visible supported conversation and a ready, empty composer. Required Firefox data permissions declare personal communications and website content because these features can submit your text and selected quotes to the chosen provider. They do not enable publisher telemetry. Private browsing is not supported.

Extension updates
This Firefox store release receives updates through Mozilla. The separate self-distributed Firefox beta uses Firefox’s built-in updater to check a public HTTPS update feed and download Mozilla-signed packages hosted on GitHub. Update hosts receive ordinary connection information, including IP addresses and request metadata, under their own privacy policies. Threadlane does not attach conversation text, notes, queued messages, account credentials, or tracking identifiers to update requests. Public feed and packages contain no saved user data.

Retention and deletion
Notes remain until you delete them. Inserting or sending does not delete notes. Queued text remains while pending, uncertain, or awaiting its response and is removed from the active queue after completion or explicit deletion. Up to 20 recently edited, retired messages per conversation may remain as recovery records until replaced or extension storage is cleared. Non-content identifiers and deletion records may remain to prevent duplicate sends or reimporting deleted notes.

You can edit or delete notes and pending queue items in the interface. This does not delete messages already submitted to a provider. Clearing extension storage or uninstalling removes local databases. Unimported legacy copies remain in the relevant site’s storage until imported or that site’s storage is cleared. There is no built-in export or cloud backup.

Limited use and security
Conversation data is used only for annotation and queue features. Threadlane does not sell user data, use it for advertising or credit decisions, or provide it for unrelated purposes. No remote executable code is loaded.

Stored notes and queue records are encrypted with AES-256-GCM, using a fresh random initialization value for each write. Locally generated non-extractable CryptoKeys persist in extension databases. Security depends on the active browser profile, device, and extension code; this does not protect against their compromise. Plaintext is used in memory, the interface, and messages submitted to providers. There is no password or server-based key recovery. Missing keys or authentication failures preserve records and report an error instead of silently resetting data. Older plaintext records migrate only after their encrypted replacement is durably saved and verified. Deleting records does not guarantee secure erasure from database free space, backups, or copies outside the extension.

Contact
For privacy or support questions, email threadlane.support@gmail.com. Support emails are received through Gmail and used to respond; avoid private conversation text unless needed. This policy will be updated when data practices change. Additional policy information: https://gist.github.com/ahmed-ela/5ce1f17c643c3daaa4bc983e7b0a81bf