Privacy policy

Upthread is operated by [legal entity name and address]. Questions about this policy go to [email protected].

• Account. Your name, email address and a hash of your password, or your basic Google profile if you sign in with Google. A session cookie keeps you signed in.
• Workspace and brand settings. Your website address and the pages we read from it during setup, your brand profile, competitors, keywords, buyer questions, subreddits, voice settings, any writing samples you add, and your disclosure text.
• Product data. Threads in Discover and their scores, your drafts, the replies you post (their link, text and time), dated snapshots of each reply's score and status, and your tracked redirect links, if you use them.
• Link clicks. Links in drafts go straight to your site, so we don't see those clicks. If you turn on tracked redirect links and someone clicks one, we log a hashed IP address, the user agent, the referrer, the country and whether it looks like a bot. We don't store the raw IP address.
• Billing. Dodo Payments sells our paid plans as merchant of record and processes the payments. We store your Dodo Payments customer and subscription ids, the email we gave Dodo Payments for the workspace (its owner's), your plan, its status and billing period, and a record of each billing notice Dodo Payments sends us (its id, type and what we did with it). Your payment details stay with Dodo Payments: we never see full card numbers and keep no card details.
• Logs. Technical logs of errors and background jobs. They never contain passwords, tokens or API keys.

The extension works only on reddit.com pages you open and on the Upthread app. It asks for the sidePanel, storage and alarms permissions plus host access to those two sites, and nothing else. It does not request access to all sites, your cookies, your history, your tabs or your network requests.

• It downloads hashed links (SHA-256) of your open opportunities, up to the latest 2,000, and hashed names of your subreddits, and matches the page you're on against them on your device.
• On a thread page, it sends page content only when the thread is already in Discover or you click Add to Discover: the post, its top comments and the subreddit's rules.
• When you open the rules, sidebar or wiki page of one of your subreddits (your focus subreddits and those with open threads, matched by hash on your device), it sends that page's rules and text.
• When you post a reply, it sends the reply's link, id, text and time.
• When you open your Reddit inbox, it sends only the replies to your own tracked comments and moderator messages about them: the author, the text, the score and the time.
• When you open your own Reddit profile, it sends your username, karma and account age. It never sends anyone else's profile.
• When you view a thread with one of your tracked replies, or your own profile, it sends that reply's score, reply count and whether it is visible, removed or deleted.
• The daily check is off by default. If you turn it on, the extension looks at up to 25 of your own tracked replies a day, logged out and without cookies, one at a time and at least 10 seconds apart.
• Your connection token is stored in the extension's local storage. We keep only a hash of it, and you can revoke it at any time.

It never sends pages that don't match your workspace's threads and subreddits, your browsing history, your cookies, or anything from other sites. More detail on the extension page.

• Our servers never request reddit.com.
• From search data providers we use thread URLs, titles, snippets and ranks only. We never buy Reddit post text from a data vendor.
• Thread text that you capture with the extension or paste (post body, comments and rules) is deleted after 30 days. We keep the URL, title and subreddit, and what we derived from them: scores, angles and your drafts.
• Captured comments can include other Reddit users' usernames and words. We use them only to score the thread and draft your reply, and they are deleted with the rest after 30 days.
• Text from subreddit rules, sidebar and wiki pages you open is deleted after 30 days. We keep our summary of the rules.
• Mentions of your brand: we keep Google's title and snippet for each Reddit result, like other search data. The excerpt we keep from a thread you capture, the sentence that names your brand, is deleted after 30 days.
• Replies to your tracked comments: the author and text are deleted after 30 days. The score and flags stay.
• Your own Reddit profile details are deleted 30 days after the extension last read them.
• Buyers ask summaries quote short phrases from Reddit threads. Each summary is deleted 30 days after it is made.
• We don't use Reddit content, or your data, to train AI models.

To score threads and draft replies, we send the thread text you captured, your brand facts and your settings to the LLM provider configured for the service. To check AI visibility, we send your buyer questions to the answer engines you track. These providers process the data under their API terms. [confirm each provider's data retention terms]

• Captured Reddit text: 30 days.
• Account and workspace data: while your account is open. After you ask us to delete it, within [number of days].
• Records of billing notices from Dodo Payments (their ids, type and what we did with each): 180 days.
• Database backups: taken nightly and kept for 14 days, so deleted data can remain in a backup for up to 14 days.
• Link click logs: [retention period to be decided].

We use one essential session cookie to keep you signed in. Your theme preference is stored in your browser. We don't use advertising cookies or third-party analytics.

Traffic is encrypted in transit. Slack webhook addresses are encrypted at rest with AES-256-GCM. Extension tokens are stored only as hashes. Every request is checked against the workspace it belongs to.

You can see, correct, export or delete your data by writing to [email protected]. You can turn off the daily check, disconnect the extension and revoke shared report links at any time. [region-specific rights (GDPR, UK GDPR, CCPA) to be completed in legal review]

We will post changes on this page and email workspace owners about material ones before they take effect.