Threadbase privacy

Privacy Policy

Threadbase is a thin client for the Claude Code sessions you run on your own computer, reached through a Threadbase streamer instance that you operate. Threadbase is local-first by design: your prompts, session content, and credentials stay on your device and on the streamers you configure.

This policy describes the specific, limited cases in which data leaves your device, and the controls you have over each.

The kinds of network traffic Threadbase uses

Threadbase separates its traffic into six distinct categories. Each is described in its own section below.

1. Core traffic to your streamers — the app's normal function.
2. Push-notification delivery — optional notifications, including iOS Live Activities.
3. Crash reporting (Sentry) — automatic reporting is off by default and opt-in; a single crash can also be reported manually at any time.
4. User-initiated feedback submissions — only when you send feedback.
5. Optional screenshots or diagnostics you explicitly select — only when you choose to include them.
6. Newsletter subscription (MailerLite) — only when you opt in on the website.

1. Core traffic to your streamers

Threadbase connects only to the streamer URLs you configure. Session content, prompts, provider metadata, file attachments you send, and status events go solely to those streamers. Threadbase does not route this traffic through any Threadbase-operated server, and it does not copy it anywhere else. Your API keys and server credentials are stored on your device (in the iOS Keychain / Android Keystore) and are used only to authenticate to your own streamers.

2. Push-notification delivery

If you enable notifications, Threadbase registers a push token with each streamer you have paired, so that streamer can notify you when a session needs attention. The token itself is an opaque delivery address and does not contain your session content. Removing a server in Settings deletes its credentials from your device, and recent app versions also ask that streamer to delete its push token — though not if the streamer is unreachable at that moment; to be certain, go to Paired devices in Settings and revoke the device — that deletes the token immediately. Threadbase uses two delivery paths. Ordinary notifications — for example, a session waiting for your input — are delivered through Expo's push relay. That payload carries the project name, which may identify the repository or project, a fixed message, and the session and server identifiers the app needs to open the right screen — the server identifier defaults to that streamer's hostname unless a custom instance ID is configured; it does not include prompts, terminal output, credentials, or conversation content. Live Activities — the iOS lock-screen and Dynamic Island session status — are sent directly to Apple's push service (api.push.apple.com) by a streamer configured with Apple push credentials, which Apple issues per developer team. The Live Activity payload carries the session status, the project name, a title derived from your first message in that session, the session's start time, a server label that also defaults to the streamer's hostname, and a short, truncated excerpt of recent terminal output. The prompt-derived title and terminal excerpt can contain content from the session, including sensitive text that appeared there.

3. Optional crash reporting (Sentry)

Threadbase includes optional crash reporting to help diagnose defects, sent through two paths:

• Automatic reporting. Disabled by default and opt-in. Nothing is sent automatically unless you turn on "Share anonymous crash reports" in Settings -> Crash Reporting. Once enabled, future crashes are sent automatically until you turn it off again.
• Manual, one-time report. If the app crashes, the recovery screen offers a "Report this crash" button. Tapping it sends that single crash report even if automatic reporting is off. This is a deliberate action you take, not something the app does on its own. It does not turn on automatic reporting; after sending, the app may ask once whether you'd like to turn automatic reporting on going forward, and remembers your answer so it does not ask again.

Automatic and manual JavaScript crash reports use the same in-app sanitization path described below. Native iOS and Android crashes are captured by the platform crash handler and may contain different native diagnostic data; server-side Sentry scrubbing is configured for that path.

• Service provider. Crash reports are processed by Sentry, a third-party error-monitoring service, under Sentry's own terms and data-processing agreements.
• What is sent. Only sanitized technical information: the app version and build number, the platform (iOS or Android), the operating-system major/minor version, the JavaScript engine, the release channel or environment, the Expo runtime version, the EAS update identifier, a generic connection-mode category (local, remote, or unknown), and the type, message, and stack trace of the error. Reports also include an anonymous, randomly generated installation identifier used only to group reports; it is not tied to your identity, your device's advertising identifier, or your streamer credentials.
• What is excluded. JavaScript crash reports do not intentionally include prompts, terminal output, source code, file contents, credentials, authentication tokens, server addresses, hostnames, IP addresses, repository names or paths, session names or content, or your device name. A sanitization step runs in the app on every JavaScript report it sends, and anything that cannot be confidently sanitized is dropped rather than sent. Native crashes captured by the underlying iOS or Android platform layer are transmitted by that platform's own crash handler and may contain native diagnostic data outside the JavaScript allowlist; server-side Sentry scrubbing rules are configured for that path, including the exclusion of IP addresses.
• A note on absolutes. We design crash reporting to exclude the categories above, and we apply sanitization before sending. We cannot, however, describe unexpected behavior in the underlying SDK or platform as an absolute impossibility, which is why crash reporting is opt-in and off by default.
• Your control. You can enable or disable crash reporting at any time in Settings. Disabling it stops future reporting immediately and deletes the anonymous installation identifier from your device.
• Previously submitted reports. Reports already sent before you disable crash reporting remain in Sentry subject to the retention below; disabling does not retroactively delete them.
• Retention. Crash reports are retained according to the configured Sentry project retention (by default, 90 days) and then deleted.
• Deletion requests. To request deletion of reports associated with your anonymous installation identifier where feasible, contact support@threadbase.sh.
• Processing location. Crash reports are processed by Sentry in the European Union. If you use Threadbase from outside the EU, your crash report is transmitted to and stored in the EU.

4. User-initiated feedback submissions

The Help & Feedback screen lets you send a bug report, feature request, or general feedback. This is always a deliberate action you initiate; Threadbase never sends feedback on its own.

• What is sent. The description you type, an optional reply email address if you provide one, and only if you leave the "Include technical diagnostics" option enabled, the same category of sanitized technical metadata described for diagnostics below. Before you submit, the screen shows you exactly what will be included.
• How it is sent. Feedback is delivered through the first available of: a configured feedback endpoint, the Sentry User Feedback channel when the build has Sentry configured, your device's email app, or a copy-to-clipboard option you can paste into the Threadbase feedback page. Tapping Send is explicit consent for that one submission and may use Sentry even when automatic crash reporting is off; it does not enable automatic reporting. Feedback works whether or not crash reporting is enabled.
• Optional email. If you provide a reply email, it is stored with your feedback so we can respond. Leaving it blank keeps your submission anonymous.
• Retention. Feedback submitted through Sentry is retained for the same period as crash reports (by default, 90 days) and then deleted. Feedback you send by email is kept until your request is resolved.
• What is excluded. As with crash reports, feedback does not intentionally include prompts, terminal output, source code, credentials, server addresses, or session content.

5. Optional screenshots and diagnostics you select

• Screenshots. Threadbase never captures your screen automatically. If you attach a screenshot to feedback, you select it explicitly from your photo library, you can preview and remove it, and it is submitted exactly as you selected it. Attached screenshots are re-encoded to strip embedded metadata (such as location) and are size-limited. Screenshots are used only to deliver the feedback you submit and are not retained beyond what is necessary for that submission and its handling.
• Diagnostics. You can copy or export a diagnostics report from the app. It contains only the sanitized technical metadata categories described above, never prompts, terminal output, credentials, server addresses, session content, or your device name. You control whether it is copied or submitted.

Screenshots and manually entered feedback may contain content you choose to include. Please review anything you attach before submitting.

6. Newsletter subscription (MailerLite)

The Threadbase website offers an opt-in email newsletter for product news and updates. This is separate from the mobile app and only applies if you subscribe on the website. If you do, the email address you provide (and your name, if you choose to give one) is sent to MailerLite, our email service provider, which processes it under its own terms and data-processing agreements to send you the newsletter and manage your subscription, including confirmation and unsubscribe. Subscribing requires an explicit, unchecked consent checkbox — there is no pre-ticked opt-in. Every newsletter email includes an unsubscribe link; unsubscribing stops future emails and removes you from the list.

What stays on your device

• Your prompts and draft prompts.
• Claude Code, Codex, and other agent conversation content.
• Terminal output and session content, apart from the prompt-derived title and truncated terminal excerpt an iOS Live Activity carries, described in section 2.
• Your streamer URLs, API keys, and pairing credentials (in the iOS Keychain / Android Keystore).
• Your session names, favorites, and app settings.

Uninstalling the app removes the Threadbase data stored in the app's own container. Some credentials held by the operating system's secure credential storage — such as the iOS Keychain — can survive an uninstall and be restored if you reinstall; to delete a server's credentials, remove that server inside the app first. Crash reports or feedback you submitted before uninstalling are not stored on your device and are governed by the retention terms above.

What we do not collect

Threadbase does not use advertising, tracking, fingerprinting, or behavioral telemetry. It does not include a product-analytics SDK. It does not automatically capture your screen, console output, or network requests. The only data that leaves your device is the core streamer traffic you direct, the optional push-notification token, and only with your action or opt-in consent, the crash reports, feedback, screenshots, diagnostics, and newsletter subscription described above. Separately, when Live Activities are enabled, the streamer sends the prompt-derived title and terminal excerpt described in section 2 to Apple's push service; that data travels from your streamer, not from your device.

Service providers we use

Threadbase relies on the following third parties. Each one processes only the data described in its section above, under its own terms and data-processing agreements.

• Expo. Delivers ordinary push notifications. Expo receives your push token and the notification payload described in section 2, which carries no session content.
• Apple. Delivers Live Activities through the Apple Push Notification service. Apple receives your device's Live Activity token and the payload described in section 2, which includes a prompt-derived title, a server label that may be the streamer's hostname, and a truncated excerpt of session output; these may contain sensitive content.
• Sentry. Processes optional crash reports, as described in section 3.
• MailerLite. Processes newsletter subscriptions from the website, as described in section 6.

Permissions the app uses

Your control

• Crash reporting is off by default; enable or disable it any time in Settings.
• Feedback and diagnostics are only ever sent when you initiate them.
• Removing a server deletes its credentials from your device, and recent app versions also ask that streamer to delete its push token — though not if the streamer is unreachable at that moment. To be certain, go to Paired devices in Settings and revoke the device — that deletes its push token immediately, right from the app.
• Uninstalling the app removes the data stored in its own container; credentials held by the operating system's secure credential storage, such as the iOS Keychain, can survive it — remove a server in the app to delete its credentials.
• Contact support@threadbase.sh with any privacy question or deletion request.