Privacy Policy

Last updated: June 22, 2026

This Privacy Policy explains how ThreadLoom (“ThreadLoom,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects information when you use our website, application, and related services. ThreadLoom is the data controller for the information described here.

ThreadLoom is a career intelligence platform: it reads the evidence already in your inbox and rebuilds your job search into a structured, living career record. Because that means handling sensitive email and career data, we have tried to describe our actual practices in plain language. If you have questions, contact us at hey@threadloom.ai.

1. Information We Collect

We collect the following categories of information:

Google account identity. When you sign in with Google or connect Gmail, we receive basic profile information such as your name, email address, and Google account identifier.
Gmail message data relevant to your job search. When you connect Gmail, ThreadLoom reads messages to detect and organize job-search activity. This can include sender and recipient details, subject lines, message body text, dates, and job-description content or attachments. We focus on job-search evidence (application confirmations, recruiter replies, interview updates, offers, rejections, and related context).
User-provided content. Resumes, documents, notes, saved answers, corrections, preferences, and other content you add to or connect with ThreadLoom.
Payment information. If you purchase a paid plan, payment is processed by Stripe. We receive limited billing details (such as plan, status, and transaction metadata) but do not collect or store your full card number.
Session, usage, and log data. Technical information needed to operate the service, such as session data, device/browser information, and server logs used for security, debugging, and reliability.

2. Google API Services — Limited Use Disclosure

ThreadLoom’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, in line with those requirements:

Gmail data is used only to provide and improve the user-facing features you connect Gmail for — job-application detection, application tracking, career history organization, and resume/saved-answer workflows.
We do not use Gmail or other Google user data for advertising.
We do not sell Gmail or other Google user data.
We do not transfer Gmail or other Google user data to others except as needed to provide or improve these user-facing features, to comply with applicable law, or as part of a merger or acquisition.
We do not use Gmail or other Google user data to develop, improve, or train generalized or non-personalized AI and/or machine learning models.
Humans do not read your Gmail data except where you give specific consent, where it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized.

3. How We Use Your Information

We use the information we collect to:

Detect, reconstruct, and organize job applications and career events from your inbox and the content you provide.
Provide ThreadLoom’s user-facing features, including the application tracker, career records, resume support, and saved-answer workflows.
Process payments, manage subscriptions, and administer Founding Member status where applicable.
Maintain the security of the service and prevent fraud, abuse, and unauthorized access.
Operate, maintain, debug, and improve ThreadLoom’s user-facing services.
Communicate with you about your account, important changes, and support requests.

4. How We Share Information

ThreadLoom does not sell your personal data. We share information only in the following limited ways:

Google. To authenticate you and access the Gmail data you authorize.
Stripe. To process payments and manage subscriptions.
Service providers acting on our behalf. Infrastructure/hosting, AI-processing, logging, and similar providers that help us operate the service. These providers may process your data only to provide services to ThreadLoom and under obligations consistent with this policy.
Legal and safety. Where required by law, or to protect the rights, safety, and security of ThreadLoom, our users, or the public.
Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy.

5. Data Storage and Security

We store your data with hosting and infrastructure providers and apply technical and organizational measures designed to protect it. In particular:

Google access tokens and refresh tokens are never exposed in API responses.
Sensitive fields (such as email addresses and message body text) are masked in internal/operator views unless access is specifically required.
Raw email body text is not written to our application logs.
Access to your data by our team is limited to what is necessary to operate, secure, and support the service.

No method of transmission or storage is perfectly secure, but we work to protect your information and continually improve our safeguards.

6. Data Retention and Account Deletion

We keep your information for as long as your account is active or as needed to provide the service, and longer where required for legal, security, or operational reasons.

When you delete your account, ThreadLoom hard-purges your personal records — including your applications, application events, documents, resumes, saved answers, connectors, and related data. For operational integrity, an audit trail of system actions is retained in anonymized form, with your personal identifier replaced by a neutral tombstone so the trail no longer identifies you.

If you disconnect Gmail without deleting your account, ThreadLoom stops accessing new Gmail data, but records that were previously imported or generated remain in your account until you delete them or delete your account.

7. Your Rights and Choices

You can access, correct, and delete your data within ThreadLoom, and you can disconnect Gmail or revoke ThreadLoom’s access at any time through your Google account settings. You may also delete your account to remove your personal records as described above.

Depending on where you live, you may have additional rights over your personal data under applicable law. To exercise any of these rights, or if you need help, contact us at hey@threadloom.ai.

8. Cookies and Sessions

ThreadLoom uses a session cookie to keep you logged in and to operate core functionality of the service. This cookie is necessary for the application to work; without it, we cannot maintain your signed-in session.

9. Children’s Privacy

ThreadLoom is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us so we can remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date at the top of this page and, where appropriate, provide additional notice.

11. Contact

Questions about this Privacy Policy or your data can be sent to: hey@threadloom.ai