Privacy Policy

Last updated: February 26, 2026

Threadmill ("we", "us", "our") operates threadmill.dev. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

• Account information: Email address, name, and hashed password when you sign up.
• Uploaded content: Audio and video files you upload for processing (podcasts, recordings).
• Generated content: Transcripts, LinkedIn posts, Twitter threads, and quote cards produced by our AI pipeline.
• Usage data: Episode count, plan tier, and credit balance.
• Payment data: Handled entirely by Creem.io (our Merchant of Record). We store a Creem customer ID and subscription ID but never see or store credit card numbers.

2. How We Use Your Data

• Service delivery: Transcribing your uploads, generating social content, and managing your account.
• Billing: Processing subscriptions and tracking credit usage.
• Improvement: We may analyze aggregate, anonymized usage patterns to improve the product. We do not sell your data.

3. Third-Party Processors

Your data is shared with the following processors solely to deliver the service:

• Deepgram — Receives your audio/video files for transcription (speech-to-text). Deepgram Privacy Policy
• Google (Gemini) — Receives transcripts to generate social media content. Google Privacy Policy
• Cloudflare R2 — Stores your uploaded files and generated assets. Cloudflare Privacy Policy
• Creem.io — Merchant of Record handling all payments, billing, tax compliance, and refunds. Creem Privacy Policy

4. Cookies

We use a single session cookie (threadmill_session) to keep you logged in. It is an HMAC-signed, httpOnly cookie. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

5. Data Retention

• Your uploaded files and generated content are retained as long as your account is active.
• You can delete individual episodes at any time, which removes the file from storage and all associated generated content.
• If you delete your account, all data is permanently removed (cascade delete across all tables and storage).

6. Your Rights

You have the right to:

• Access your data via the dashboard or by contacting us.
• Delete your account and all associated data at any time.
• Export your generated content (copy from the dashboard).
• Correct your account information by contacting us.

7. Security

Passwords are hashed using scrypt with unique salts. Sessions are HMAC-signed and stored server-side with expiration. All connections use HTTPS in production.

8. Children

Threadmill is not intended for users under 16 years of age. We do not knowingly collect data from children.

9. Changes

We may update this policy from time to time. Material changes will be communicated via the email on your account.

10. Contact

For privacy questions or data requests, email us at [email protected].