Privacy Policy

This policy explains what ThreadArt does with information when you use the website at threadart.net or the ThreadArt iOS app. It is written to be accurate rather than reassuring: everything below describes what the software actually does.

The short version: your chat export is read and analysed entirely on your device. It is never uploaded, and we cannot see your messages. Two things do leave your device: the search terms you type when looking for a background photo, and — only if you order a print — the finished artwork image together with the name, email and delivery address needed to make and post it. The website also uses Google Analytics and Google Ads measurement, but only if you accept cookies when asked, and never with anything from your chat. The iOS app runs no analytics at all. We sell no data.

1. Who we are

ThreadArt is operated by Stephen Harcombe, trading as ThreadArt, a sole trader based in the United Kingdom, who is the data controller for the personal data described in this policy. You can contact us about anything in this policy at privacy@threadart.net.

2. What we collect, and why

2.1 Your chat export

When you open a WhatsApp export (.txt or .zip), the file is read by the app on your own device: the browser on the website, or the iOS app. The messages, sender names and timestamps in it are used to build the word cloud and the Chat Insights.

• The export is never uploaded. There is no code path that sends it anywhere.
• We cannot read, access or recover your messages. They exist only in memory on your device.
• The chat is discarded when you close the tab or the app. Nothing from it is saved.
• If you add your own photo as a background, it stays on your device in the same way. It is only ever sent anywhere as part of the finished artwork, and only if you order a print (see 2.3).

2.2 Background photo search

If you search for a stock photo, the words you type (and the page number) are sent to our server, which forwards them to Pexels, the stock photo provider, and returns the results. Photos you pick are fetched through our server too, so your device never contacts Pexels directly. Search terms are not linked to you and are not stored.

2.3 Print orders

When you order a print, the following happens:

• The finished artwork image (a PNG that contains the words shown in your word cloud, and your background photo if you used one) is uploaded to our server so it can be printed. This is the only time anything derived from your chat leaves your device.
• You are taken to a checkout page hosted by Stripe, where you enter your name, email address, delivery address and card details. Stripe handles the payment; we never see or store your card number.
• Stripe sends us your name, email address and delivery address, which we store against the order along with what you bought and what you paid.
• We pass the artwork, your name, delivery address and email address to Printify, our print partner, which produces the print and ships it to you. Your email is included so that Printify can send you a shipping notification.

2.4 Chat Insights in the iOS app

In the iOS app, the full Chat Insights page is a one-time in-app purchase made through Apple's App Store. Apple handles the payment under its own privacy policy; we do not receive your name, payment details or Apple ID. The app stores a single flag on your device recording that the unlock has been bought. On the website, Chat Insights is free and there is no purchase.

2.5 Analytics and advertising measurement (website only)

The website loads Google's tag for Google Analytics and Google Ads so that we can see how many people reach each step (upload, word cloud, checkout, order) and whether our adverts bring in orders. It works like this:

• It sets cookies, and can recognise you between visits, only if you accept the cookie bar shown on your first visit. Until then, and if you decline, it runs in a denied mode that sets no cookies and cannot identify you. Google may still receive anonymous, cookieless pings used for aggregate totals.
• The events we send contain counts and product data only: how many messages and participants a chat had, which design was used, and what was ordered and for how much. Nothing from the chat itself — no message text, no names — is ever included. There is no code path that could include it.
• Google receives this data and, with your consent, its own cookie identifiers. We see it only in aggregate.
• The iOS app does not load the tag and sends nothing to Google.

Our Cookie Policy lists the cookies and lets you change your choice at any time.

2.6 Technical data

• To stop abuse, our server limits how often one connection can start a checkout or run a photo search. It uses your IP address to do this, held in memory for a few minutes and never written to disk.
• Like every internet service, our hosting providers keep standard server logs (IP address, time, and the address requested) for a short period for security and fault-finding.

2.7 What we do not collect

• No account, login or sign-up exists, so no account details.
• No cookies beyond Google's analytics and ad-measurement cookies, and those only with your consent (see section 11).
• No location, contacts, photos library or other device data. The iOS app requests no permissions.
• No marketing lists. We do not send newsletters or promotional email.

3. How we use your information

• To make the word cloud and Chat Insights you asked for (on your device)
• To find background photos you search for
• To take payment for, produce, post and keep records of print orders
• To answer you if you contact us about an order or about your data
• To prevent abuse of the service
• To understand, in aggregate, how the website is used and whether our adverts work (website only, with your consent)

We will never:

• Sell or rent your personal data to anyone
• Use anything from your chat for advertising, marketing or training anything
• Share your messages with anyone — we do not have them

4. Legal basis

• Contract — taking payment for, producing and delivering an order, and keeping its records
• Legal obligation — keeping order and payment records for as long as UK tax and accounting rules require
• Legitimate interests — keeping the service secure and preventing abuse, and answering your enquiries
• Consent — analytics and advertising-measurement cookies on the website, which you can withdraw at any time from the Cookie Policy page

Processing of your chat happens on your device under your own control; we do not process it at all.

5. Where your data is kept and how it is protected

• Order records and uploaded artwork are held on our API server, hosted by Fly.io in London, United Kingdom, on storage that is encrypted at rest.
• The website's static files are served from a server in the United Kingdom (Freethought Internet). The website itself holds no personal data.
• All connections to the website and the API use HTTPS (encryption in transit).
• Access to order records is limited to the founder.
• Uploaded artwork is served from an unguessable, unlisted address so that Printify can collect it, and is deleted automatically once the order is complete (see section 7).

6. Who else receives your data

We use a small number of providers. Each receives only what it needs for its job.

6.1 Stripe — payments

Receives your name, email, delivery address and card details on its own checkout page, and processes the payment. We receive the name, email and address back; never the card. See Stripe's privacy policy.

6.2 Printify — print production and delivery

Receives the artwork file, your name, delivery address and email address, and passes the name and address to the print provider that makes and posts the item. Print providers are located in the United Kingdom, the European Union or the United States depending on the product; the shop shows where each item is shipped from. See Printify's privacy policy.

6.3 Pexels — stock photos

Receives background search terms only, via our server. No personal data. See Pexels' privacy policy.

6.4 Apple — the iOS app

Distributes the app and processes the Chat Insights in-app purchase. We receive no personal data from Apple. See Apple's privacy policy.

6.5 Google — analytics and advertising measurement (website only)

Receives usage events (counts and product data, never chat content) and, if you accept cookies, its own cookie identifiers, which it uses to tell visits apart and to attribute orders to adverts. Google acts as an independent controller for its own use of that data. See Google's privacy policy.

6.6 Hosting

Fly.io hosts the API and order records (London). Freethought Internet hosts the website's static files (United Kingdom). Both are processors acting on our instructions.

7. How long we keep things

8. Your rights

Under UK data protection law you can ask us to:

• Access — give you a copy of the personal data we hold about you
• Rectify — correct anything that is wrong
• Erase — delete your personal data, where we are not required to keep it as a financial record
• Restrict or object — limit or stop particular processing
• Port — give you your data in a machine-readable form

In practice the only personal data we hold is order records. Email privacy@threadart.net and we will respond within 30 days. Because there are no accounts, we will ask you for the order reference or the email address used at checkout so that we can find the right record.

9. Other people in your chat

A chat export contains other people's messages. Because the export is processed on your device and never sent to us, you are responsible for how you use it. By creating artwork you confirm that you have the agreement of the people in the conversation, and that you will not use the result in a way that breaches their rights. The app lets you exclude any participant before the word cloud is built. If you order a print, the words in it become part of the artwork we hold briefly to fulfil the order, as described above.

10. Children

ThreadArt is not intended for anyone under 13, or under the higher age that applies where you live. We do not knowingly collect personal data from children. If you believe a child has placed an order with us, contact privacy@threadart.net and we will delete the record where the law allows.

11. Cookies and local storage

• The website uses cookies for one purpose: Google Analytics and Google Ads measurement, and only after you accept the cookie bar. Decline, and no such cookies are set.
• The iOS app sets no cookies and loads no analytics.
• The website keeps your cookie choice in local storage so it does not ask again. The iOS app keeps one value in its local storage: whether the Chat Insights unlock has been bought. Neither ever leaves your device.
• Stripe's checkout page is on Stripe's own domain and uses Stripe's cookies for security and fraud prevention while you pay. They are governed by Stripe's policies.

Our Cookie Policy lists each cookie, what it is for and how long it lasts, and lets you change your choice.

12. International transfers

Our own servers are in the United Kingdom. Stripe, Printify, Pexels, Google and Apple are international companies and may process data in the United States or the European Union. Transfers of personal data outside the UK rely on the UK's adequacy regulations or on the standard contractual safeguards in those providers' terms. Print providers are chosen per product and may be in the UK, EU or US.

13. Changes to this policy

When the software changes what it does with data, this page changes with it, with a new "Last Updated" date. We have no mailing list, so we cannot email you about changes; please check this page.

14. Contact and complaints

• Email: privacy@threadart.net

If you are not satisfied with our response, you can complain to the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113

15. Summary

• Your chat never leaves your device — everything is built locally and we cannot see your messages
• Ordering a print is the exception — the finished artwork image, your name, email and delivery address are used to make and post it, then the artwork is deleted
• Analytics only with your consent, and never on your chat — the website's Google tag sees counts and orders, not messages; the iOS app has none
• No accounts, no data sales
• You have rights — ask us at any time about the order data we hold