Privacy Policy

Last updated: October 18, 2026

This policy explains what RARCO LLC ("we", "us"), the company that operates ThreadBridge, collects when you use ThreadBridge, why, and what we do with it. ThreadBridge relays messages between chat platforms; the design goal throughout is to hold as little of your data as the job allows.

The short version

• We do not store the content of the messages ThreadBridge relays.
• We store the access tokens needed to connect to your workspaces, encrypted.
• We store your account details and your bridge configuration.
• We do not sell your data, and we do not use your messages to train anything.

Information you give us

• Account information: your name, email address, and password (stored as a hash, never in readable form). If you invite colleagues, the same applies to them.
• Billing information: handled by our payment processor. We receive subscription status and receipts; we never see or store your card details.
• Bridge configuration: the names you give bridges, the channels you map to each other, and any tags you apply.
• Support correspondence: anything you send us by email.

Information from the platforms you connect

When you connect Slack or Microsoft Teams, we receive and store:

• An identifier and display name for the workspace or tenant.
• Access tokens, and for Microsoft a refresh token, encrypted at rest.
• The list of permissions that were granted.

While a bridge runs, ThreadBridge also reads the channel lists of the workspaces you connected so you can choose channels, and receives messages posted in the channels you mapped.

What happens to message content

Message content is processed in memory for as long as it takes to deliver it to the other platform. It is not written to our database or to our logs. Two artifacts exist to make the relay correct, and neither contains message content:

• A one-way hash of a message, used to recognize and discard the echo of a message we just sent. It expires after thirty seconds.
• A mapping between the platforms' own message identifiers (which platform, which message ID), so that a threaded reply lands in the right thread on the other side and a message delivered twice by a platform isn't relayed twice. It is stored in our database and deleted after 30 days.

Your messages themselves remain in Slack and Microsoft Teams, governed by your own retention policies and your agreements with those providers. We cannot delete them for you, and deleting your ThreadBridge account does not remove messages that were already delivered.

Operational records

We record events about a bridge's own lifecycle (started, stopped, restarted, health check results, and errors) so you and we can tell whether a bridge is working. These records describe the bridge, not the conversation, and are deleted after 7 days on the Free plan and 90 days on the paid plan (routine health checks after 7 days on every plan). Our servers also keep standard application logs containing request metadata and error details (identifiers, never message content); these are retained for a limited period for security and debugging.

Product analytics

We use product analytics to see how people find and use ThreadBridge: which pages are visited, where sign-up or setup stalls, and whether a feature gets used. It does not use cookies or local storage. Your IP address is shortened before it is sent (the last part is removed), which is enough to estimate your country and city but not to identify you. When you're signed in, events are tied to an internal account identifier, never your name or email address. Some visits are recorded as session replays with every piece of text and every form field masked, so what you type, your channel names and your workspace names are never captured. Message content never reaches analytics.

Why we process this

• To provide the service you asked for; this is the basis for nearly everything above.
• To keep the service working and secure: health checks, alerts, abuse prevention.
• To bill you, and to meet our legal and accounting obligations.
• To contact you about the service. We will not add you to marketing email you didn't ask for.

Who else is involved

We use a small number of providers to run ThreadBridge: cloud hosting, a payment processor, an email delivery provider, error monitoring, and product analytics. They process data on our instructions and only as needed to provide their service. We do not sell personal information or share it with advertisers.

We may disclose information if legally compelled, and if we're permitted to tell you, we will.

Where data is processed

ThreadBridge is operated from infrastructure located in the United States. If you're outside the United States, your data will be transferred to and processed there.

Retention

• Account and configuration data: kept while your account is open.
• Credentials: deleted when you disconnect a platform or delete your account.
• Message ID mappings: deleted after 30 days, or sooner with the bridge.
• Bridge events: deleted after 7 days on Free and 90 days on the paid plan (routine health checks after 7 days on every plan), or sooner with the bridge.
• Billing records: kept as long as tax and accounting law requires.

Deleting your account removes your bridges, your configuration, and your stored credentials. We also recommend revoking ThreadBridge's access from Slack and from the Microsoft Entra admin center, which you can do independently of us at any time.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to processing, or to complain to a supervisory authority. Email support@threadbridge.app and we'll help. We won't treat you differently for exercising a right.

Security

Credentials are encrypted at rest. Traffic is encrypted in transit. Incoming webhooks are cryptographically verified. Each customer's bridges run in isolation from every other customer's. More detail is on our security page. No system is perfect; if we suffer a breach affecting your data, we'll tell you promptly and describe what happened.

Children

ThreadBridge is a business tool and is not directed at children. We don't knowingly collect data from anyone under 16.

Changes

If we change this policy materially, we'll update the date above and notify account owners by email before the change takes effect.

Contact

ThreadBridge is operated by RARCO LLC, which is responsible for the personal data described in this policy. Contact: RARCO LLC, 30 N Gould St #45919, Sheridan, WY 82801, USA, or support@threadbridge.app.