---
title: Threadpacket privacy policy
description: What Threadpacket stores, for how long, who can see it, and how to have it deleted.
canonical: https://threadpacket.com/privacy
last-updated: 2026-11-11
---

# Privacy

The hosted Threadpacket service at https://threadpacket.com is run by Eugene Olshenbaum, the author of Threadpacket. Contact: https://threadpacket.com/contact.

Threadpacket has no AI inside: it makes no model calls, and nothing you send is used to train a model, sold, or shown to advertisers.

## What Threadpacket stores

- **Your account:** your team name and username, and a salted hash of your access code. Not your email, name or phone number.
- **What you send:** each packet's title, brief and files, exactly as your assistant sent them, and who sent it to whom.
- **Files you upload** in Packets or through an assistant, until you send or delete them.
- **Sign-ins:** the assistants you connected (the name each app gives) and their refresh tokens, stored as hashes. Access tokens are not stored.
- **Pickups:** when each recipient first read a packet in an assistant, with that assistant's name, and when they first opened it in Packets. Kept until the packet is deleted.
- **Activity:** which tool was called, when, by which username, and whether it worked. Not the content.
- **Abuse limits:** when you sign in or create a team, a hash of your IP address, to slow down guessing. It is deleted after 10 minutes.

## How long

- Packets are deleted 7 days after they are sent by default (the sender can choose up to 30 days), or as soon as the sender revokes them; the stored rows are removed within 7 days after that.
- Files nobody sent are deleted after 7 days.
- Activity records are deleted after 30 days. Expired sign-ins are deleted every hour.
- Your username stays until you or your team's admin removes it.

## Who can see it

- A packet: the sender and the recipient (or everyone in the team, when sent to the team). People in other teams cannot address or read it.
- Pickups: the sender sees when each recipient picked up or opened their packet, and in which assistant. A recipient sees only their own.
- A file you uploaded and have not sent: only you, in Packets and in the assistants you connect.
- The operator does not read teams' packets, files or accounts, and does not recover access codes. Stored data is not end-to-end encrypted, so the operator could technically read it; it is opened only if the law requires it.
- The assistants you connect read what you ask them to read. What they do with it is under your agreement with that assistant (Anthropic, OpenAI and others).

## Where

On Cloudflare (Workers, a D1 database and Cloudflare's file storage), which processes the data for Threadpacket. Traffic is encrypted in transit. Cloudflare may keep request logs under its own policy.

## Your choices

- Revoke a packet you sent with your assistant (“revoke that packet”) or in Packets, or wait for it to expire.
- Delete your uploaded files in Packets (https://threadpacket.com/packets).
- Disconnect an assistant: your team's admin can do it in the console.
- To delete your account, ask your team's admin to remove you in Members. An admin deletes the whole team, with every member, packet and file, on the Your team page (Delete team).

## Cookies

A sign-in cookie keeps you signed in to Packets and the console, up to five accounts per browser. A session ends after 30 days without use, or when you sign out. No tracking or advertising cookies, and no third-party scripts.

## Changes

This page shows the date of its last change. Questions: https://threadpacket.com/contact.