Rethread — Privacy Policy Local-First · Zero-Knowledge

Last updated: June 12, 2026 · Applies to extension v0.7.0+

Overview

Rethread is an AI context memory extension that helps your AI assistants remember who you are across conversations. By default, all data stays in your browser. Pro users may optionally enable end-to-end encrypted cloud sync, in which case our servers receive only ciphertext — encryption keys are derived on your device and never transmitted.

Data Collection

Rethread itself does not collect:

• Plaintext conversation contents or chat history
• Browsing activity or URLs outside of supported AI platforms
• Analytics or usage statistics — unless you explicitly opt in to anonymous usage counters (off by default; see Optional Anonymous Usage Statistics)
• Cookies or tracking identifiers

When you purchase a Pro plan, your email and payment details are collected by Creem (our payment processor) — not by Rethread. We only store the license key locally in your browser.

Data Storage

All extracted memory entries, conversation snapshots, buckets, folders, tags, and templates are stored locally in your browser's IndexedDB database. This is the default and applies to every user.

Optional End-to-End Encrypted Cloud Sync (Pro)

Pro users may enable Cloud Sync from Settings to keep their library in lock-step across multiple browsers and devices. When enabled:

• You choose a passphrase. The passphrase itself never leaves your browser.
• Your browser derives an AES-256-GCM encryption key from the passphrase using PBKDF2 (600,000 iterations) followed by HKDF.
• Memories, conversations, snapshots, buckets, folders, tags, and templates are encrypted on-device before being uploaded.
• Our backend (Cloudflare Workers, D1, R2, Durable Objects) stores only:
  • Opaque ciphertext blobs and the matching initialization vectors (IVs)
  • Record metadata required for sync — record ID, record type, soft-delete flag, last-modified timestamp, byte size
  • Your license key (used as the account identifier) and basic instance/device labels you choose
• We cannot decrypt your data — there is no "forgot password" recovery by design. Lose the passphrase and the cloud copy becomes permanently unreadable.
• You can disable sync and wipe the cloud copy at any time from Settings → Cloud Sync.

Optional Anonymous Usage Statistics (Opt-In)

Rethread can send anonymous usage counters to help us understand which features matter. This is off by default and only ever enabled if you switch on "Anonymous usage stats" in Settings. When enabled:

• Only pure event counts from a small fixed allowlist are sent (e.g. "onboarding completed", "recall insert", "sync enabled"), together with the extension version and a short non-identifying label such as a platform name.
• There is no user ID, no random "anonymous" ID, and no stored IP address — nothing exists to join events to a person or device. The server keeps only aggregated daily counters.
• No conversation content, memory content, URLs, or timestamps of individual actions are ever included.
• Turning it off stops collection immediately and deletes any queued, unsent counters.

Optional Bring-Your-Own-Key AI Extraction (Pro)

Pro users may configure a personal API key for an OpenAI-compatible provider to improve memory extraction quality. If you set this up:

• Your API key is stored locally in your browser's extension storage and is never sent to Rethread's servers.
• Conversation excerpts are sent over HTTPS directly from your browser to the provider you chose (e.g. OpenAI, OpenRouter, or a custom endpoint), solely to extract memory entries. Rethread's servers are not involved in these requests.
• Those requests are governed by your chosen provider's privacy policy and terms.
• BYOK is entirely optional — if you never configure it, no external AI API is called on your behalf.

Optional Prompt Marketplace

Rethread includes a community prompt template marketplace. Browsing, searching, starring, and installing built-in templates is anonymous beyond standard server logs (IP, user-agent — retained briefly for rate limiting and abuse prevention).

If you choose to publish a template (Pro), the template's title, description, tags, and prompt body are shared in plaintext with the community. Do not include personal data, secrets, or proprietary information in published templates. You can delete or unpublish your templates at any time.

Host Permissions

Rethread requests access to the following six AI platform domains:

• chatgpt.com (OpenAI ChatGPT)
• claude.ai (Anthropic Claude)
• gemini.google.com (Google Gemini)
• grok.com (xAI Grok)
• www.perplexity.ai (Perplexity AI)
• chat.deepseek.com (DeepSeek)

These permissions are used solely to read the DOM structure of conversation pages in order to extract contextual memories. Rethread does not modify page content beyond injecting a small recall button and context preview UI.

In addition, the extension can reach api.creem.io (license validation and checkout, see Payments & Billing) and — only if you configure BYOK extraction — api.openai.com or openrouter.ai. A custom BYOK endpoint prompts for an optional host permission for that origin at configuration time, which you can revoke in your browser's extension settings.

Authentication & License

Rethread does not require user registration or login to use the free tier. The Pro plan is activated via a license key issued after purchase. License key validation communicates with Creem's API to verify activation status — no other authentication mechanism is used. There are no user accounts, no passwords, and no OAuth flows.

Payments & Billing

Rethread uses Creem as our Merchant of Record for payment processing. When you purchase a Pro plan, Creem collects the information necessary to process your payment, including:

• Email address
• Payment method details (processed by Creem — we never see your card number)
• Billing country (for tax calculation)

This billing data is stored and managed by Creem under their Privacy Policy, not by Rethread. We only store your license key and activation status locally in your browser's storage.

Chat History Import

Rethread allows you to import chat history export files from ChatGPT and Claude. Imported data is parsed entirely within your browser and stored locally alongside other memories. No imported data is sent to any external server.

Third-Party Services

Rethread integrates with the following third-party services:

• Creem (creem.io) — payment processing and license key validation for Pro plan purchases. Creem acts as the Merchant of Record and handles all payment data. See Creem's Privacy Policy.
• Cloudflare (Workers, D1, R2, Durable Objects) — hosts the optional cloud sync, template marketplace, and (if you opt in) anonymous usage counter backend. Cloudflare receives only encrypted ciphertext for sync data and aggregated counters for usage statistics, plus standard request metadata (IP, user-agent) for routing and abuse prevention. See Cloudflare's Privacy Policy.
• Your chosen BYOK provider (optional, Pro) — if you configure bring-your-own-key extraction, conversation excerpts go directly from your browser to that provider under its own privacy policy. Rethread never proxies or stores these requests.

No third-party analytics platforms, advertising networks, or tracking tools are used. Aside from BYOK extraction requests you explicitly configure, your plaintext memory data is never shared with any third party.

Data Deletion

You can delete all Rethread data at any time by:

• Using the export/import feature to back up data before deleting
• Disabling Cloud Sync from Settings — choose "Disable & wipe cloud copy" to also delete the encrypted backup from our servers
• Removing the extension — this permanently deletes all locally stored memories
• Clearing your browser's site data for the extension

Changes to This Policy

If we update this privacy policy, the changes will be posted on this page with a revised "Last updated" date. Material changes will be communicated via the extension's update notes.

Contact

If you have questions about this privacy policy, please contact us at: [email protected]