Privacy Policy

Effective date: 8 May 2026 · Last updated: 22 October 2026

This Privacy Policy explains how Tredsy ("Tredsy", "we", "our") collects, uses, and protects information when you use the Tredsy iOS application and the related services at tredsy.com (the "Service"). We've tried to write it in plain English. If anything is unclear, email us at [email protected].

1. Who is the data controller

The data controller is the individual entrepreneur (Ukrainian: ФОП) Yaroslav Kira, registered in Ukraine. You can reach the controller at [email protected] for any privacy-related question or to exercise your rights under the GDPR.

2. What data we process

We only process the minimum needed to run the Service:

• Threads profile data — your numeric Threads user id, username and profile picture URL, for each Threads account you connect (one Tredsy profile can hold several). Received from Meta during the OAuth sign-in flow so we know which account a post belongs to.
• Threads access token — issued by Meta after you authorise Tredsy — one per connected Threads account. Stored encrypted at rest using AES-256-GCM with a per-row initialisation vector. Used only to publish on your behalf.
• Post content you create — text, scheduled time, the text of up to five follow-up comments, status (draft / scheduled / published / failed), and timestamps. Also any reusable text snippets you save in Settings.
• Media you upload — images and videos attached to a post. Stored on Cloudflare R2 in the EU until the post or your account is deleted.
• Moving a Threads account between Tredsy profiles — if you add a Threads account that is already connected to another Tredsy profile (for example, one you used on another phone), you sign in to that Threads account, which shows it's yours, and then confirm the move. Only then are the account and its posts, posting slots and statistics moved to your profile; that profile's other data, including its subscription, stays where it is. While you add or move an account, the newly issued access token is held encrypted for at most 15 minutes and deleted if the step isn't completed.
• Server logs — IP address, User-Agent, request path, and error stack traces. Used for debugging, abuse prevention, and security. Retained for up to 7 days, then rotated by our hosting provider.
• Subscription and purchase data — if you subscribe to Tredsy Pro, we and our subscription provider (RevenueCat) receive your purchase history and subscription status, tied to a device / app-user identifier, so we can unlock Pro features on your account. Apple processes the actual payment — we never see your card number or your Apple ID password.
• Telegram link (optional) — if you connect the Tredsy Telegram bot, we store your Telegram chat id linked to your account so the bot can create posts for you. You can unlink it at any time.
• Post and profile statistics — views, likes, replies, reposts and quotes for posts you published through Tredsy, and your follower count and profile views. Fetched from the Threads API about once an hour and stored so the Analytics tab can show trends.
• AI requests (optional) — when you use an AI feature (generate a post from a brief, or rewrite, shorten, extend or translate text), the brief or text you submit is sent to our AI providers to produce the result. We keep only a count of AI requests per account, to apply the daily limit — not the prompts or results.
• AI assistant connections (optional) — if you connect an AI assistant such as Claude, ChatGPT, Claude Code or Codex (see tredsy.com/mcp), we store the connection's name, a SHA-256 fingerprint of its access key (never the key itself) and its last four characters, your timezone, which actions you allowed it and when it was last used. Posts it creates are labelled with its name.

We do not ask for or collect: your email password, bank details, contacts list, photo library beyond the items you explicitly attach to a post, location, microphone, or any health data.

3. Why we process it (legal basis)

• Performance of contract (GDPR Art. 6(1)(b)) — when you sign in with Threads, you ask us to schedule and publish posts on your behalf. Processing the data above is necessary to deliver that.
• Legitimate interest (GDPR Art. 6(1)(f)) — for server logs and abuse prevention, balanced against your reasonable expectations of a hosted service.

4. Where data lives

• Application database — managed PostgreSQL on Render, hosted in Frankfurt, Germany (EU).
• Media storage — Cloudflare R2, EU region.
• DNS and TLS termination — Cloudflare (operates a global network; the backend origin remains in Frankfurt).

Your account, posts and media are stored in the EU/EEA. Some processors listed in section 5 operate outside it, mainly in the United States: Meta (when you publish to Threads), RevenueCat and Apple (subscriptions and push notifications), our AI providers (only when you use an AI feature) and any AI assistant you choose to connect. Those transfers rely on the providers' Standard Contractual Clauses or the EU–US Data Privacy Framework.

5. Who else sees the data

We use a small number of processors who handle data on our behalf under contractual obligations consistent with the GDPR:

• Meta Platforms, Inc. — receives post text and media when you publish. Subject to Meta's own privacy policy and the Threads platform terms.
• Render Services, Inc. — hosts the application server and database.
• Cloudflare, Inc. — provides DNS, TLS, and R2 object storage.
• RevenueCat, Inc. — manages Tredsy Pro subscription entitlements and validates purchases; receives purchase history and device / usage identifiers for that purpose.
• Apple Inc. — processes subscription payments through the App Store and handles billing and refunds, and delivers push notifications (Apple Push Notification service) using your device push token.
• AI providers — Google LLC (Gemini API) and OpenAI, L.L.C. — receives the brief or text you submit to an AI feature, only when you use one, to generate the result. Subject to that provider's API terms and privacy policy.
• AI assistants you connect — for example Anthropic (Claude) or OpenAI (ChatGPT, Codex). When you ask a connected assistant to work with Tredsy, it receives the posts, queue, snippets and statistics it requests, and what it creates is sent back to your account. This happens only at your direction. The assistant's provider handles that data under its own terms and privacy policy, not as our processor. You can disconnect an assistant in the app at any time.
• Telegram Messenger — if you use the Tredsy Telegram bot, the messages you send it pass through Telegram's infrastructure. We also use a private Telegram bot for internal operations alerts, which may include the Threads username of a newly registered account.

We do not sell your data, and we do not share it with advertisers, data brokers, or analytics networks beyond what is described here.

6. How long we keep it

• Threads access token — until you disconnect that Threads account, remove Tredsy in your Threads settings, or delete your account.
• Account and Threads profile data — until you delete your account. A disconnected Threads account keeps its posts and statistics so you can reconnect it; delete them as described in section 9.
• Posts and uploaded media — until the post is deleted from Tredsy or your account is deleted.
• AI assistant connections — until you disconnect them or delete your account.
• Server logs — up to 7 days, after which they are rotated and overwritten by the hosting provider.
• Database backups — encrypted backups are retained by our hosting provider for up to 30 days for disaster recovery, then deleted.

7. Security

• All traffic in transit uses TLS 1.2 or higher.
• Threads access tokens are encrypted at rest with AES-256-GCM.
• Authentication uses signed JSON Web Tokens scoped to your user, which we can revoke server-side (for example when you disconnect Threads or delete your account).
• Access to the production environment is limited to the data controller and is protected by hardware-backed multi-factor authentication.

No system is perfectly secure. If we ever discover a personal data breach affecting you, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR Art. 33–34.

8. Your rights

Under the GDPR (and equivalent local laws), you have the right to:

• Access the personal data we hold about you (Art. 15) and receive a copy in a portable format (Art. 20).
• Ask us to correct inaccurate data (Art. 16) or delete it (Art. 17 — "right to be forgotten").
• Restrict or object to certain processing (Art. 18, 21).
• Withdraw consent at any time (where consent is the legal basis), by disconnecting Threads from within the app or by emailing us.
• Lodge a complaint with a data protection authority. In Ukraine, the Ukrainian Parliament Commissioner for Human Rights. In the EU, the authority of your country of residence.

To exercise any of these rights, email [email protected] from the address associated with your account. We will respond within 30 days.

9. Deleting your data

The fastest way to delete everything is from inside the app: open Settings → Delete account. This removes your user record, all posts, all uploaded media (including from R2), and revokes your Threads session on our side. For a step-by-step walkthrough see our Data deletion instructions.

If you remove Tredsy in your Threads settings and ask Meta to delete your data, we delete the data of that Threads account — its posts, media and statistics — after a 30-day grace period (reconnecting the account within it cancels the deletion). Other Threads accounts in the same Tredsy profile are not affected; the profile itself is deleted once no account is left in it.

10. Children

Tredsy is not directed at children under 13 (or under 16 in jurisdictions where that is the minimum age for online consent). We do not knowingly collect personal data from children. If you believe a child has registered, please contact us and we will delete the account.

11. Analytics, push notifications, and crash reports

Tredsy does not use advertising SDKs or ad networks, and does not use third-party crash reporting. For subscriptions we use RevenueCat, which collects your purchase history and product-interaction data solely to manage your subscription and measure conversion — never for advertising. Crash diagnostics are provided only by Apple's built-in tools, and only when you opt in to share them with developers in iOS Settings.

Tredsy sends push notifications to tell you whether a scheduled post published successfully. To deliver them, your device push token is stored and used solely for that purpose — never for tracking or advertising. You can turn push notifications off at any time in iOS Settings. If we ever add third-party analytics or crash reporting (for example, anonymous crash reporting via Sentry), we will update this policy and notify users in-app at least 30 days before the change takes effect.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be highlighted at the top of this page and announced in the app 30 days before they take effect. The "Last updated" date above always reflects the current version.

13. Contact

For any privacy-related question, including GDPR rights requests: [email protected].