threadport

Privacy Policy

How Threadport handles your data.

Last updated: 2026-05-22

The short version

  • The Threadport Chrome extension and local MCP server run on your machine. Your AI conversation data never leaves your device unless you explicitly opt in to hosted Pro generation.
  • We do not have a user database. We do not require an account. We do not run analytics or telemetry.
  • We do not sell, trade, or share your data with anyone, ever.
  • The product is open source. You can read the entire pipeline at https://github.com/ashahi10/ai-capsules.

What the Chrome extension can read

The extension is granted access to two specific origins only: chatgpt.com and claude.ai. On those tabs, and only when you click the Threadport button, it reads the visible conversation thread DOM. It does not read other tabs, your browser history, your cookies, or anything else.

The extension also uses Chrome's local storage (chrome.storage.local) to remember your most recent capsule and your saved-capsule list. This storage stays on your machine and is wiped when you uninstall the extension.

What the local server does

Threadport ships with a small local Node server that:

  • Receives the captured chat from the extension over http://localhost:8787.
  • Calls one LLM provider you have configured (OpenRouter or OpenAI by default) with a single API request to extract the capsule. Your API key lives in server/.env on your machine and is never sent to us.
  • Writes the resulting capsule JSON to ~/.ai-capsules/capsules.json on your machine. That file is the only persistent record outside Chrome's local storage.

We do not run a backend server that touches your conversations on the free tier. Generation happens via your provider key directly.

What the MCP server exposes

The Model Context Protocol server reads from ~/.ai-capsules/capsules.json and exposes that data as tools to the MCP client you connect (Claude Desktop, Cursor, Claude Code, Windsurf, etc.). MCP traffic stays on your machine. We are not in the data path.

Hosted Pro tier (when launched)

Pro is opt-in. When you opt in, the extension sends the captured chat content to a Threadport-operated endpoint, which forwards it to the LLM provider, returns the capsule, and discards the input. We do not persist your raw conversations on the server. We retain the following operational metadata for billing and abuse prevention: license key id, request timestamp, and approximate token counts.

We do not use any captured content to train models, and we do not share captured content with third parties. The only third party that sees the captured content during a Pro request is the LLM provider we route the request through (currently OpenRouter, which in turn routes to the model provider you choose).

What we collect on this website

If you submit your email through the waitlist form on this site, we store it in our notification channel for the sole purpose of emailing you when Threadport ships and when hosted Pro opens. We store no cookies on this site beyond what your browser sets by default. We do not run third-party analytics, tag managers, or advertising pixels.

You can ask us to delete your email at any time by emailing the address listed at the bottom of this page.

Your rights

Because we don't operate a user database, there is nothing to request, export, or delete on the free tier. If you have submitted your email via the waitlist, or if you become a Pro customer, you can request deletion of all associated data by emailing us. We will comply within 30 days and confirm by email.

Children's privacy

Threadport is a developer tool. We do not knowingly collect information from anyone under 13. If you believe a child has signed up, contact us and we will remove the record.

Changes

If this policy meaningfully changes, the Last updated date above will change and we will post a note on the site for 30 days. Material changes that would expand data use will be opt-in only.

Contact

Privacy questions, data deletion requests, or anything else: email adityashahiasr@gmail.com. For security disclosures, please use the same address with [security] in the subject.