Privacy Policy
Effective August 17, 2026
ThreadRelay’s single purpose is to mass-forward Gmail messages selected by the user to destinations the user reviews and confirms.
Data the extension handles
The extension handles the connected Google account identity, selected Gmail thread content, recipient addresses, contacts used for autocomplete, and local run history. A separate ThreadRelay account contains the email address or sign-in identity supplied to Clerk, the user’s plan, and daily forwarding-count usage.
How Gmail data is used
Email content is processed locally in the browser extension and transmitted directly to Google’s Gmail APIs to perform the forwarding action the user requests. Contacts are requested from Google to provide recipient autocomplete. Run history is stored locally on the user’s device. Email bodies, attachments, recipient addresses, contact lists, and local history are not sent to ThreadRelay, Clerk, Stripe, Google Analytics, or the subscription service.
Accounts, usage, and billing
Clerk provides ThreadRelay account sign-in, session management, and the private daily forwarding counter used for the free plan. Before a batch begins, the extension sends the signed-in account token and requested message count to ThreadRelay’s subscription service so it can verify the plan and enforce the free daily limit. Stripe processes checkout, subscriptions, and the billing portal. Stripe receives payment and billing data entered on Stripe’s hosted pages.
Website analytics
ThreadRelay uses Google Analytics on the public website to understand page visits, navigation, device information, and general acquisition sources. Website analytics are kept separate from Gmail message content, contacts, recipient addresses, and local forwarding history. ThreadRelay does not send Gmail data to Google Analytics.
Sharing and sale
ThreadRelay does not sell personal information, use Google API data for advertising, or allow humans to read email content. Data is shared only with Google, Clerk, Stripe, Google Analytics, and infrastructure providers as necessary to provide the requested Gmail, account, quota, billing, website measurement, and hosting functionality; to comply with law; or to protect against abuse.
Retention and deletion
Local run history and cached contacts can be cleared from the extension. The Clerk daily quota record is replaced when a new calendar day begins. Clerk account records, Stripe billing records, and aggregated website analytics are retained as needed for account operation, accounting, measurement, fraud prevention, and legal compliance. Users may contact support to request deletion of account-linked data where legally permitted.
Security
Network requests use HTTPS. Google OAuth and Stripe secret keys are not embedded in the public extension code. The website requires a verified Clerk session; after a user initiates extension pairing, ThreadRelay issues a signed 30-day device token that is bound to that exact Chrome or Safari extension origin. Account API requests require one of those verified tokens, and Stripe webhooks are signature-verified.
Google API Limited Use
ThreadRelay’s use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Contact
Support contact: support@threadrelay.app.