Privacy policy
1. Who we are
This policy explains how ThreadWave (“ThreadWave”, “we”, “us”), based in Lahore, Pakistan, handles information when you visit threadwave.io or use the ThreadWave desktop app and its relay service (together, the “Service”). Questions can be sent to privacy@threadwave.io.
2. How ThreadWave works
ThreadWave connects to messaging and calling platforms you choose — WhatsApp Business Platform and Facebook Messenger (provided by Meta), Twilio and Telnyx — using your own accounts and credentials. These platforms send new messages and call events to a webhook address. Our relay, which runs on Cloudflare, receives those events and forwards them to your desktop app. Everything you see in the app is then stored on your computer, not on our servers.
3. What we process
| Data | Where | Why |
|---|---|---|
| Incoming messages, media links and call events (webhook payloads) | Our relay, briefly | To deliver them to your app. Each event is deleted once your app confirms it was received. If your app stays offline, undelivered events are deleted after at most 7 days. |
| Connection settings: your WhatsApp phone number ID, Facebook Page ID and relay registration | Our relay | To route each platform’s events to the right business. |
| Team settings: team member names and roles, and which teammate a conversation is assigned to | Our relay | To deliver conversations to the right teammate when you use team features. |
| Technical logs (IP address, request time, error details) | Cloudflare | To operate, secure and troubleshoot the relay and website. Kept for a short period. |
| Messages you send us (support emails, early-access requests) | Our email | To reply to you. |
The website threadwave.io does not use advertising or analytics cookies, and its fonts are served from our own domain.
4. Data stored on your computer
Your conversations, contacts, media, call history, recordings and transcripts are stored in an encrypted database and encrypted files on the computer where the app is installed. Access tokens for your Meta, Twilio and Telnyx accounts are kept in your operating system’s secure keychain. We cannot read this data. You control it: you can set a retention period or delete all local data from the app’s settings, and uninstalling the app and removing its data folder deletes it from that computer.
5. Third-party services
To provide the Service, data passes through the following providers under their own terms and privacy policies:
- Meta Platforms — WhatsApp Business Platform and Messenger Platform, which carry your messages and calls.
- Twilio and Telnyx — phone calls and SMS, if you connect them.
- Cloudflare — hosts the relay and this website, and may provide network relay servers so calls can connect.
When you send a message or place a call, the app talks to these platforms directly using your own credentials. Their handling of that data is governed by your agreements with them.
6. Call recording and transcription
Call recording is optional and off unless you enable it. Recordings made by the app are stored encrypted on your computer. If you enable WhatsApp’s server-side recording or transcription, Meta plays an announcement to both parties before recording starts, and makes the audio or transcript available for download for up to 7 days; the app downloads it and stores the copy on your computer. You are responsible for obtaining any consent required by the laws that apply to you and the people you call.
7. Your customers’ data
When you use ThreadWave to talk to your own customers, you decide what information is collected and how it is used, and you are responsible for it (as the “controller”). We act only as a service provider (“processor”) for the limited data that passes through the relay, and we process it only to deliver the Service to you.
8. Retention
- Relay events: deleted as soon as your app confirms receipt, and in any case within 7 days.
- Connection and team settings: kept while your account is active, and deleted when you ask us to delete your account.
- Technical logs: kept for a short period by Cloudflare, then deleted automatically.
- Data on your computer: kept until you delete it.
9. Security
Data on your computer is encrypted at rest. Traffic between the platforms, our relay and your app is encrypted in transit, and access to the relay is protected by a secret token. No system is perfectly secure, so please keep your computer, operating-system account and app lock password safe.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict processing. Because most data lives on your own computer, you can exercise many of these rights directly in the app. For data held by our relay, email privacy@threadwave.io, or follow the steps on our data deletion page. We don’t sell personal data or share it for advertising.
11. Children
The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data.
12. Changes to this policy
We may update this policy as the Service changes. We will post the new version here with a new “last updated” date, and tell you in the app or by email if the changes are significant.
13. Contact
ThreadWave, Lahore, Pakistan · privacy@threadwave.io