Last updated July 25, 2026. This page is a plain-language overview of our real data practices, written by us, not a law firm. It's accurate to what the product actually does, but it isn't attorney-reviewed or a complete legal document — if you need a GDPR/CCPA/compliance answer for your own purposes, verify it independently with counsel.
What we collect
Account information
To create an account we collect your email address and a password. The password is never stored in plain text — we hash it with scrypt (a salted, one-way hash) and keep only the hash. Signing in sets a single session cookie; see “Cookies” below.
The lead-discovery app (internal tool, not publicly available)
ThreadSnoop also runs a separate, internal lead-discovery tool that watches Reddit for a specific product and scores what it finds. It isn't a public product — there's no public signup, and it isn't offered or marketed here. For completeness: when it's used, it stores a product description (name, URL, target customer, the problems it solves), the matches it finds, and ratings given to those matches, which train a scoring model. None of this is shared outside the account it belongs to.
Payments
If you buy API credits or a subscription, Stripe collects and processes your card details directly — we never see or store your raw card number. On our side we keep a Stripe customer ID, a ledger of credit grants and top-ups, and the dollar amounts charged, so we can answer billing questions and keep your balance accurate.
API usage
Every API call is logged for metering and support: the endpoint you called, the HTTP status, credits charged, and latency. We do not log or store the actual search terms, subreddit names, or other query parameters you send — usage records are aggregate, not a transcript of what you searched for.
IP addresses
We use IP addresses to slow down abuse — signup/login throttling and free-credit-farming detection. These checks run in memory on our application server and are not written to a database; we don't keep a persistent log of visitor IP addresses. The one exception is a small internal table that logs requests to our upstream Reddit data provider (status codes and rate-limit info, for our own reliability monitoring) — it records nothing about you or your IP address.
Communications
We send transactional email — verification, password reset, and billing receipts — and you can reply to any of it. On rare occasion we reach out directly about ThreadSnoop using publicly available contact information, such as an address listed on your own company site; tell us to stop and we will, and we'll delete what we found.
What we don't do
- We never post, comment, or message anyone on Reddit. The API is strictly read-only — it has no capability to post to Reddit at all. Our internal lead-discovery tool can draft a reply for a human to review, edit, and post themselves from their own Reddit account; nothing is ever posted from our servers, and we don't ask for or store anyone's Reddit login.
- We never sell your personal data to anyone, for any reason.
- We don't run ad trackers or third-party analytics on threadsnoop.com — no Google Analytics, no Meta/Facebook Pixel, no ad-network scripts. The site's fonts are self-hosted at build time, so even loading a page doesn't call out to a third party.
Data retention and deletion
We keep your account data for as long as your account is active. You can delete your account yourself, at any time, from Settings — it's a genuine hard delete, not a deactivation flag: your product profile, discovery alert, matches, ratings, customer memory, API keys, usage history, and credit ledger are all removed in one cascade, along with your login itself. It cannot be undone, and we don't keep a shadow copy afterward.
If you only joined our waitlist, we keep your email address until we invite you or you ask us to remove it.
Cookies
ThreadSnoop sets one cookie: ts_session, used to keep you signed in. It's httpOnly (invisible to page JavaScript), sameSite=lax, marked securein production, and holds nothing but a signed user ID and an expiry — no tracking payload. We don't set any third-party or advertising cookies.
Children's privacy
ThreadSnoop is a business tool and isn't directed at children. We don't knowingly collect personal information from anyone under 13 (or the relevant minimum age in your jurisdiction). If you believe a child has given us information, contact us and we'll delete it.
International users
ThreadSnoop is a small, independently run product, hosted in the United States. If you use it from outside the US, your data is processed there. We aim to honor the spirit of GDPR/CCPA-style rights (access, deletion, correction) for anyone who asks, regardless of location — the self-serve delete above covers most of it, and you can email us for anything else.
Contact
Questions, deletion requests, or anything else about this policy: hello@threadsnoop.com.