link2threadsPrivacy Policy
Last modified: 2026-09-28 | Link2Threads (스타일팩토리9)
1. Data Subject
Link2Threads (the "Service") collects, uses, processes, and protects your personal information as described below.
2. Information We Collect and Use
| Item | Purpose | Retention |
|---|---|---|
| Threads user ID | Threads publishing and account management | Until account deletion |
| Threads username | Post identification and management | Until account deletion |
| Generated card content | Publishing and history management | Until account deletion |
| Verification, notifications | Until account deletion | |
| Account link info | Threads OAuth connection | Until account deletion |
| Threads profile info (username) | Account identification, UI display | Until account deletion |
| Threads OAuth access token (AES-256-GCM encrypted) | API authentication | Until account deletion |
| Post performance data (likes, replies, reposts, quotes) | Dashboard display | Until account deletion |
| usage_log observation column (IP, route, timestamp) | Traffic observation only | Until account deletion |
| Onboarding survey responses (goal, cadence, content type, language) | Service optimization, content personalization | Until account deletion |
3. Information We Do Not Collect
- Passwords: handled via OAuth or PBKDF2 hash, never stored in plaintext.
- Financial data: payments are processed by Paddle; the Service never collects card details directly.
4. Storage and Processing
Storage: Cloudflare D1 (SQLite) — encrypted storage in a distributed global environment.
5. Third-Party Sharing
| Third party | Purpose | Data scope |
|---|---|---|
| Paddle | Payments and subscription management | Email, payment info, plan info |
| Meta/Threads | Publishing and OAuth | Threads user ID, username |
| Cloudflare | Hosting and infrastructure | IP address, logs |
| Brevo (EU-based) | Transactional email delivery | Email address, send-event logs |
| AI providers (via Cloudflare AI Gateway) | AI card generation | Input URL, extracted body text, tone/language instructions |
6. Use Limitation
Data obtained through the Threads API is used only to provide the Service to that user. It is never sold to third parties or used for advertising/marketing purposes.
7. Data Security
- JWT token authentication (HS256, 7-day expiry)
- Threads OAuth tokens encrypted with AES-256-GCM
- API access requires JWT Bearer token
- Cloudflare Workers security infrastructure
8. AI Processing
AI processing is routed through Cloudflare AI Gateway. Multiple AI providers may be used for card generation.
Transmitted: input URL, extracted body text, generated card content, tone/language instructions. Not transmitted: email, account information, Threads OAuth tokens.
Input content may be used by AI providers for their service improvement purposes per their respective privacy policies. Confidential input is prohibited.
Rights-holder opt-out: contract termination and deletion requests are filed at info@link2threads.com.
9. Source URL Retention
Source URLs are stored in the Service database for 1 year. This retention enables response to rights-holder requests within that period, and opt-out enforcement records (request, processing result, reply) are kept as evidence of enforcement.
10. Email Processing (Brevo)
Transactional emails are sent through Brevo (EU-based). Transmitted items: email address and send-event logs (trigger type, send status, timestamp). Service-required notices (verification, system outage alerts, paid-plan quota notices) cannot be opted out; marketing emails can be opted out via the unsubscribe link in each email or by replying to info@link2threads.com.
11. EU Traffic Observation
The Service maintains a usage_log observation column for traffic measurement. The Service is not currently offered to EU users; this column exists only to observe traffic share (EU trigger condition for geogating review).
12. Your Rights
- Access: request access to your personal information
- Correction: request correction of inaccurate information
- Deletion: request deletion of your account and information — by email. You may also revoke Link2Threads' access to your Threads account directly from your Meta account settings. Upon deauthorization, Link2Threads will receive a callback notification and will delete your Threads access tokens and associated data within 30 days.
- Objection: object to collection/processing (may restrict service use)
13. California Privacy Rights (CCPA)
If you are a California resident, you have the right to: (1) know what personal information is collected about you; (2) request deletion of your personal information; (3) opt out of the sale of your personal information — Link2Threads does not sell personal information to third parties; (4) non-discrimination for exercising your privacy rights. To exercise these rights, contact info@link2threads.com.
14. Cookies and Technology
The Service uses localStorage for login session persistence and technical cookies for analytics.
15. Contact
Data protection officer: info@link2threads.com