Privacy policy

Last updated: not yet published

In short

• ThreadWeaver runs on your PC. Your email goes from your mail provider straight to your PC and is stored there.
• We never receive your email, your passwords or anything about how you use the app. There are no FatCat Tech servers in between, no tracking and no usage statistics.
• It reads your mailbox; it never changes or deletes anything there. It sends an email only when you write one and press send.
• AI summaries are optional, off by default, use your own Anthropic account, and only send a conversation when you press Summarise.

Who we are

ThreadWeaver is made by FatCat Tech (“we”, “us”). Because ThreadWeaver keeps your email on your own PC and doesn’t send it to us, we don’t process the contents of your mailbox and aren’t its data controller: you are in control of it. We are the data controller for the information you send us if you contact us for support (see who else is involved). Contact: info@fatcattech.co.uk.

What ThreadWeaver accesses

Only the mailboxes and files you choose to add. From those, ThreadWeaver reads:

• email headers: sender, recipients, CC, subject, date, and the technical headers that link replies together or mark mailing lists;
• the text of each email;
• the names of attachments. The attachments themselves are only downloaded when you press Download full message;
• folder names, so it can show where an email is filed and skip Junk, Deleted and Drafts;
• for Microsoft accounts, your name and email address, to show which account is connected.

Microsoft 365 / Outlook.com permissions: Mail.Read (read your mail; it cannot change or delete it), User.Read (your name and email address), offline_access (stay signed in between syncs), and only if you send from a Microsoft account, Mail.Send (send email as you), which you’re asked for separately the first time you send.

IMAP and POP3: your server details, user name and password, so ThreadWeaver can connect. Folders are opened read-only.

ThreadWeaver does not collect crash reports, analytics, location, contacts, calendars or anything from outside the mailboxes and files you add.

How that information is used

Everything ThreadWeaver reads is used on your PC, for you, to:

• group your email into conversations and by person;
• remove quoted replies, signatures and disclaimers (it learns these by counting lines that repeat in your mail; no AI is used);
• let you search;
• send the replies and new emails you write;
• create a summary of a conversation, only when you ask for one.

It is never used for advertising, never sold, never shared with us, and never used to train AI models by us.

Where it is stored and for how long

• Your email (the cleaned text, headers and what was removed) is kept in a database file on your PC, in %LOCALAPPDATA%\ThreadWeaver, along with any original emails and attachments you download. It stays until you remove the account in ThreadWeaver or delete that folder.
• Passwords and API keys are kept in Windows Credential Manager, protected by your Windows sign-in, and never in the database.
• Microsoft sign-in tokens are kept in the same folder, encrypted so that only your Windows user account can read them. ThreadWeaver never sees your Microsoft password, because you sign in on Microsoft’s own page.
• Removing an account in ThreadWeaver deletes its emails and saved password from your PC. Nothing is deleted from your mailbox.

Who else is involved

ThreadWeaver talks directly to these services, and only these, on your behalf:

• Your mail provider (Microsoft, Google, your internet provider and so on) to fetch your mail and send what you write. That’s the same as any email app, and their own privacy policy applies.
• Microsoft, when you sign in with a Microsoft account. Microsoft handles the sign-in and records that you allowed ThreadWeaver access.
• Anthropic, only if you add your own API key and press Summarise. The text of that one conversation (never attachments) is sent to Anthropic’s Claude API, under your own Anthropic account and Anthropic’s terms and privacy policy. We never see it.

Nothing is sent to FatCat Tech. If you email us for support, we use what you send only to help you, keep it no longer than needed for that, and don’t share it.

This website doesn’t use cookies or analytics for these pages. Like any website, our hosting provider keeps standard server logs (such as IP addresses and pages requested) for security and to keep the site running.

Security

• Connections to Microsoft and Anthropic always use HTTPS. Connections to mail servers use SSL/TLS encryption wherever the server supports it, which all major providers do.
• Passwords and keys are held by Windows Credential Manager; Microsoft sign-in tokens are encrypted with Windows data protection (DPAPI) for your user account.
• The stored emails are only as protected as your PC: anyone signed in as you can read them. Use a Windows password and, ideally, device encryption (BitLocker).

Your rights

Your mail stays under your control on your PC, so you can see, export or delete it at any time (see uninstalling and removing access). For anything you’ve sent us, under UK data protection law (the UK GDPR) you have the right to ask for a copy, to have it corrected or deleted, and to object to how we use it. Email info@fatcattech.co.uk. If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.

Removing ThreadWeaver’s access

You can stop ThreadWeaver accessing your account at any time. See uninstalling and removing access for step-by-step instructions.

Changes to this policy

If this policy changes, we’ll update it here and change the “last updated” date at the top. If a change affects what ThreadWeaver accesses or sends anywhere, we’ll also say so in the release notes on the ThreadWeaver page.

Contact

Questions about this policy or your data: info@fatcattech.co.uk