This policy explains what personal data Massthread collects, why we collect it, who we share it with, how we protect it, how long we keep it, and what you can ask us to do with it. It covers the Massthread web application, the massthread.com website and the e-mail we send.
We have written it to be specific rather than reassuring. Where something is not yet automated, or where a limitation exists, we say so plainly in this document instead of implying otherwise.
1. Who we are
Massthread is a product of Cinute InfoMedia, a sole proprietorship of Sandeep Maske, operating from India. For the purposes of India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described in this policy. Under laws that use the term, we are the data controller.
Cinute InfoMediaOffice #3, 2nd Floor, Ashley Tower, Kanakia Road,
Vagad Nagar, Beverly Park, Mira Road East,
Mira Bhayandar, Mumbai 401107, Maharashtra, India
tech@massthread.com
India-specific rights, the Grievance Officer and escalation to the Data Protection Board are set out in our DPDP Compliance Notice, which forms part of this policy.
2. Who this policy is about
This policy covers three groups of people, and they are not treated the same:
- Our customers — the people who create a Massthread account. We decide how their data is handled, so we are the Data Fiduciary for it.
- Newsletter subscribers added by our customers. When a customer uploads or imports a subscriber list, that list belongs to the customer. They decide what it is used for; we process it on their instructions. If you are on such a list and want to be removed, use the unsubscribe link in the e-mail, or write to us and we will pass your request to the customer and act on it ourselves.
- Visitors to massthread.com, including anyone who writes to us through the contact form.
3. Data we collect
3.1 Data you give us
- Account identity: e-mail address, display name, an avatar if you upload one, and a password, which we store only as a bcrypt hash.
- Two-factor authentication: if you enable it, an encrypted TOTP secret and the SHA-256 hashes of your eight single-use recovery codes.
- Workspace and team data: workspace name, plan, member roles, and the e-mail addresses you invite.
- Brand profile: brand name, tagline, website, industry, description, logo, brand colours, voice and tone settings, and the contact details you choose to put on your posts — which may include a phone number, e-mail address and social handles.
- Newsletter subscribers you add manually, import from CSV, import from Google Contacts, or collect through a sign-up form.
- Contact-form submissions: name, e-mail, company, reason and your message.
3.2 Data from the accounts you connect
When you connect a social account, we receive and store an encrypted access token and, where the platform issues one, a refresh token, together with the granted scopes and a small amount of public profile data: the platform's internal id for your account, your display name, handle and avatar URL. Section 5 covers this in detail.
3.3 Data the product creates
- Content: briefs, post bodies, hashtags, mentions, links, long-form drafts and newsletter copy — whether you wrote them or the AI drafted them.
- Media: images and video you upload or the AI generates, with filename, type, size and dimensions.
- Performance metrics for posts we published for you: impressions, reach, likes, comments, shares, saves, clicks, views and profile visits, plus the raw response the platform returned.
- Keyword and hashtag research cached per brand.
3.4 Data collected automatically
- Session data: a session record and a signed session cookie.
- Audit log: who did what and when inside a workspace, including the acting user's id and e-mail, the action, and a before/after diff of the change.
- E-mail engagement: when Resend tells us an e-mail was delivered, opened, clicked, bounced or marked as spam, that event includes the recipient's IP address and user-agent, which we store.
- Push subscriptions: if you enable browser notifications, the push endpoint URL, its keys and your browser's user-agent string.
- Billing data: your Stripe customer and subscription ids, plan, status and period dates. We never see or store your card number — that goes directly to Stripe.
We do not run advertising trackers, we do not sell personal data, and we do not buy personal data about you from anyone.
4. Why we use it
| Purpose | Data used | Basis |
|---|---|---|
| Run your account | Identity, session, workspace, roles | Performance of our contract with you |
| Plan, draft and schedule content | Brand profile, goals, existing content | Contract |
| Publish to your connected accounts | OAuth tokens, post content, media | Your consent, given per platform |
| Report performance | Metrics for posts we published | Contract |
| Send service e-mail | E-mail address | Contract |
| Send your newsletters | Your subscriber list | On your instructions, as your processor |
| Take payment | Billing identifiers | Contract, and legal record-keeping |
| Keep the service secure | Audit log, rate-limit counters | Our legitimate interest in preventing abuse |
We do not use your content or your metrics to build products for anyone else, and we do not pool your data with other customers' data.
5. The social accounts you connect
This is the most sensitive data Massthread holds, so we describe it exactly.
5.1 How tokens are stored
Access and refresh tokens are encrypted before they are written to the database, using AES-256-GCM with a fresh random initialisation vector for every value. They are never returned in any Massthread API response.
One exception we disclose for completeness: some platform APIs require the access token to be sent as a URL query parameter rather than as a header. Instagram's insights endpoint is one. For those calls the token appears in the URL sent to that platform. We are moving these calls to header-based authentication wherever the platform supports it.
5.2 What we do, and do not do, with your accounts
We use your tokens for exactly two things:
- publishing content that you have reviewed and scheduled; and
- reading back the performance of the posts we published for you.
We do not read your direct message inbox. We do not browse, follow, like, react to or message anyone on your behalf. We do not read other people's posts. We do not scrape platforms, and we do not use any data obtained from a platform to train AI models.
One disclosure. The permission sets we currently request for Instagram and
Threads include permissions covering comments and replies
(instagram_business_manage_messages, instagram_business_manage_comments,
threads_manage_replies, threads_read_replies). No part of Massthread
uses them — nothing in the product reads, writes or stores comments, replies or messages —
and we are removing them from the permission request. We are telling you this rather than
describing a narrower request than we actually make.
5.3 Permissions we request, per platform
| Platform | Scopes requested |
|---|---|
| Facebook / Instagram (Meta) | pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata, business_management, instagram_basic, instagram_content_publish |
| Instagram (direct) | instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights, and the two comment/message permissions noted in 5.2 |
| Threads | threads_basic, threads_content_publish, threads_manage_insights, and the two reply permissions noted in 5.2 |
openid, profile, email, w_member_social; for Pages also r_organization_social, rw_organization_admin, w_organization_social | |
| X | tweet.read, tweet.write, users.read, offline.access |
| YouTube | youtube.upload, youtube.readonly |
| Blogger | blogger |
| Google Business Profile | business.manage |
| TikTok | user.info.basic, video.upload, video.publish |
pins:read, pins:write, boards:read, user_accounts:read | |
identity, submit, read, mysubreddits, flair | |
| Shopify | write_content, read_content |
5.4 Google user data — Limited Use
Massthread's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you asked for, we do not transfer it except as required to provide those features or for security or legal reasons, we do not use it for advertising, and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with the law, or where the data is aggregated and anonymised.
5.5 Disconnecting
Pressing Disconnect inside Massthread deletes the connection record immediately, and with it the encrypted access token, the refresh token, the stored scopes and the cached profile data.
If instead you revoke our access at the platform, the next time we try to use that connection it fails and we mark it expired. The stored credentials are then dead, but they are not yet erased automatically. Press Disconnect, or write to tech@massthread.com, and we erase them within 24 hours. We are changing the product so that an expired connection erases its own credentials, and we will update this section when that ships.
6. AI processing
Massthread uses Google's Gemini API to plan, write and illustrate content. When you ask it to generate something, we send Google the material it needs: your brand name, tagline, industry, website, description, voice and tone settings, the goal you set, and the existing or draft content being worked on. Generated images are produced the same way and stored in our object storage.
We use the Gemini API on a paid tier. Under the terms that apply to the paid tier, the data we submit is not used to train or improve Google's models. This commitment depends on our account remaining on the paid tier; if that ever changes we will update this policy before the change takes effect.
A brand's own past performance figures can optionally be summarised to guide that same brand's future drafts. This feature is disabled by default. It never mixes one customer's data into another customer's suggestions.
The AI does not publish anything by itself. Every post waits as a draft until a human schedules it.
7. Who we share data with
We do not sell personal data and we do not share it for anyone else's marketing. We use the following processors, each bound to act only on our instructions:
| Processor | What it receives | Where |
|---|---|---|
| Google (Gemini API) | Brand kit and content prompts; returns drafts and images | Outside India |
| Cloudflare, Inc. (R2) | Image and media file bytes — generated images, avatars, logos, uploads, newsletter art | Outside India |
| Resend | Recipient address, subject, full message body; returns delivery events including recipient IP and user-agent | Outside India |
| Stripe | Your e-mail, name and workspace id; handles card details directly | Outside India |
| Browser push services | Notification content sent to your browser vendor's push endpoint | Varies by browser vendor |
| Platforms you connect | Your access token and the post content and media being published | Varies by platform |
| Google People API | Only if you choose to import contacts: your Google token; returns contact names and e-mail addresses | Outside India |
| Webhooks you configure | Signed event payloads sent to a URL you choose. You are responsible for that destination | Wherever you point it |
We also disclose personal data where the law requires it, and we would transfer it as part of a merger or sale of the business — in which case we would tell you before your data became subject to a different privacy policy.
8. Transfers outside India
The processors above operate outside India, so running Massthread necessarily involves transferring personal data out of India. We do this under Section 16 of the DPDP Act, which permits transfer to any country the Central Government has not restricted. We rely on each provider's contractual data-protection terms. If India restricts a country we use, we will move that processing.
9. How we protect your data
These are the measures actually implemented in the product today:
- Passwords stored as bcrypt hashes with cost factor 12 — never in plain text, never reversible.
- Platform tokens encrypted at rest with AES-256-GCM, unique IV per value.
- Optional two-factor authentication (TOTP). A correct password alone does not create a session for a 2FA account — it only produces a five-minute challenge that must be completed.
- Recovery codes stored only as SHA-256 hashes and usable once.
- Password-reset, magic-link and API tokens stored only as SHA-256 digests, never in readable form.
- Session cookies are
httpOnly,securein production andsameSite=lax. - Same-origin (CSRF) checks on every state-changing browser request. Requests authenticated with a personal API token are exempt by design, because they carry no ambient cookie and so cannot be triggered from another site.
- OAuth handshakes protected by a signed, 10-minute, single-use state token.
- Uploads capped at 5 MB with the file type verified from the file's own bytes rather than its declared type, and filenames replaced with server-generated ids.
- Rate limiting on authentication and other sensitive endpoints. These counters are held in application memory unless a shared backend is configured; on our current deployment they apply per application instance rather than globally.
- Every workspace and brand request re-checks your membership before acting.
- Changing your password signs out all your other sessions.
- Inbound e-mail webhooks are signature-verified and rejected outright in production if the signature cannot be checked.
No system is perfectly secure, and we do not claim certifications we do not hold. If a breach affects your personal data we will notify you and the Data Protection Board of India as the DPDP Act requires.
Media files are served from public URLs
Images and media — including generated images, avatars, logos and anything you upload — are stored in object storage and served from a public base URL. Anyone who has the URL of a file can open it without signing in. The URLs are long and unguessable, but they are not access-controlled. Please do not upload anything you would not be willing to share with someone who has the link.
10. How long we keep data
| Data | Kept for |
|---|---|
| Account and workspace data | Until you ask us to delete it |
| Sessions | 30 days, or until you sign out |
| Platform tokens | Until you disconnect — see section 5.5 for the revocation case |
| Content and drafts | Life of the brand |
| Performance metrics | Refreshed for 30 days after a post is published, then kept as your history — see the note below |
| Audit log | Life of the workspace |
| Billing records | As long as tax and accounting law requires |
| Contact-form messages | Until the query is resolved, then deleted on request |
What deletion does and does not do today
We would rather tell you this than let you assume otherwise:
- Deleting a single media asset removes both the database record and the underlying file from storage.
- Deleting a brand, workspace or account removes the database records, but does not yet delete the stored media files automatically. We delete them on request. We are building the sweep that will make this automatic.
- Metric rows are not yet removed automatically when a brand or account is deleted. They persist, including the cached platform response, until we delete them on request.
- Account closure is performed manually by us, in writing, within seven days of your request — there is no self-service delete button yet. We delete the workspaces you own, which removes their brands, connected accounts and encrypted tokens, content, media records and subscriber lists, and then delete your user record.
Write to tech@massthread.com and we will do all of this and confirm in writing exactly what was deleted. We will update this section as each piece becomes automatic.
11. Your rights
Whoever and wherever you are, you can ask us to:
- See what personal data we hold about you and who we have shared it with.
- Correct anything inaccurate, incomplete or out of date.
- Delete your data, subject to anything we must keep by law.
- Export your data. Workspace owners can already export a full JSON copy of every brand, post, media record, audit entry, member and API token from inside the product.
- Withdraw consent — for example by disconnecting a platform or unsubscribing. Withdrawing consent does not undo what was lawfully done beforehand.
- Complain to us, and escalate if we do not resolve it.
Write to tech@massthread.com. We will acknowledge within 72 hours and respond substantively within 30 days. We may need to verify your identity first, and we will only ask for what is necessary to do that.
If you are in India, the DPDP Compliance Notice sets out your statutory rights, our Grievance Officer, and how to escalate to the Data Protection Board of India.
12. Cookies
Massthread sets a small number of strictly necessary cookies and nothing else. There are no advertising cookies, no analytics trackers and no third-party profiling on our site or in the app.
| Cookie | Purpose | Life |
|---|---|---|
nos_session | Keeps you signed in. httpOnly, secure, sameSite=lax | 30 days |
| Two-factor challenge | Holds a login part-way through 2FA | 5 minutes |
| OAuth state | Protects a platform connection handshake | 10 minutes |
This website loads fonts from Google Fonts, which means your browser makes a request to Google to fetch them.
13. E-mail we send, and the newsletters you send
Service e-mail — verification, password resets, sign-in links, failure alerts — is part of the product and cannot be switched off while you hold an account.
For newsletters our customers send, we act on the customer's instructions. Delivery events come back to us from Resend and include the recipient's IP address and user-agent alongside opens and clicks. Every newsletter carries a working unsubscribe link, and unsubscribing is honoured immediately.
If you are a customer importing a list, you are responsible for having a lawful basis to contact those people. Do not upload a list you did not collect properly.
14. Children
Massthread is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18. Indian law treats anyone under 18 as a child and requires verifiable parental consent before processing their data, and prohibits tracking or behavioural advertising directed at them — we do neither. If you believe a child has given us personal data, write to us and we will delete it.
15. Changes to this policy
When we change this policy we will update the version and date at the top. For changes that materially affect your rights or how we use your data, we will e-mail account holders before the change takes effect. Continuing to use Massthread after that means the updated policy applies.
16. Contact us
For anything in this policy — questions, requests, complaints — write to tech@massthread.com, or by post to the address in section 1. We read every message.
Grievance Officer details and escalation rights for India are in the DPDP Compliance Notice.