Threads Studio Privacy Policy

1. Who operates Threads Studio

NAQIU DIGITAL VENTURES, Malaysia, operates Threads Studio at studio.celik-ai.my. Its associated Meta developer app is currently named Threads App.

The current service is for the operator’s own accounts. It does not offer public signup or client onboarding. This policy also covers information about other people contained in authorized Threads posts, replies or references saved in the workspace.

Privacy contact: naqiuddin1311@gmail.com.

2. Information the app uses

• Workspace access: login email, user identifier and authentication session.
• Connected accounts: Threads user IDs, usernames and access tokens provided or authorized for those accounts.
• Threads content and activity: post and reply text, author usernames, links, timestamps and available account or post performance metrics returned by permitted API calls. Keyword search results are used only when the app and account have the required access.
• Planning records: saved references, manually entered source material, Brand DNA (such as niche, audience, language, tone and factual knowledge), drafts, approvals, schedules, publication status and daily routine records.
• Technical information: request, device/browser, network and security metadata processed by the hosting and infrastructure services to deliver and protect the app.

Information comes from the workspace owner, authorized Meta/Threads API requests and the services that deliver the app. Avoid entering unnecessary confidential or sensitive information about yourself or other people into references, Brand DNA or AI inputs.

3. How the information is used

The app uses information to authenticate the owner, identify connected accounts, organize account-specific content, retrieve permitted posts and replies, show available insights, find relevant conversations when authorized, and support content planning.

The owner can save selected references and request draft posts, briefs, analysis or reply suggestions. Publishing requires an explicit publishing action or an approved schedule when scheduling is enabled. Approving a draft alone does not publish it. The current production scheduler is disabled, and the app does not automatically send replies.

The app’s workflow does not sell personal information, export advertising audiences or continuously monitor people. Public search access remains subject to Meta’s authorization and availability.

4. AI features

When the owner requests AI assistance, relevant reference text, Brand DNA, account context (which can include account identifiers), drafts and instructions are sent to the configured AI service. The app supports the OpenAI API and an operator-managed Hermes service on a virtual private server. Hermes passes requests to its configured model provider.

AI processing can occur outside Malaysia. Threads access tokens and backend credentials are not intentionally included in AI prompts. Inputs are not necessarily anonymized.

The app requests that generated responses not be stored where the provider supports that setting. This does not guarantee zero retention: Hermes sessions and model or infrastructure providers may retain operational records, logs or backups under their own settings and terms. AI output can be inaccurate and must be reviewed before use.

5. Services that process information

• Meta / Threads: authorized account and content access, insights, search requests and publishing.
• Supabase: workspace authentication, database storage and backend functions. The current project’s database region is Seoul, South Korea; this is not a statement that all processing occurs there.
• Cloudflare: web app hosting and delivery, session verification, security, DNS/HTTPS and the authenticated connection to the AI service.
• Netlify: a private backup deployment and its hosting/request metadata.
• The operator’s Hermes hosting and configured AI provider: requested AI input and generated output, with processing and retention dependent on the active service configuration.

Providers may use subprocessors and process information in multiple countries, including through remote support, security operations and backups. The database location does not determine every provider’s processing location.

Information may also be disclosed when required by applicable law or when reasonably necessary to address security incidents or protect rights. An AI suggestion or an app-held copy of a public post does not change the source platform’s own privacy practices.

6. Access, security and browser storage

Threads credentials are encrypted on the server and are not returned to the browser after connection. Backend authorization and database access controls restrict live workspace records to the authorized owner. The app uses HTTPS for service connections.

The browser retains the workspace login session. A secure, HTTP-only, short-lived cookie is used to unlock private dashboard files after session verification. Clearly labelled demo data may be stored locally and is separate from live account records.

This public policy page does not load the portfolio’s Google Analytics script or require a workspace login. Its hosting services still process request and security metadata. Separate analytics practices for the main portfolio website are described in its website privacy information.

7. How long information is kept

Saved references, Brand DNA, drafts and routine records remain in the workspace until the operator removes them or deletes the workspace. The current app has no automatic purge period for these records. Connected credentials remain stored until removed or replaced; expiry or revocation can stop API access without deleting existing workspace records.

Service-provider logs, AI session records and backups may have separate retention periods. Deleting live app records does not immediately erase every provider backup or operational record. Any specific limitation affecting a deletion request will be explained in the response; this policy does not promise an unverified deletion deadline or zero retention.

8. Access, correction and deletion requests

To ask about information relating to you, request a correction, or request deletion of data held by Threads Studio:

1. Email naqiuddin1311@gmail.com with the subject “Threads Studio privacy request”.
2. Give the relevant Threads username or source post link and explain the request. For a connected account, specify whether you want its stored credentials removed, its workspace records deleted or the whole workspace deleted.
3. Do not send passwords, access tokens, authentication codes or login links. The operator will verify the request using an appropriate account/contact check and request only information needed to do so.
4. The operator will assess the request, remove or correct applicable live app records where appropriate, address relevant service-provider records through available procedures, and confirm the outcome and any specific retention limitations.

Deletion currently requires operator assistance; there is no self-service delete button. Relevant records can include account identity, stored credentials, saved references, Brand DNA, drafts, schedules, publication records and routines. Scheduled work must be stopped and any publishing already in progress checked before a connected account is removed.

You can revoke the app’s authorization in the relevant Threads/Meta account controls to stop future authorized access. Revocation and deletion of saved workspace data are separate actions.

Deleting information from Threads Studio does not delete posts already published on Threads. Use Threads to remove those posts. Records that must be retained for a specific legal or security reason may be excluded from deletion, with the reason and limitation explained to the requester.

9. Changes to this policy

Updates will be published at this URL with a revised date when the app’s processing changes. Public registration, client onboarding or materially different automation will require an updated policy before rollout.