Extension sign in and account connections

Supplement 2026-10-12.1

Extension 1.7.111 lets you sign up or log in directly with Google or your email and password. After required account setup and agreement steps, the extension connects automatically. You do not generate or paste a pairing code in this version. Your web dashboard uses the same Threadline account and can remain signed in separately.

Threadline authorizes one active extension login session per account. Signing in through another extension replaces the previous extension session and revokes its refresh session. Protected extension requests must match the currently authorized session. Multiple tabs in the same Chrome profile share that extension session. Teams members use their individual accounts and seats. You can sign out the active extension from Connection in the dashboard without signing out the dashboard. Account-level session revocation and deletion controls remain available. Work already started may finish; signing out does not erase information already displayed or copied.

To maintain this connection, the extension keeps its Auth access and refresh tokens and a random connection credential in local Chrome extension storage. Newly created connection credentials are not placed in Chrome sync storage. The existing internal storage key my_pairing_code now holds that opaque credential, not a code the user must enter. During unfinished setup, the pending Auth session and its activation credential are stored locally until connection completes or setup is signed out. A transient Chrome session-storage preference remembers whether you chose Sign up or Log in; it contains no credentials. The server stores a hash of the connection credential, the associated Auth session identifier, account identifier, connection status and timestamps. These are necessary authentication and account-access records; this change does not add hardware fingerprinting, location tracking or browser-history collection.

Active authorization is checked against the live Auth session. It ends when replaced, signed out, revoked, deleted with the account or no longer backed by a valid Auth session. Daily cleanup removes expired temporary handshakes and ended connection records while preserving a live connection. The old two-minute code lifetime does not expire an active extension login. Older extension versions retain a compatibility handshake during rollout and should be updated. A connection created before session binding may require a fresh sign-in; the account, company profile, plan, credits and saved research are preserved.

This control limits active login sessions. It does not identify a physical person or guarantee that deliberately copied authentication credentials cannot be shared. Keep your account credentials private and use the individual accounts or seats required by your plan.

Signing in, reconnecting or repeating setup neither consumes a Reveal nor grants another Free allowance. This release does not change prices, plan entitlements, credit/refund rules, AI providers or prompts, extension permissions, professional-data collection, marketing choices, customer rights or the separate real-payment activation gate. Accepted legal bundle 2026-10-07.1 and its acceptance history remain unchanged. This dated update supplements the previous authentication, storage and security descriptions; earlier notices remain historical where superseded.

For account or privacy assistance, contact admin@threadlinehq.io.