Privacy update — extension 1.7.109 and aggregate founder reporting

Supplement ID 2026-10-08.2

This update describes extension 1.7.109 and the matching backend and founder-reporting controls deployed on 8 October 2026. It supersedes the earlier 2026-10-08.1 checkpoint for these controls. Earlier notices and accepted contract versions are preserved as historical records; this update does not change contractual rights or create a new acceptance record.

In extension 1.7.109, opening a supported LinkedIn profile or the Threadline research panel reads the current professional profile locally for the existing interface. It does not send that currently viewed prospect's URL, name, company, profile identifier or profile-reference hash to Threadline merely because the page or panel opened. Account authentication, vendor settings, language, credit checks and an account-level download of previously saved Reveal results can still contact Threadline. The extension matches the current profile against those saved results locally; the lookup does not identify which profile is currently being viewed.

When you explicitly request Reveal, the professional profile information and company context required for the existing research and drafting feature are transmitted and processed normally. Previously requested in-flight Reveals can resume. Saved results, sources, generated content, explicit feedback, account access and credit/refund rules remain available under their existing controls. The change does not mean that Threadline collects no data.

Routine founder Analytics now provides aggregate usage and account administration separately. It does not expose named individual usage counts, activity times, per-person costs, prospect browsing history, individual-activity views or individual-usage exports. Small usage groups are suppressed, and account/company labels cannot be used to filter usage into individual reports. Account identity and ordinary account administration remain identifiable. Necessary raw product records and restricted operational access remain; aggregation and suppression are not an unconditional guarantee of anonymity. Human access to extension-derived data must be confined to a documented applicable Limited Use exception, such as the user's explicit consent to read specific data, necessary security work or a legal obligation.

Older extension installations can still send the earlier passive profile payload until updated. The deployed database guard continues to discard new passive profile-view inserts from those clients. Distribution of the verified 1.7.109 download does not establish Chrome Web Store review, publication or automatic installation; check the installed version. Earlier passive records were not deleted and retain the existing 180-day activity cleanup. Product/workspace records, private reporting facts, provider logs and backups have their separate retention rules. This update does not claim zero provider logging, immediate backup deletion, EU-only processing or completion of outstanding supplier/transfer evidence.

Threadline limits extension-data use to its disclosed research and drafting purpose and the related operation and security of that service. It does not sell extension data, use it for advertising or use it to determine creditworthiness. Final Chrome Web Store package/declaration reconciliation remains a separate verification step; this notice is not Chrome approval or a blanket legal-compliance certification.

For access, correction, deletion, restriction or objection requests, including requests from prospects without a Threadline account, contact admin@threadlinehq.io. Existing rights and contact routes continue to apply.