Effective October 5, 2026. Garnet Thread is operated by Gavin Dinubilo under Toothpaste Apps. This policy explains how the iPhone app and garnetthread.com handle information. For questions or privacy requests, email [email protected].
Your shared content
Garnet Thread gives two people a private shared place. Photos, videos, voice moments, message bodies, and note bodies are encrypted on your iPhone before upload. Our service stores and delivers encrypted content and the envelopes needed by your paired devices. Device private keys stay on the devices; the service does not receive them in plaintext. Your paired person can view content shared with them and may save their own copies.
Encryption does not hide all information from the service. Our encryption explanation describes the boundary and its limits.
Information used to operate the app
We process device and shared-place identifiers, device names and platform information, public encryption keys, authentication records, pairing and membership information, and push-notification tokens. We also process operational metadata such as channel names, timestamps, encrypted file sizes and storage locations, reactions, delivery state, and place lifecycle records.
We use this information to authenticate devices, connect the two people, synchronize content, deliver notifications, enforce access, protect the service, troubleshoot problems, and carry out changes such as moving devices or closing a place.
Subscriptions
Apple processes App Store payments. RevenueCat helps us validate subscriptions and maintain access for both people in a shared place. We process purchase and subscription information, including product identifiers, transaction information, renewal and expiration state, and an app user identifier linked to the installation. We also use RevenueCat’s subscription analytics to understand subscription performance. We do not receive your full payment-card details.
Permissions and your choices
The app requests access to photos, the camera, microphone, or notifications when you use the corresponding feature. You can change these permissions in iPhone Settings. Choosing not to grant a permission limits that feature. The app does not require an email-and-password account to pair two devices.
Website and support
When you visit the website or contact the service, hosting providers process connection information such as IP address, browser details, requested pages, and request timing to deliver and protect it. We use aggregate website traffic information to understand visits. If you email support, we receive your email address, message, and any attachments you choose to send. Support mail is routed through Cloudflare to a Google-hosted inbox.
Service providers and disclosures
We use infrastructure and service providers to operate Garnet Thread, including Cloudflare for website delivery, encrypted media storage and email routing; Hetzner for application hosting; GitHub for deployment and encrypted backups; Apple for distribution, purchases and push delivery; RevenueCat for subscriptions; and Google for support email. These providers process the information necessary for those services, potentially in countries other than your own.
We do not sell personal information or use your private shared content for advertising. We may disclose information when needed to comply with legal obligations, protect people or the service, or complete a business transfer, subject to applicable protections.
Retention and deletion
Shared content remains available while the place is active, unless it is deleted through the app. Leaving or using Safety Exit revokes the requesting device's access; it does not delete the other person's shared place or copies they have saved.
When both people confirm Close Together, the app provides a seven-day grace period followed by a thirty-day export window before the service purges shared content. The dates shown in the app identify that place's window. Purging removes shared content and schedules removal of stored encrypted media. Operational records needed for security, billing, lifecycle history, or legal obligations may remain. Encrypted deployment backups can retain earlier data for up to thirty days.
We retain support correspondence as needed to address requests and keep relevant support records. Email us to request access, correction, or deletion of information we hold about you. We may need to verify the request and account for the other person's rights in shared content. We cannot recover content without its device encryption keys or delete copies someone has saved outside the service.
Security
We use encryption and access controls to protect information. No system can guarantee absolute security. Protect your iPhone and invitations, and contact support if you believe someone has gained unauthorized access.
Changes and contact
We will update this page when our practices change and revise its effective date. For support or privacy requests, contact [email protected].