Privacy Notice

Last updated: 5 June 2026 · Version 2.6

ICO registered data controller · Registration: C1896585

1. Who we are

EverythingThreads is operated by Kariem A., trading as EverythingThreads, as a sole trader registered in the United Kingdom. We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number C1896585.

This notice explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: hello@everythingthreads.com

2. What data we collect and why

Newsletter subscribers (Substack / Beehiiv)

  • Email address — to send you the newsletter you subscribed to
  • Subscription date and preferences — to manage your subscription
  • Lawful basis: Consent (UK GDPR Article 6(1)(a))
  • You can unsubscribe at any time using the link in any email

M-Code Quiz and interactive tools with optional email

  • The M-Code Quiz optionally collects your email address to send you your quiz result and subscribe you to the EverythingThreads newsletter
  • You can skip the email step and still see your result — email is not required
  • If provided, your email is sent to Beehiiv (our newsletter platform) with your quiz result M-code for personalisation
  • Lawful basis: Consent (UK GDPR Article 6(1)(a)) — you chose to enter your email

LiveScope web tools

  • When you paste AI-generated text into a tool and submit it, that text is sent to our Cloudflare Worker or Netlify serverless function
  • Before the text is passed to the scoring model, our server applies automated PII detection and removes recognisable personal data patterns
  • The anonymised text is then sent to Claude on AWS Bedrock under the EU cross-region inference profile (inference is restricted to AWS regions in the EU and the UK — Ireland, London, Paris, Frankfurt, Stockholm, Milan, and Spain) to generate a risk score. AWS hosts the model weights; prompts and completions are not shared with Anthropic, and AWS does not retain them under our terms
  • The anonymised text is not retained after scoring. Scores may be cached for up to one hour using Upstash Redis
  • Evaluation scores and metadata (not raw text) are stored in Neon PostgreSQL for research
  • Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f))

LiveScope browser extension

LiveScope is published to the Chrome Web Store as the canonical build. Builds for Microsoft Edge Add-ons, Firefox AMO, and Safari are also available. The data flow described below applies identically across all four browser builds, with one privacy-positive difference noted under “On-device scoring path” below.

  • The extension operates on supported AI chat platforms only: ChatGPT (chat.openai.com, chatgpt.com), Claude (claude.ai), Google Gemini (gemini.google.com), Mistral Le Chat (chat.mistral.ai), and Microsoft Copilot (copilot.microsoft.com). These are the AI services you already use directly; the extension simply reads the AI response rendered on the page in your own browser session. We do not call those providers' APIs on your behalf from this extension.
  • The AI response text visible on the page is the only content ever sent for scoring. The extension does not capture your prompts, only the AI-generated response
  • PII detection and anonymisation applies before any processing
  • Extension settings (enabled state, sensitivity mode, evaluation counts, locale preference, opt-in flag for the on-device path, and — for paid-tier subscribers — an API key used solely to validate tier access) are stored in the browser's sync and local storage on your device. The API key is sent only to our own Cloudflare Worker and is never shared with any third party.
  • Local reliability-score history (the last 50 scores, used to render the trend sparkline in the popup) is stored in your browser's local storage and never transmitted
  • Page metadata captured alongside each evaluation: the AI platform domain (e.g. chatgpt.com), and the visible name of the model selector on that page (e.g. “GPT-5”, “Claude Sonnet 4.6”). This is not personal data; it is used to populate the per-model breakdown on the public model comparison page.
  • Optional “File Track” image provenance check (opt-in, off by default): if you turn the File Track toggle on in the popup, the extension will extract image URLs from the AI response on the page (skipping any URL that carries a signature, presigned token, or basic-auth credentials) and forward only those clearly-public image URLs to our own c2pa-checker.kariem.workers.dev worker. That worker fetches the first 10 MB of each asset to look for C2PA / JUMBF / known AI-generator markers and returns a provenance badge. No prompt text, no response text, and no identifier of yours is sent on this path. The feature is off by default; you control it from the popup.
  • Lawful basis: Consent — you installed the extension and accepted the consent gate on first run; for the optional File Track toggle, your explicit opt-in

On-device scoring path (privacy-positive option)

  • On Chrome and Edge builds (v1.2.13+), an opt-in on-device scoring path is available. When enabled, AI response text is scored locally in your browser and never transmitted to our Cloudflare Worker
  • The on-device path runs in cascade: first Chrome's built-in Prompt API (Gemini Nano), then a self-hosted WebLLM model (Gemma 2-2B-it, ~1.4 GB downloaded once from Hugging Face and cached in your browser's IndexedDB)
  • Model weights are static binary tensors. They are downloaded once on first activation of the on-device path and never contacted again unless you clear browser storage
  • The on-device path is unavailable on Firefox and Safari (the offscreen document API required by WebLLM is not implemented in those browsers). On those builds the extension uses the Cloudflare Worker scoring path described above
  • When the on-device path is active, no network request is made for scoring. Privacy maximised for users who can afford the local-storage and compute cost
  • On-device scores are presented as a coarse approximation and labelled as such; the published reliability-index methodology and any agreement statistics apply to the cloud-scored path only

LiveScope mobile app (launching soon — the following applies once the app is generally available)

  • The mobile app is a React Native build with an embedded browser view. You will sign into your own ChatGPT, Claude, Gemini, Mistral, or Microsoft Copilot account inside the app; we do not see your platform credentials
  • When the LiveScope toggle is ON, the AI response text rendered in the embedded browser will be sent to our Cloudflare Worker for scoring (same EU/UK-restricted Bedrock flow as the web tools and browser extension; PII anonymisation applies before any processing)
  • Subscription billing will be processed through Apple In-App Purchase (iOS), Google Play Billing (Android), or Stripe (web). We will receive transaction confirmations and a subscription status flag — we will not receive your card number, billing address, or full purchase history. Apple, Google, and Stripe are independent data controllers for the payment data they hold
  • RevenueCat will unify Apple and Google subscription state. Clerk will issue authentication JWTs for the mobile endpoints
  • Sentry will provide crash reporting once configured (currently the SENTRY_DSN environment variable is not set — the SDK ships in the build but emits nothing). When active, Sentry will receive stack traces, device model, OS version, and a non-identifying user hash; PII is scrubbed client-side before any report leaves the device
  • Lawful basis: Performance of contract (for paid users) and consent (for the LiveScope toggle and crash reporting)

Live model comparison (everythingthreads.com/model-comparison)

  • Once a day, our worker sends a fixed set of pre-published benchmark prompts to a roster of frontier AI models (Anthropic, OpenAI, Google, Groq, Mistral) to collect their responses for comparative analysis.
  • The prompts are written by us and contain no personal data. The visitor on the page does not send any data to any model provider — the page only reads cached aggregate scores from our database.
  • Each response is scored by a separate judge model (Anthropic Claude Haiku) and the aggregate is published on the public page with confidence intervals.
  • Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)) — independent research and transparency.

Browser-only tools

  • Self-Anchor, Session Bridge, Signal Check, and other client-side tools process text entirely in your browser
  • No text is transmitted to our servers
  • Voice recording uses your browser's Web Speech API — audio is processed locally

3. Supported AI platforms and sub-processors

Supported AI platforms (where LiveScope runs — not our sub-processors)

These are the AI services you sign into directly in your own browser session. LiveScope reads the rendered AI response on those pages; we do not call their APIs on your behalf and they do not process user data as our sub-processor. Your relationship with each provider is governed by the provider's own privacy policy.

Sub-processors (entities that process user data on our behalf)

  • Amazon Web Services (AWS Bedrock) — runs Anthropic's Claude model (Haiku 4.5 for Tier 1; Sonnet 4.6 for Tier 2 / Tier 3 / Deep Audit) as our scoring engine. We invoke Bedrock via its EU cross-region inference profile, which keeps inference within the EU and the UK (the profile routes across Ireland, London, Paris, Frankfurt, Stockholm, Milan, and Spain — geographies covered by UK–EU adequacy in both directions). AWS hosts the model weights; prompts and completions are not shared with Anthropic, and AWS does not retain them under our terms. Privacy policy
  • Cloudflare — runs our scoring API (the worker that receives your anonymised text before invoking Bedrock). Cloudflare also hosts the c2pa-checker.kariem.workers.dev worker described in the next bullet. Privacy policy
  • c2pa-checker (our own Cloudflare worker) — invoked only when the optional “File Track” toggle is on. Receives image URLs extracted from the AI response on the page (signed / token-bearing URLs are filtered out before any URL leaves the device), fetches the first 10 MB of each public asset, and returns a C2PA / JUMBF / AI-generator-marker provenance badge. Stateless; no logging of user-identifying data; CORS-open public service. Purpose: help users see whether images in an AI response carry verifiable provenance. Lawful basis: explicit opt-in via the popup toggle. Off by default.
  • Netlify — hosts this website and the legacy web-tools serverless functions. Privacy policy
  • Neon — PostgreSQL database for evaluation metadata (EU region). Privacy policy
  • Upstash — Redis cache for one-hour score caching (EU region). Privacy policy
  • Langfuse — LLM observability (EU-based, EU data residency). Privacy policy
  • Groq — Boardroom multi-model chat (zero data retention). Privacy policy
  • Stripe — payment processing for the LiveScope Pro and AI Clarity paid tiers (independent data controller for payment data). Privacy policy
  • RevenueCat — will unify Apple In-App Purchase and Google Play Billing subscription state for the mobile app (forthcoming). Privacy policy
  • Clerk — will issue authentication JWTs for the mobile-app endpoints (forthcoming). Privacy policy
  • Sentry — crash reporting for the mobile app (forthcoming; the SDK ships with the build but emits nothing until the SENTRY_DSN environment variable is configured). Privacy policy
  • Resend — transactional and operational email delivery. Privacy policy
  • Beehiiv — newsletter subscriptions. Privacy policy
  • Plausible Analytics — cookieless website analytics (EU-based). Privacy policy

We do not sell personal data. We do not share personal data with advertisers.

4. How long we keep your data

  • Newsletter data: until you unsubscribe
  • Cached scores (Redis): 1 hour auto-delete
  • Evaluation metadata (database): 12 months
  • Server logs (Netlify): 30 days
  • Commercial enquiries: 2 years
  • Research data: 5 years from study completion

5. Your rights

Under UK GDPR you have the right to: access your data, correct inaccuracies, request deletion, object to processing, withdraw consent, data portability, and lodge a complaint with the ICO.

Contact: hello@everythingthreads.com. We respond within one calendar month.

Data protection complaints: If you are unsatisfied with how we handle your data, please contact us first at hello@everythingthreads.com. We aim to resolve all complaints within 14 days. If you remain unsatisfied, you have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint or call 0303 123 1113.

6. Cookies and local storage

This website does not use tracking or advertising cookies. We use Plausible Analytics (cookieless). A cookie consent banner is displayed on first visit allowing you to accept all cookies or use essential only. Your preference is stored in browser localStorage for 12 months.

Some tools use browser localStorage for settings and session data (e.g. Session Bridge items, quiz progress, tool history). This data stays on your device and is never transmitted to our servers. The Chrome extension uses chrome.storage for evaluation counts and preferences.

7. International transfers

Scoring path residency. The LiveScope scoring engine — Claude on AWS Bedrock — runs under Bedrock's EU cross-region inference profile. Inference is restricted to AWS regions in the EU and the UK (Ireland, London, Paris, Frankfurt, Stockholm, Milan, and Spain). For a UK controller, this path is fully lawful under UK–EU adequacy in both directions; no transfer outside the EU/UK perimeter occurs during model processing. Neon, Upstash, Langfuse, and Plausible also store data in EU regions. The Tier-1/2/3 scoring path is EU/UK end-to-end.

Other processors. Some sub-processors that handle parts of the service other than scoring are US-based: Cloudflare (edge worker compute), Netlify (website hosting), Groq (Boardroom multi-model chat), Stripe (payment processing), and the forthcoming mobile-app processors (RevenueCat, Clerk, Sentry once configured). Transfers to these are covered by the UK IDTA, Standard Contractual Clauses (SCCs) including the EU-US Data Privacy Framework where the processor self-attests, or the UK-US data bridge. None of these processors receive your scoring input — that path stays within the EU end-to-end.

8. Changes

We update this notice when practices change. The date at the top shows the last update. Significant changes are communicated to newsletter subscribers.

Contact the data controllerEverythingThreads · Kariem A.
hello@everythingthreads.com
ICO registration: C1896585