Privacy and data
This page explains where your data lives, what an agent can reach from its sandbox, and how to delete things. Threadrun has no account, and it doesn't keep your work on servers of its own.
Where your data lives
| What | Where it lives |
|---|---|
| Threads, files and history | The runner you chose: Docker on this computer, or your server. |
| Audit log and logs | The same runner, with the thread it belongs to. |
| Agent logins and API keys | The OS keychain on this computer: macOS Keychain or Windows Credential Manager. |
| GitHub token | The keychain on this computer. The server holds it in memory and doesn't write it to disk. |
| Server access tokens | The keychain on this computer, one per server. |
| Your server list | A settings file in your user config folder, threadrun/state.json. It holds server names, addresses, users and the path to each key file, not the key. It also holds the webhook keys of loops you created here. |
Threads on this computer run only while the computer is awake. Threads on your server keep running while your laptop sleeps.
What a sandbox can reach
Each sandbox is a Docker container. Containers share the host's kernel, so they are not separate virtual machines.
A sandbox can:
- reach the internet only through the egress proxy, and only to domains on the allowlist. Every connection is logged on the thread;
- read and write its own workspace. Agents can send what they read to the model provider you chose.
A sandbox cannot:
- reach other sandboxes, or any network address that is not on the allowlist;
- accept connections from outside. It connects out to the server, and nothing connects in;
- use the Docker socket. The server reaches Docker through a filtered proxy;
- gain Linux capabilities. It runs as a non-root user with all capabilities dropped, a read-only root filesystem and no-new-privileges;
- see your SSH keys. They stay on this computer, and the app uses them to connect to your server;
- see your folders. Threads clone the project from its GitHub remote, so local folders are not mounted into a sandbox.
Credentials go only to the sandbox of the thread that uses them.
Threadrun has no account
You don't sign in to Threadrun, and Threadrun doesn't run a cloud service that holds your work. The only accounts you use are the ones you connect yourself, such as your agent's provider or GitHub. Model usage is billed by those providers, not by Threadrun.
Phone links
Phone access lets you follow a thread from your phone. The phone is served by your own server, and each link is signed for one thread. A link expires after 7 days.
Opening a link also needs the 6-digit PIN that only your app shows, and five wrong PINs lock the link. To stop phone access, turn it off on the server's card. The phone pages stop being served.
Delete data
- Delete a thread: click Delete in the thread's toolbar and confirm. This removes the thread's sandbox, files and history. It can't be undone. Runs and loops work the same way.
- Automatic deletion: logs older than the period in Keep logs (days) are deleted. See Governance.
- Remove a server: on the server's card, click Remove. Then choose one of two options:
- Uninstall and remove removes the runner, its sandboxes and their files, the swap file if Threadrun added one, and this app's record of the server and its threads. Thread data and images on the server are kept unless you tick Also delete thread data and images on the server.
- Only forget it in this app removes the server from this app and leaves the runner running.
- Remove a skill or MCP server: click Remove next to it in Settings → Skills & MCP. Its stored keys are deleted.
To uninstall by hand on your server, run sudo /opt/threadrun/uninstall.sh. Add TR_PURGE=1 before the command to delete thread data as well.
Uninstalling doesn't delete the server itself. Your provider keeps billing for it until you delete it there.