Current architecture, described without shortcuts

Trust starts with a precise boundary.

ThreadCue is local-first, not local-only. This page explains what stays on the desktop, what reaches the hosted Reddit gateway, what may reach an optional AI provider, and where the prototype still needs hardening.

Where data goes

The current desktop and gateway are intentionally separate.

01 · Desktop workspace

Projects and work stay local

Project profiles, onboarding conversations, tasks, drafts, schedules, account metadata, and captured source snapshots are stored in the desktop application’s local SQLite database.

The SQLite workspace itself is not encrypted.

02 · Reddit gateway

Reddit credentials stay off the desktop

The hosted gateway holds the Reddit client secret and encrypted Reddit access and refresh tokens. The desktop retains only an encrypted, opaque gateway credential and non-secret account metadata.

The checked-in gateway is designed for one server instance.

03 · Optional AI provider

External AI has an explicit boundary

A user can configure an OpenAI API key for eligible demo-source drafts and revisions. Live Reddit text is deliberately excluded from external AI prompts in the current implementation.

Switching back to Demo AI does not yet remove the stored OpenAI credential.

Reddit permissions

Read only, for a visible reason.

The approval-gated connector requests three scopes and maps each one to a current feature.

identity: Recognize the accountReads the connected username and immutable account identity.
mysubreddits: Choose relevant communitiesReads the communities the connected account follows.
read: Find public discussionsReads public search results, posts, comments, and community listings.

ThreadCue does not request permission to publish, vote, save, join communities, send private messages, read account history, or moderate.

Retention, disconnect, and deletion

These actions are related, but they are not the same.

During use

Live Reddit source snapshots can include an author, title, body, URL, publication time, score, and comment count. The default snapshot window is 48 hours and can be configured from 24 to 168 hours.

After snapshot expiry

The captured Reddit text is removed. A derived opportunity task or draft can remain, with its source relationship cleared, so the user’s work is not silently destroyed.

On Reddit disconnect

ThreadCue attempts to revoke the Reddit refresh token, then removes gateway and local account credentials and account metadata. Existing tasks remain, and previously captured snapshots are not immediately purged by disconnect alone.

Full local reset

The prototype does not yet include a one-click workspace deletion flow. Users can stop the app and remove its local data directory; exact platform paths are documented in the data deletion instructions.

Security posture

Useful safeguards, plus unfinished work.

Implemented safeguards

Separate trusted Reddit gateway
Encrypted gateway tokens and desktop provider credentials
Read-only Reddit permission set
Short-lived, one-use OAuth transaction material
Rate limits and bounded Reddit reads
Automatic live-source snapshot cleanup
No live Reddit text in external AI prompts

Before a public release

Real product identity and user ownership
OS credential-vault adapters
Full account, export, and deletion UX
Production monitoring and incident process
Multi-instance gateway persistence if needed
Broader automated and accessibility testing
External security and legal review

Policy details

The legal pages describe the current prototype and flag the business details that must be finalized before launch.