DownthreadYour exports never leave your browser.
The comments you export are read in the tab you already have open and written straight to your Downloads folder. They are never uploaded, never sent to us, and never seen by anyone but you.
Two things do leave your browser, and this page is precise about both: the requests the extension makes to the platform you are exporting from, and — only if you create an account — your email address and whether you have a paid pass.
What it reads
When you export a post, the extension reads the comment data that page is already receiving from its own site — the same responses your browser loads as you scroll. It works only inside your own signed-in session and only on the sites listed in its permissions. It cannot see anything you could not open yourself.
To be exact about where it runs: its reader loads in every open tab on those sites, not only the one you are looking at, because a page's comment responses arrive as you scroll and cannot be captured after the fact. In a tab you never export from, what it sees is held in that tab's memory and goes when the tab does. Exporting, and the run history below, begin only when you start an export.
The comments it reads contain other people's names, profile links and words. That information is assembled in the tab and written to the file you asked for. A copy of your most recent exports is also kept in your own browser, as your run history (below), until you delete it or newer exports replace it. It is never sent anywhere.
What it stores, and where
| What | Where | Why |
|---|---|---|
| Your panel settings — format, replies on or off, speed | Your browser's extension storage | So the panel opens the way you left it. |
| Your YouTube Data API key, if you use YouTube | Your browser's extension storage | It is your key, used to call YouTube directly. It is never sent anywhere but to YouTube's own API. |
| A resume checkpoint for a long Facebook export | Your browser's extension storage | So a run interrupted after twenty minutes can continue instead of starting over. |
| Your run history: your last 10 exports per platform — the post's address, when you exported it, and the comments themselves (authors, profile links, text, replies) | Your browser's extension storage | So you can download an export again or compare a re-run with the last one. It stays on this machine and is never sent anywhere. Older exports are dropped as new ones arrive; you can delete any of them from the panel. |
| Your account: email address and a user id | Our database (Supabase), and your browser | Only if you sign in. It is how a pass is attached to a person. Without an account nothing of yours is stored anywhere but your own machine. |
| Whether a pass is running, and the date it ends | Our database (Supabase) | To answer one question the extension asks a few times a day: is this person paid up, and if not, what is their export limit. |
| A sign-in token, and the last answer about your pass | Your browser's extension storage | So you are not asked to sign in repeatedly, and so an export still works when the network does not. Signing out deletes both. |
| The exported CSV or JSON file | Your Downloads folder | It is the thing you asked for. Nothing sends a copy anywhere. |
What it does not do
- No comment ever leaves your machine. Not one line of exported text, not an author name, not a profile link, not a count. The account system carries your email and whether you have paid — it has no idea which posts you export, or that you exported anything at all.
- No tracking. No analytics, telemetry, crash reporting, cookies of its own, advertising or advertising identifiers. Your browsing is not recorded; the only addresses kept are those of the posts you chose to export, in your own run history.
- No account required to use it. Signed out, the extension exports up to 200 comments per post and stores nothing off your machine. An account exists to lift that limit, and for nothing else.
- It never asks for a password, and never stores a credential. To ask a
platform for the next page of comments, the exporter re-sends that page's own request, which
means the session fields the page put in it — Facebook's
fb_dtsg, X's request headers, and their equivalents elsewhere — are held in the tab's memory while the export runs, and discarded with the tab. They are never written to disk, never put in an export, and never sent anywhere but back to the platform that issued them. Your password and your login cookie are never read at all. - No selling or sharing. Your email is used to identify your pass and for nothing else. It is not sold, not shared, not mailed to, and not used for any purpose unrelated to running your account.
- No remote code. Everything it runs ships inside the extension package and is reviewable in the source repository. Nothing is fetched and executed at runtime.
- Nothing is collected until you press Export. On the supported sites a small reader does start with the page, and watches for the comment requests the page makes anyway — that is how the exporter learns the shape of the request it will later repeat. It reads nothing else, keeps nothing outside that tab, and exports nothing until you ask. It stops when the run ends or you press Stop.
Network requests it makes
Three kinds, and no others. All of them come from your own browser.
- Requests to the platform you are exporting from — Facebook, TikTok, Instagram or X — of the same kind the page makes for itself when you scroll its comments.
- On YouTube, requests to
www.googleapis.com, the official YouTube Data API, authorised by the API key you supplied. Google's own privacy policy governs that call. - If you have an account: requests to
supabase.co, our database, to sign you in and to ask whether your pass is still running. These carry your sign-in token and nothing else — no comment text, no post address, no page you visited. When you look at the price or press Subscribe, the request also carries your browser's time zone setting (for exampleAsia/Manila), used only to decide whether a regional rate applies. It is not stored.
Why each permission is asked for
| Permission | Reason |
|---|---|
activeTab |
To act on the tab you pressed the toolbar button from, and no other. |
scripting |
To place the export panel into the tab you launch it in. The reader itself loads in every open tab on the supported sites, as described above, so that a post's comments can be captured as the page requests them. |
storage |
To keep the settings, the YouTube key, the resume checkpoint and the run history described above, all locally. |
unlimitedStorage |
A post with tens of thousands of comments produces a resume checkpoint larger than the default quota; without this the run would fail partway. |
| Site access to facebook.com, youtube.com, tiktok.com, instagram.com, x.com and twitter.com | These are the sites it exports from. It reads the comment responses those pages already receive. It has no access to any other site. |
identity |
To open the Google sign-in window when you choose to create an account. Unused until you press sign in. |
Site access to supabase.co |
Our database: where an account is created and where the extension asks whether your pass is still running. |
Site access to googleapis.com |
To call the official YouTube Data API with your key. |
Handling what you export
An export is other people's writing. Each platform's terms govern what you may collect and how you may use it, and this tool does not change them. If you are using the exports for research, the usual obligations apply — consent where required, care with identifying details, and storage appropriate to the sensitivity of what you collected.
Deleting your account
Signing out removes the token and the cached answer from your browser immediately. To have the account itself deleted — your email address and pass record — write to the address below and it will be removed, along with anything attached to it. Exports you have already saved are yours and were never ours to delete.
Changes and contact
If this policy changes, the updated version appears on this page and the date changes with it.
Contact: downthread.support@gmail.com for support, questions about this policy, or to have your account deleted.
Last updated 23 September 2026. Extension version 3.53.0.