Privacy policy

Last updated October 8, 2026

Thirdpass is run by Material Advisory ("we"). It turns folders of HTML into websites at thirdpass.app addresses. This policy covers the Thirdpass app at platform.thirdpass.app, the sites it hosts, the Mac app, the tp command-line tool, the Claude connector, and this website.

The short version. We keep your name and email address so you can sign in and so people can see who made what. We don't sell data, show ads, or use analytics trackers.

What we collect

• Your name and email address. We receive these when you sign in. We use them to decide which sites you can open and to show your name next to your comments and changes. Your avatar is drawn from your initials.
• Sites you publish. The files you upload, earlier versions of them, and a record of who published each version and when. Collaborative sites keep a full change history that includes each author's name and email.
• Data that sites save. Sites can store things like poll answers or form entries in a database we host. We note which signed-in person created or last changed each entry. The site's owner decides what a site asks for.
• Comments. The text, your name, and when you posted it.
• Sharing settings. Who owns each site, the email addresses it's shared with, and whether it's open to the team, specific people, or everyone.
• Request logs. Our server logs the time, path and result of each API request. Requests from Claude also log your email address and which tool Claude used, but never what Claude sent. Our code doesn't store IP addresses, though our hosting providers see them while delivering traffic.

Signing in with Google

You can sign in with Google or with a link sent to your email. WorkOS runs sign-in for us. When you choose Google, we ask only for your basic profile: your name, email address and profile picture. We don't ask for access to Gmail, Drive, Calendar or any other Google data.

We keep your name and email address and nothing else from Google. We don't store your profile picture or Google's access tokens. Your Google information is used only to sign you in and to show who did what inside Thirdpass. We don't sell it, use it for advertising, or use it to train AI models, and we share it only with the providers listed below.

Thirdpass's use and transfer of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

Cookies

Thirdpass sets two cookies, both for signing in. tp_session keeps you signed in for 7 days. tp_auth holds your place for 10 minutes while you sign in. Your browser also stores a few display settings locally, such as whether comment pins are hidden. WorkOS sets its own cookies on its sign-in pages. We use no analytics or advertising cookies, and this website sets no cookies at all.

Who else handles your data

We use these providers to run Thirdpass:

• Railway hosts our servers, database and site files.
• WorkOS handles sign-in.
• Cloudflare runs our DNS and serves this website.
• OpenAI writes a brief from a comment thread when a team member asks for one. We send it the thread's text with OpenAI's response storage turned off.
• Anthropic is involved only if you connect Claude to Thirdpass. Claude then sends requests to us on your behalf, and Anthropic's own privacy policy covers your conversations with Claude.

We'll also disclose data if the law requires it.

How long we keep it

• A site and everything in it (files, saved data, comments, history and sharing settings) stays until its owner deletes the site. Deleting a site removes all of it permanently.
• The author of a comment or the site's owner can delete that comment at any time.
• Files Claude uploads for publishing are deleted after one hour.
• Sign-ins last 7 days in the browser and 90 days in the Mac app and tp tool.
• Deleted data can remain in our database backups for a short time.

Your choices

You can delete your own sites and comments whenever you like. Thirdpass doesn't have a delete-account button yet, so to see, correct or delete the data we hold about you, emailtom@materialbuilt.com. We'll reply within 30 days.

If you used a site someone else built on Thirdpass, that site's owner controls what it stored. Ask them first, or email us if you can't reach them.

Children

Thirdpass is a work tool and isn't meant for anyone under 16.

Changes

When we change this policy, we'll update it here and change the date at the top.

Contact

Material Advisory runs Thirdpass. Questions or requests about your data go totom@materialbuilt.com.