Privacy Policy

Last updated: October 11, 2026

ThreatCaddy is a personal open-source project. It is not affiliated with any employer, organization, or company — past, present, or future.

Data Storage

• Notes, tasks, timelines, and investigation data are stored locally in your browser using IndexedDB. Optional features described below can transmit selected content, identifiers, or requests to other services.
• Extension clips are stored in chrome.storage.local on your device.
• The standalone HTML file and the default web app require no accounts and use no cookies.

Optional Team Server

• You may optionally connect to a self-hosted team server for real-time sync and collaboration. This is entirely opt-in — no data is sent until you configure a server URL and sign in.
• When connected, notes, tasks, timelines, IOCs, and other investigation entities are transmitted to the server you configure. Authentication tokens are stored in your browser.
• Local workspace encryption protects covered browser fields at rest; it is not end-to-end encryption for team sync. The server receives readable entity values and may retain historical records. Removing a server record does not erase offline copies or exported files.
• The team server is open-source and self-hosted. This project does not provide a hosted team-server service; access and retention depend on the server operator you choose.

API Keys & AI Features

• API keys you configure for AI features (e.g., OpenAI, Anthropic, Google, or other LLM providers) are stored locally in your browser.
• Depending on the selected route, AI requests travel through the extension, directly to a configured local-model endpoint, or through your team server. The extension receives client-configured credentials needed for its requests; a team server can use its own provider credentials.
• Prompts, selected context, attachments and tool results may contain investigation data. They are sent to the configured service when you use these features. Custom endpoints and proxies are additional trust boundaries; review their operators and retention policies.

Extension Permissions

• The extension uses permissions for clipping and delivery, and optional permissions for approved app connections, AI provider requests, URL fetching and desktop notifications.
• Host permissions and app approval are separate controls. File access also depends on the browser's extension settings. Enabling an optional capability may allow selected content or requests to leave the device.
• Clipping is user-initiated. Optional AI and URL-fetching operations process the requests and content you submit through those features; they are not limited to saved clips.

Analytics

• Hosted builds can enable Cloudflare Web Analytics when the operator supplies a build-time analytics token. The application does not inject this analytics script when that token is absent. Hosting providers may separately retain ordinary request logs.
• The standalone HTML file and the extension include no analytics whatsoever.

Third Parties

Network activity depends on the features you use and the deployment configuration. These requests can reveal your IP address and request metadata to the receiving service. They include:

• CaddyAI requests sent to the LLM provider endpoint you configure (e.g., api.openai.com).
• URL fetch requests you explicitly initiate through CaddyAI tools.
• Sync traffic to a self-hosted team server, if you choose to configure one.
• IOC enrichment and enabled integration requests to their configured services; submitted indicators can themselves be sensitive.
• Optional cloud-backup uploads, downloads and connection tests to the storage endpoint you configure. A connection test writes a small remote test object. Plain JSON exports are not encrypted; use the separate password-encrypted backup flow when needed.
• Community integration catalog downloads when you explicitly browse or refresh that catalog, and map-tile requests when you open map views. Tile providers can infer the viewed geographic area.
• App assets, update checks and any analytics enabled for the hosted build. Standalone offline operation does not require these hosted resources, but optional network features remain available when configured.