Built to be trusted
with your Slack workspace
Threadly is a Slack-approved app that uses OAuth 2.0, requests only what it needs, encrypts your data, and gives you full control.
Security practices
Data encryption in transit and at rest
All data transmitted between Threadly and Slack, and between your browser and Threadly, is encrypted via TLS 1.2+. Data at rest is encrypted using AES-256.
OAuth 2.0 authentication only
Threadly never asks for your Slack password. Authentication is handled entirely via Slack's official OAuth 2.0 flow. You can revoke access at any time from your Slack workspace settings.
Minimal data retention
Threadly stores only the data necessary to power broadcasts and analytics: channel lists, message metadata, click events, and form responses. We do not store full message content from your Slack workspace.
Infrastructure on Heroku (AWS) and Google Cloud
Threadly's application runs on Heroku, which is itself built on AWS infrastructure. Workspace data is stored in Google Cloud Firestore, which encrypts data at rest by default.
Slack permissions explained
Threadly requests only the Slack OAuth scopes it needs to operate. Here is exactly what each scope is for.
chat:writePost messages to Slack channels on behalf of Threadly
channels:read / groups:readRead the list of channels in your workspace to let you select broadcast targets
channels:history / groups:historyRead message history to power analytics and threading
users:read / users:read.emailRead user information to personalize messages and map channels to contacts
reactions:readTrack emoji reactions on Threadly messages for engagement analytics
files:readSupport file attachments in messages
team:readRead basic workspace information (name, domain) for multi-workspace support
commandsRegister Threadly slash commands in your Slack workspace
Threadly does not request channels:write — it cannot create, rename, or delete your Slack channels. It also does not request admin or workspace administration scopes.
What data Threadly stores
What Threadly stores
- Your workspace ID and name
- Slack channel IDs, names, and metadata
- Message metadata (when sent, to which channels)
- Click events on message CTAs (who clicked, when)
- Form responses submitted via Threadly messages
- Meeting booking confirmations
- Broadcast analytics and engagement metrics
- API tokens for connected integrations (e.g. HubSpot, Attio, Bonusly), used only to query your data at send time
What Threadly does NOT store
- –Full Slack message history from your workspace
- –Slack passwords or authentication credentials
- –Private channel content not related to Threadly
- –Direct messages not sent via Threadly
- –Slack user passwords or 2FA codes
- –Payment card numbers (handled by Stripe)