ThunderSweep Help Center

Getting Started

How Scanning Works

What We Detect

Supported File Types

ThunderSweep scans the content of: PDF, DOCX, XLSX, CSV, TXT, RTF, ODT, ODS, and ZIP archives. Files over 10 MB are scanned by filename only.

Limitations & Unsupported Files

• Native Google Docs/Sheets: Files created directly in Google Workspace (Docs, Sheets, Slides) cannot be downloaded and natively encrypted into the Vault. You must export them (e.g., as PDF or DOCX) in Google Drive before vaulting.
• Read-Only Shared Files: If a file is shared with you as "Viewer", ThunderSweep can successfully copy the file's content, encrypt it, and save it to your Vault. However, it cannot automatically delete the original because you lack edit permissions. After vaulting, you must manually right-click the file in Google Drive and select "Remove".
• Images & Scans: Image formats (PNG, JPG) and scanned PDFs without OCR text currently cannot be scanned for text keywords, though they can still be manually vaulted using ThunderVault Dropoff.

Understanding Results

Results are grouped by email conversation (thread). Each result shows:

• Subject — The email subject line
• Sender — Who sent the email
• Date — When the email was received
• Files — Attachment filenames that triggered the detection
• Categories — What type of sensitive content was found (tax, financial, SSN, etc.)

Suspected Items

Items marked as "Suspected" have filenames containing sensitive keywords but could not be fully verified (e.g., the file content couldn't be read). Review these manually to determine if they need action.

Deleting Emails

To delete sensitive emails:

1. Select emails using the checkboxes in the results table
2. Click "Delete Selected"
3. You'll be offered to download attachments or a CSV report before deleting
4. Confirm the deletion to move the emails to Trash

Real-Time Monitoring (Shield/Family)

Shield and Family subscribers get continuous background monitoring and real-time outbound protection for both Gmail and Google Drive. ThunderSweep will:

• Inbound Gmail: Automatically scan incoming emails in the background and send you desktop alerts if sensitive information hits your inbox.
• Inbound Drive: Monitor your Google Drive for newly added or modified files containing sensitive data.
• Outbound Gmail: Scan attached files and email body text for PII (SSNs, credit card numbers, etc.) while you are composing an email.
• Show a warning banner inside the compose window if sensitive outbound content is detected.

Outbound scanning does not block sending — it's an informational warning so you can review your attachments before clicking Send.

Privacy & Security

• No Backend Servers: ThunderSweep is a standalone app that operates entirely within your local browser. We have no backend servers to collect, process, or store your data.
• Permissions are to the Tool, not the Developer: When you grant Google permissions, you are giving the tool running locally on your computer the ability to organize your files, not granting a person or remote company access to your data.
• 100% Local Processing: All scanning happens directly on your device. No email or Drive content is ever sent to external servers.
• ThunderSweep requests read-only access for scanning, plus modify access only for the Vaulting and delete features.
• Scan results are stored locally in your browser's storage and never uploaded anywhere.
• You can disconnect your account at any time from the extension popup.
• License validation uses Gumroad's API — only your license key is sent, never your email content.

How Zero-Knowledge Works: TS Share & TS-X-Port

At ThunderSweep, we believe that true security means you are always in control of your data. We've designed our core features around "zero-knowledge" principles—meaning we process your data without ever having the ability to read it.

TS Share: Secure File Sharing

When you send a secure file, our servers never see your private data or the key needed to unlock it.

1. Local Decryption: ThunderSweep first decrypts the file on your local machine.
2. One-Time Key: A brand new, random, single-use encryption key is generated.
3. Local Re-encryption: The file is re-encrypted on your device using this one-time key (via AES-256-GCM).
4. Secure Upload: Only this fully encrypted, unreadable blob of data is sent to our servers.
5. The Magic URL: A sharing link is created. The one-time encryption key is appended to the end of the URL, after a hash symbol (#). (e.g. https://thundersweep.app/share/file123#SecretKey)
6. Zero-Knowledge Transfer: Browsers are hard-coded to never send anything after a # fragment to a web server. We see the request for the file, but we never receive the secret key.
7. Recipient Decryption: When your recipient clicks the link, their browser queries our server for the encrypted file, reads the key from their address bar's # fragment, and decrypts the file locally.

TS-X-Port: Digital Sovereignty

Security shouldn't be a trap. TS-X-Port ensures you own your ciphers and can access your data forever, independent of ThunderSweep.

1. Industry-Standard Encryption: Files are secured in your ThunderVault using AES-256-GCM, and your password is strengthened using PBKDF2.
2. Export Your Vault: You can export all your encrypted files (.enc) and your configuration file containing your cryptographic "salt" (.tsv1).
3. No Proprietary Lock-in: Because we use open cryptographic standards, your data can be decrypted using any standard programming language.
4. The Unlocking Script: We provide a standalone, open-source script (like our manual_decrypt.js) that runs completely offline.
5. Local Execution: You provide the script your master password, salt, and the exported file. The script acts offline to verify integrity and decrypt your data perfectly.

Vault — Button Guide

File Actions (⋯ menu)

Toolbar Buttons (Bulk Actions)

Troubleshooting

Plans & Pricing

Managing Your Subscription