Privacy policy

not yet configured is the controller for the personal data described here. Address and contact details are on the provider information page.

What we store, and why

Email address

To identify your account, verify it, and let you reset your password. Legal basis: performance of a contract (providing the service you asked for).

Password hash

Argon2id. We never store the password itself and cannot recover it. Accounts created through a sign-in provider have no password at all.

Sessions

A hash of your session token, its creation and expiry time, so you stay signed in and can see and revoke your signed-in devices.

Sign-in provider links

If you sign in with Google, the provider's account identifier and the date the link was made — never your provider password.

Abuse counters

A counter keyed by your IP address or the email address entered in a form, so sign-in, sign-up and password-reset attempts can be rate-limited. Legal basis: legitimate interest in keeping the service usable. These rows are short-lived windows of 15 or 60 minutes and are overwritten as they expire.

Cookies

We set two cookies and no tracking cookies:

• a session cookie when you sign in, so the service knows it is you. It is HTTP-only, same-site, and secure over HTTPS;
• a theme cookie remembering whether you chose the light or dark theme, so the first paint matches your choice.

Both are strictly necessary for functions you asked for, so there is no cookie banner to click away.

Email we send you

If you keep them switched on, we send a daily briefing and alerts when one of your saved searches matches something new. Every one carries a one-click unsubscribe link that works without signing in, and you can change or stop all of it on your account page.

We do not track whether you open an email. There is no tracking pixel. To avoid mailing addresses nobody reads, we stop sending to an account that has not signed in for 90 days; one visit starts it again.

Analytics

We run our own Umami instance on our own server, served from this domain. It is cookieless, stores no personal identifiers, does not follow you across sites, and sends nothing to a third party. We use it to count page views and a handful of product events (for example: an account was created).

Who else processes your data

• Our hosting provider — runs the server and the database in the EU.
• Resend — sends verification and password-reset email. It receives your email address and the message.
• Google — only if you choose to sign in with Google, and only then.
• Groq — generates article summaries. It receives only the headline, the feed description and the source name of publicly published articles. No personal data, no account data and nothing you have written is ever sent to it; that restriction is enforced in code and covered by a test.

Groq's data-processing agreement, sub-processor list, transfer basis and retention terms have not yet been confirmed for this account. Because no personal data reaches that service at all, this is a transparency note rather than a transfer of your data — but it will be confirmed and this section updated before the service starts charging.

How long we keep it

• Account data: until you delete your account.
• Sessions: 30 days, or until you sign out.
• Verification tokens: 24 hours. Password-reset tokens: 1 hour. Both are deleted the moment they are used.
• Abuse counters: the length of the rate-limit window (15 or 60 minutes).
• Backups: encrypted database dumps are kept for up to 7 days daily and 4 weeks weekly, then destroyed. A deleted account disappears from backups as those rotate out.

Your rights

Under the GDPR you may access, correct, export, restrict, object to or erase your personal data. Two of these are self-service and immediate on your account page:

• Export my data downloads everything we hold about your account as JSON.
• Delete my account erases the account and everything attached to it, and signs out every device. It cannot be undone.

For anything else, contact us. You also have the right to complain to a supervisory authority — in Italy, the Garante per la protezione dei dati personali.

Children

The service is not directed at children and we do not knowingly create accounts for anyone under 16.

Last updated 2026-08-17.