https://newsdiary.app/privacy

1<!doctype html>
2<html lang="en">
3  <head>
4    <meta charset="utf-8" />
5    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6    <title>Privacy Policy — NewsDiary</title>
7    <meta name="description" content="What NewsDiary collects, why, who processes it, how long we keep it, and your rights." />
8    <link rel="stylesheet" href="/static/legal.css" />
9  </head>
10  <body>
11    <main>
12      <nav class="crumbs" aria-label="Breadcrumb">
13        <a href="/">NewsDiary</a> · Privacy Policy
14      </nav>
15
16      <h1>Privacy Policy</h1>
17
18      <div class="meta">
19        <strong>Policy version:</strong> v1.0 ·
20        <strong>Effective:</strong> 2026-05-23 ·
21        <strong>Controller:</strong> Cape Wesley, <a href="mailto:[email protected]">[email protected]</a>
22      </div>
23
24      <p>This policy explains what NewsDiary collects, why, who processes it on our behalf, how long we keep it, and what rights you have. It applies to the iOS app, the Chrome extension, and the backend API operating at <code>*.newsdiary.app</code>.</p>
25
26      <p>If you read only one paragraph: we keep what you save in NewsDiary (articles you ingest, annotations you write, audio you record, diary entries). We do not train models on it, we do not sell it, and we delete it on request. The full list and our processors are below.</p>
27
28      <h2>1. Data we collect</h2>
29
30      <h3>From you, directly</h3>
31      <ul>
32        <li><strong>Account identity</strong> — email address; password hash (Argon2id, never the password itself); for Sign in with Apple, the stable Apple subject identifier (<code>sub</code>) returned by Apple.</li>
33        <li><strong>Article content</strong> — text, HTML, and PDF documents you choose to ingest via the extension, the share extension, or paste into the app. Optionally, if you turn on auto-capture for a specific site, articles you open on that site are saved to your diary as you read them, without a further tap. Auto-capture is off by default, is offered once per site and only after you have captured from it manually, applies solely to the sites you add, and can be turned off per site at any time. Nothing is captured from sites you have not added.</li>
34        <li><strong>Annotations</strong> — highlights, written notes, voice recordings, and their automated transcripts.</li>
35        <li><strong>Diary entries</strong> — text and (when added) audio you write in your personal journal.</li>
36        <li><strong>Profile</strong> — handle, display name, bio (only if you set them and only if you choose to make a profile public; default is private).</li>
37        <li><strong>Locale preference</strong> — <code>fr</code> or <code>en</code>, derived from your device or set explicitly.</li>
38      </ul>
39
40      <h3>Generated by our systems</h3>
41      <ul>
42        <li><strong>LLM usage metadata</strong> — model name, tool name (summary, bias, fact-check, context, glossary), input/output/cached token counts, cost estimate, timestamp. <strong>We do not log prompt or response text.</strong></li>
43        <li><strong>Engagement metadata</strong> — last engagement timestamp per article; count of articles and annotations per month; full-text search index of your own content (Postgres <code>tsvector</code> columns).</li>
44        <li><strong>Diagnostic events</strong> — error reports captured by Sentry (stack trace, route, HTTP method, anonymous user id). PII scrubbing is enabled on the SDK.</li>
45      </ul>
46
47      <h3>We do not collect</h3>
48      <ul>
49        <li>Browsing history outside articles you explicitly capture.</li>
50        <li>Location data.</li>
51        <li>Advertising identifiers, IDFA, IDFV.</li>
52        <li>Tracking cookies. The marketing site uses a single first-party session cookie to remember whether you dismissed the banner; no third-party cookies are set.</li>
53      </ul>
54
55      <h2>2. Why we process your data (lawful basis under GDPR Art. 6)</h2>
56      <table>
57        <thead>
58          <tr><th>Purpose</th><th>Basis</th></tr>
59        </thead>
60        <tbody>
61          <tr><td>Create and maintain your account</td><td>Contract (Art. 6(1)(b))</td></tr>
62          <tr><td>

62Store and sync your articles + annotations</td><td>Contract</td></tr>
63          <tr><td>Run the LLM tools you trigger</td><td>Contract</td></tr>
64          <tr><td>Send transactional email (verify, magic)</td><td>Contract</td></tr>
65          <tr><td>Send marketing email</td><td>Consent, opt-in only (Art. 6(1)(a))</td></tr>
66          <tr><td>Diagnostics and error monitoring</td><td>Legitimate interest (Art. 6(1)(f))</td></tr>
67          <tr><td>Comply with legal requests</td><td>Legal obligation (Art. 6(1)(c))</td></tr>
68        </tbody>
69      </table>
70
71      <h2>3. Sub-processors</h2>
72      <p>We use a small number of vendors. None receive more than the data strictly needed for their function.</p>
73      <table>
74        <thead>
75          <tr><th>Processor</th><th>Purpose</th><th>Location</th><th>Notes</th></tr>
76        </thead>
77        <tbody>
78          <tr><td>Anthropic, PBC</td><td>LLM inference (Claude API)</td><td>US</td><td>No-training agreement; prompt caching enabled.</td></tr>
79          <tr><td>Brave Software</td><td>Web search grounding</td><td>US</td><td>Default since Tavily was acquired by Nebius (2026).</td></tr>
80          <tr><td>Resend, Inc.</td><td>Transactional + marketing email</td><td>US</td><td>Verify, magic link, weekly digest if opted in.</td></tr>
81          <tr><td>Functional Software (Sentry)</td><td>Error monitoring</td><td>DE/US</td><td>PII scrubbing on.</td></tr>
82          <tr><td>Fly.io</td><td>Application hosting</td><td>EU (cdg)</td><td>Single-replica backend, Postgres database.</td></tr>
83          <tr><td>Cloudflare R2 (planned)</td><td>Object storage for audio/PDFs</td><td>EU</td><td>When migrated from inline Postgres storage.</td></tr>
84          <tr><td>

84Whisper (self-hosted)</td><td>Audio transcription</td><td>EU (cdg)</td><td>Runs on our own Fly.io app, <strong>not</strong> a third party.</td></tr>
85        </tbody>
86      </table>
87      <p>We do not transfer data outside processors listed here. Apple Foundation Models, when used, run on-device and no data leaves your phone.</p>
88
89      <h2>4. Retention</h2>
90      <ul>
91        <li><strong>Active account</strong>: indefinitely, until you delete the account.</li>
92        <li><strong>Delete account</strong>: immediate and permanent. The account row is erased the moment you confirm, cascading through every owned table — there is no grace window and no way to undo it. See <a href="/delete-account">Delete your account</a>.</li>
93        <li><strong>Withdrawing the privacy consent</strong>: a different route with a <strong>30-day</strong> window. It also ends the account, because consent is the lawful basis for processing, but during those 30 days you can sign in to cancel; mutations are blocked while reads and exports keep working so you can recover your data. After 30 days the row is hard-deleted and cascades.</li>
94        <li><strong>LLM usage metadata</strong>: retained for billing reconciliation, 24 months.</li>
95        <li><strong>Sentry error reports</strong>: 90 days.</li>
96        <li><strong>Server logs</strong>: 14 days.</li>
97      </ul>
98
99      <h2>5. Your rights</h2>
100      <p>Under GDPR you may:</p>
101      <ul>
102        <li><strong>Access</strong> — request a copy of your data. Use <code>GET /export?format=json</code> in-app or email us.</li>
103        <li><strong>Rectify</strong> — edit your profile, annotations, diary entries, and consents directly in-app.</li>
104        <li><strong>Erase</strong> — <code>POST /me/delete</code> in-app (immediate, permanent), or email us. Step-by-step: <a href="/delete-account">Delete your account</a>.</li>
105        <li><strong>Portability</strong> — the JSON export at <code>GET /export?format=json</code> is a complete, machine-readable snapshot.</li>
106        <li><strong>Object</strong> — <code>POST /me/consents</code> toggles marketing consent off immediately. Revoking the <em>privacy</em> consent triggers account deletion (it is the lawful basis for processing).</li>
107        <li><strong>Lodge a complaint</strong> with your data protection authority. In France: CNIL, <a href="https://www.cnil.fr/">www.cnil.fr</a>.</li>
108      </ul>
109      <p>Requests sent to <a href="mailto:[email protected]">[email protected]</a> are answered within 30 days.</p>
110
111      <h2>6. Security</h2>
112      <ul>
113        <li>Passwords are hashed with Argon2id and never stored in plaintext.</li>
114        <li>All API traffic is over HTTPS with a wildcard certificate.</li>
115        <li>Audio blobs and PDFs are stored encrypted at rest by the hosting provider's disk encryption.</li>
116        <li>BYO LLM keys (when enabled) are encrypted at rest using AES-GCM with a per-installation key (separate ticket; flag-gated until Sprint 4-bis lands).</li>
117      </ul>
118
119      <h2>7. Children</h2>
120      <p>NewsDiary is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, write to <a href="mailto:[email protected]">[email protected]</a> and we will delete the account.</p>
121
122      <h2>8. Changes</h2>
123      <p>We may update this policy. The current <code>policy_version</code> is shown above and recorded with every consent you give. If we bump the version, you will see a re-consent screen on your next session.</p>
124
125      <h2>9. Contact</h2>
126      <p>Cape Wesley — <a href="mailto:[email protected]">[email protected]</a></p>
127
128      <footer class="foot">
129        <span>Source of truth: <a href="https://dev.azure.com/CapeWesley/NewsDiary/_git/NewsDiary?path=/docs/legal/privacy-policy.md"><code>docs/legal/privacy-policy.md</code></a></span>
130        <span><a href="/terms">Terms of Service</a></span>
131      </footer>
132    </main>
133
134    <div id="cookie-banner" role="region" aria-label="Cookie notice" hidden>
135      <p>NewsDiary uses one first-party cookie to remember this dismissal. No tracking, no third-party cookies.</p>
136      <button type="button" id="cookie-dismiss">Got it</button>
137    </div>
138
139    

139<script src="/static/cookie-banner.js"></script>

139
140  </body>
141</html>