Privacy Policy

digest.news is a news reading service operated by Digest News, Inc. This policy explains what we collect when you use it, why we collect it, and what you can do about it. It covers the digest.news website and the accounts you create on it.

Digest News, Inc. is the controller of the personal information described here. If you have a question about anything in this document, write to privacy@digest.news and a person will answer you.

We collect three kinds of information: what you give us to create an account, what you tell us by using the product, and a small amount of technical data that comes with any web request.

Account information

• Your email address. This is your identity on digest. We do not ask for your name, and we do not store one.
• Your password. Handled by our authentication provider and stored only as a salted hash. We never see or store your actual password.
• Google sign-in. If you choose to sign in with Google, we receive your email address and a Google account identifier. We do not receive your Google contacts, files, or activity.
• Account timestamps. When your account was created, when it was last updated, and whether your email has been confirmed.

What you tell us by using digest

• Reading activity. When a story appears on your screen, when you open one, roughly how long you spend on it, and which part of the app you were in at the time. This is what makes For You work: it is the difference between a feed that learns and one that does not.
• Saved stories. Which stories you save, and when.
• Follows. The topics, people, organizations, storylines, and sources you follow.
• Mutes. The entities and storylines you have muted, so we can keep them out of your feeds.

Technical information

• Standard request data. Our hosting providers process IP addresses, browser user-agent strings, and request timestamps as part of serving the site and protecting it from abuse. We do not use this to build a profile of you, and we do not combine it with your reading activity.

We do not use advertising cookies, and we do not run cookie-based tracking across other websites. You will not see a consent banner on digest because we do not set anything that requires one.

The cookies we do set are functional:

• Session cookies. Set by our authentication provider to keep you signed in. Removing them signs you out.
• Interface state. A cookie recording whether you have pinned the side navigation open, so the layout is the same when you come back.
• Beta access. While digest is in private beta, a cookie records that you entered the access password.

Separately, a number of your preferences are stored in your browser's local storage and are never transmitted to us: your light or dark theme, your feed layout choices, your reading-guard and category settings, your colour scheme, and your recent searches. That data stays on the device it was set on. Clearing your browser storage clears it.

This section is as important as the one above it:

• We do not sell your personal information. Not to advertisers, not to data brokers, not to anyone. We also do not "share" it for cross-context behavioural advertising as California law uses that term.
• We do not run third-party analytics or advertising trackers. There is no Google Analytics, no advertising pixel, and no session-recording tool on digest.news.
• We do not track you across other websites. Your reading activity on digest stays on digest.
• We do not collect your name, phone number, address, or payment details. digest is free during beta and we have no payment system.
• We do not use your reading activity to train third-party AI models. Article summaries on digest are generated from published news content, not from anything about you.

We use what we collect only for the following purposes:

• To run your account. Signing you in, confirming your email address, and keeping your session alive.
• To personalize your feed. Your reading activity, follows, and mutes shape For You, decide which stories you have already seen, and keep muted subjects out of your feeds.
• To provide the features you use. Saved stories, followed storylines, and your reading preferences.
• To keep the service working and secure. Diagnosing errors, preventing abuse, and understanding aggregate load.
• To contact you when we have to. Email confirmation, password resets, and security notices. We do not send marketing email.

We do not make decisions about you that produce legal or similarly significant effects using automated processing alone. Ranking stories in your feed is the only automated decision digest makes, and you can turn personalization off by using the general feed instead of For You.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR:

• Performance of a contract. Processing your account information and the content you save and follow, so we can provide the service you signed up for.
• Legitimate interests. Processing reading activity to personalize and improve the product, and processing technical data to keep the service secure. We have weighed these against your rights, which is why this data is minimal, is not sold, and is not combined with data from other services.
• Consent. Where we ask for it explicitly. You can withdraw consent at any time.
• Legal obligation. Where we have to retain or disclose information to comply with the law.

We do not sell or rent your information. We share it only with the service providers that make digest run, and only so they can perform that work for us:

• Supabase. Authentication and our primary database. Stores your account and the data listed in section 2.
• Vercel. Hosts and serves the digest.news website.
• Fly.io. Hosts the backend service that assembles your feeds.
• Google. Only if you choose to sign in with Google, and only for authentication.

Each of these is bound by contract to process your information only on our instructions. Beyond them, we will disclose information only if we are legally required to, or if it is necessary to protect the rights and safety of our users. If digest is ever involved in a merger or acquisition, we will tell you before your information becomes subject to a different policy.

• Account information. Kept while your account is open, and deleted when you delete your account.
• Saves, follows, and mutes. Kept until you remove them, or until you delete your account.
• Reading activity. Kept while it is useful for personalization, and deleted with your account.
• Backups. Deleted data may persist in encrypted backups for a short period before those backups rotate out.

Whoever and wherever you are, you can:

• Delete your account. From your profile settings. This deletes your account and the personal information associated with it.
• Turn off personalization. Use the general feed rather than For You, and your reading activity stops shaping what you are shown.
• Change what you follow and mute. At any time, from the app.
• Ask us for a copy of your data. Write to privacy@digest.news and we will send you what we hold.

If you are in the EEA or the UK

You have the right to access your personal data, correct it, delete it, receive it in a portable format, restrict or object to how we process it (including profiling for personalization), and withdraw consent where we rely on it. Write to privacy@digest.news and we will respond within one month. You also have the right to complain to your local data protection authority.

If you are in California

Under the CCPA and CPRA you have the right to know what personal information we collect and why, to request its deletion, to request correction, and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, but the other rights are yours and we will not discriminate against you for exercising any of them. The categories we collect are identifiers (your email address) and internet activity (your reading activity on digest), both described in section 2.

Traffic to digest.news is encrypted in transit with TLS, and your data is encrypted at rest by our infrastructure providers. Passwords are stored only as salted hashes. Access to production data is limited to the people who need it to operate the service. No system is perfectly secure, and we will not pretend otherwise, but if a breach ever affects your personal information we will notify you and the relevant regulators as the law requires.

digest is operated from the United States, and your information is processed there by us and by the providers listed in section 7. If you are in the EEA or the UK, this means your data is transferred outside your home jurisdiction. Those transfers rely on the European Commission's Standard Contractual Clauses, or an equivalent safeguard, in our agreements with each provider.

digest is not intended for anyone under 13, and we do not knowingly collect personal information from children. If you believe a child has created an account, write to privacy@digest.news and we will delete it.

We will update this policy as digest changes. When we do, we will revise the date at the top of the page. If a change materially affects how we handle your personal information, we will tell you directly, by email or in the app, before it takes effect. We will not apply a materially different policy to information we have already collected without asking you first.

For anything about this policy, your data, or a request to exercise the rights above, email privacy@digest.news. We read every message.

Digest News, Inc.