1. Who we are
News Shorts is run by Alisco Labs, the controller of the personal data described here. For anything about your data, email privacy@news-shorts.xyz.
2. The short version
- You can read the news without an account. We then process only technical data: your IP address, briefly, to stop abuse; your approximate country, to suggest local news; and settings kept in your own browser.
- If you create an account, we store your email and sign-in details, your preferences, the stories you save or react to, and your comments.
- Comments are public.
- We do not sell your data, and we run no advertising trackers.
- Usage analytics run only if you choose “Allow”, and you can switch them off at any time in You → Privacy & data. Without them we still count page visits anonymously, with no cookies and nothing stored in your browser.
- When something breaks, an error report with no account details is sent to our error-monitoring provider.
- You can download your data or delete your account yourself, in You → Privacy & data and You → Account.
- The AI that summarises the news never receives your account data. When you use smart search, the text of your search is sent to Google to be processed, but it is not linked to you.
3. What we collect, why, and our lawful basis
| Data | When | Why | Lawful basis (UK GDPR) |
|---|---|---|---|
| Email address, password (stored hashed by our sign-in provider), sign-in times. With Google sign-in: the name, email and profile picture Google shares. | You create an account | To run your account and sign you in | Contract |
| Preferences: language, region, theme, followed topics, and a profile of the categories, topics and outlets you read most (what you open, how long you read, and what you save, share, react to, comment on or click through to) | You change settings or read stories. Kept in your browser, and synced to your account if you are signed in. | To personalise your feed | Contract; legitimate interests |
| Saved stories and reactions | You save or react | To provide those features. Reactions are shown publicly only as totals. | Contract |
| Comments, your display name, and reports you make | You comment or report | To publish and moderate comments | Contract; legitimate interests (a safe community) |
| Moderation records: hidden comments and account restrictions, and what we did and why | After repeated reports, or when we act on an account or comment | To stop abuse and answer appeals. You can ask for a human review at privacy@news-shorts.xyz. | Legitimate interests; legal obligation (Online Safety Act records) |
| IP address | Every request to our API | To apply rate limits and stop abuse. We store only a keyed hash of it that changes every day, never the address, and delete it after about a day. | Legitimate interests (security) |
| Country, worked out from your IP address by our hosting provider | Your first visit | To suggest news from your region. Kept only in a cookie on your device. | Legitimate interests |
| Server logs: IP address, browser type, page requested (including search terms), time | Every request | To run, secure and fix the service. Kept by our hosting provider for a short period. | Legitimate interests |
| Search terms | You search | To show results. With smart search, the text is sent to Google's Gemini API to be turned into a search vector, without anything that identifies you. | Legitimate interests |
| Page visit counts: the page path (never its query string, so never search terms or sign-in links), the site you came from, country, browser, operating system and device type. No cookies and nothing stored in your browser. | Every page you open | To know how many people visit and which pages they use | Legitimate interests |
| Usage analytics: pages viewed, and actions such as opening a story or article link, reacting, saving, sharing, following a topic or posting a comment (with the story or topic involved); how long you read and how far you got; a random identifier in your browser; browser, device type and approximate location. If you are signed in, these are linked to your account’s internal id, never your email. Your IP address is used for the location and not stored. | Only if you choose “Allow” | To learn which features are used, so we can improve them | Consent. Withdraw it any time in You → Privacy & data. |
| Session recordings: a replay of the screens you saw and where you tapped and scrolled. What you type, and your email address, are hidden. | Only if you choose “Allow” | To find confusing screens and fix bugs | Consent, as above |
| Error reports: the error, the page, browser and system versions, the app release, and the stories involved. Never your account details, cookies, sign-in tokens or what you typed. | Something fails | To find and fix faults | Legitimate interests (a working, secure service) |
| Emails we send you: sign-in links, confirmations, and individual messages such as a moderation notice | You sign up or sign in, or we write to you | To run your account and answer you | Contract; legitimate interests |
| Messages you send us, and publisher takedown requests | You contact us | To reply and keep a record | Legitimate interests; legal obligation |
People mentioned in the news. News stories name public figures and other people, and bylines name journalists. We process this publicly reported information to organise and summarise the news. To ask about it, email privacy@news-shorts.xyz.
What we do not do. We make no decisions about you with legal or similarly significant effects by automated means alone. We do not build advertising profiles, and we do not sell or rent personal data.
4. What is public
- Your comments are public, shown with the display name you choose before your first comment. You can change it once, on your account page, and the change applies to your earlier comments too.
- Nothing public links your comments to each other or to your account: a comment shows only its display name.
5. Cookies and browser storage
We use no advertising cookies. Analytics cookies are set only after you choose “Allow” in the banner shown on your first visit, and “No thanks” is just as easy. The anonymous page visit counts set no cookie and store nothing. Everything else below is needed for something you asked for, or remembers a choice you made.
| Name | Type | Purpose | Kept for |
|---|---|---|---|
geoCountry | cookie | Your approximate country, to suggest local news | 30 days |
appLanguage | cookie | The interface language you chose | 1 year |
theme | cookie | Light or dark mode | 1 year |
sb-…-auth-token | local storage | Keeps you signed in | Until you sign out |
news:consent | local storage | Your analytics choice, so we don’t ask again | 12 months, then we ask again |
news:preferences:v1 | local storage | Your preferences and reading profile | Until you clear it, reset personalisation or sign out |
news:seen:v2 | local storage | Stories you have opened, so they can be marked as read | Until you clear it or sign out |
feed:scroll | session storage | Your scroll position | Until you close the tab |
ph_…_posthog | cookie and local storage | Analytics, only if you allowed it: a random identifier, so repeat visits are counted once | 1 year, or until you switch analytics off |
__ph_opt_in_out_… | cookie and local storage | Records that you switched analytics off | 1 year |
- Switch analytics on or off at any time in You → Privacy & data. Switching off stops them at once and discards the identifier.
- Your browser can delete all of the above.
- Outlet logos are fetched by our own server, so Google’s logo service never sees your IP address.
- Article images load from the publisher’s own servers, without telling them which page you were on.
6. Who we share data with
These service providers process data only on our instructions, under contracts that include UK GDPR terms. We will also disclose data if the law requires it, or to protect the service and its users.
| Provider | What for | Data | Where |
|---|---|---|---|
| Supabase | Database and sign-in | All account data, and the hashed IP addresses used for rate limiting | EU (Ireland); Supabase Inc. is in the US |
| Vercel | Hosting the site and API, and counting page visits | All web traffic, including IP address, browser details and URLs; for visit counts, only the page path, referrer, country and device type | Servers in the EU and US; Vercel Inc. is in the US |
| Google (Gemini API) | Summarising news, and turning search text into search vectors | News content and search terms, with nothing that identifies you | US and other countries |
| Google (sign-in) | Only if you choose “Continue with Google” | Your Google identity | US |
| PostHog | Usage analytics, only if you allow them | The analytics data above, with IP addresses discarded | EU (Frankfurt); PostHog Inc. is in the US |
| Sentry (Functional Software Inc.) | Error monitoring | The error reports above, with IP addresses discarded | US |
| Resend | Sending sign-in, confirmation and other emails | Your email address and the message | EU (Ireland); Resend Inc. is in the US |
7. International transfers
Some providers are in, or can access data from, the United States. Where they do, we rely on the UK’s adequacy regulations for the US (the UK Extension to the EU–US Data Privacy Framework) where the provider is certified, or on the UK International Data Transfer Agreement or Addendum. Email privacy@news-shorts.xyz for a copy of the relevant safeguards.
8. How long we keep it
| Data | Kept |
|---|---|
| Account, preferences, saved stories, reactions | Until you delete your account |
| Comments | Until you delete your account. Deleting a comment removes its text. |
| Reports and moderation records | Until your account is deleted |
| Records of moderation and account actions we took | 2 years, naming the account by id only |
| IP addresses for rate limiting | About 1 day |
| Usage analytics | 1 year. Deleted sooner if you delete your account. |
| Session recordings | 1 month |
| Error reports | 30 days |
| Server logs | As set by our hosting provider, typically days to weeks |
| Takedown requests | As long as needed to show we complied |
9. Your rights
Under UK GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to send it to you in a portable format. You can also withdraw any consent you gave.
- Download your data: You → Privacy & data → “Download my data” gives you one file with your account data and the settings kept in that browser.
- Delete your account: You → Account → “Delete account” deletes your account, preferences, saved stories, reactions, comments and reports at once, and asks our analytics provider to delete usage data linked to you.
For anything else, or if you can’t sign in, email privacy@news-shorts.xyz. We will reply within one month. If you are unhappy with how we handle your data, please tell us first; you can also complain to the Information Commissioner’s Office at ico.org.uk.
10. Children
The service is for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has an account, email privacy@news-shorts.xyz and we will delete it.
11. Security
Traffic is encrypted in transit and our providers encrypt data at rest. Each user’s private data is protected by row-level access rules in the database, and access to production systems is limited to the operator. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the ICO as the law requires.
12. Changes
We will post changes here with a new date. If a change is significant, we will also tell account holders by email before it takes effect.