Privacy Policy

This policy explains what NewsDiary collects, why, who processes it on our behalf, how long we keep it, and what rights you have. It applies to the iOS app, the Android app, the Chrome extension, the web app at newsdiary.app (including the reader at /pages), and the backend API at *.newsdiary.app.

If you read only one paragraph: we keep what you save in NewsDiary. That is the articles you capture, the notes you write, the audio you record, your diary, and what you post to a Lounge. We do not train models on it and we do not sell it. We run no advertising and no third-party analytics, and we delete it when you delete your account. The full list and our processors are below.

1. Data we collect

From you, directly

• Account identity — your email address and a password hash (Argon2id, never the password itself). If you sign in with Apple, the stable identifier Apple returns. If you sign in with Google, on the Android app through Android Credential Manager or on the web, the Google account identifier and the email address Google returns. Email is used for sign-in, recovery and transactional mail. Other members never see it; they see your handle.
• Article content — text, HTML and PDF documents you choose to capture: from the extension, the in-app browser, a pasted link, the iOS share sheet, or a PDF you pick from your device. This includes the web address of each article you capture.
• Annotations — highlights, written notes, voice recordings (iOS), and their automated transcripts.
• Diary entries and posts — what you write in your diary or publish as your own article.
• Profile — handle, display name, bio and topic interests.
• Political leaning (optional, special category) — a position on one left-to-right scale, only if you pick one. Nothing is stored until you pick it. It is hidden by default. You choose who can see it: nobody, your Lounges, or everyone. It appears only on your profile. It is never used to rank, filter, target, recommend or colour anything you read, and it is never sent to any processor. You can remove it in your profile at any time. It is special-category data under GDPR Art. 9, so we process it only on your explicit consent (§2).
• Lounges and social activity — the Lounges you create or join, your role, invitations you send or accept, articles you share into a Lounge, comments, reactions, and the members you follow.
• Reading activity you control — your reading list and read state, the stories you keep open, the sites you have switched on for automatic capture (extension), and which Lounge activity you have already seen.
• Search — when you search your diary, the words are used to run that search and are not kept. They are not written to our logs.
• Messages — chat, in the iOS and Android apps, is end-to-end encrypted and we cannot read it. The chat server necessarily processes delivery metadata: which rooms exist, who is in them, and when messages were sent.
• Reports and blocks — if you report content, we store what you reported, the reason and any note. Chat is encrypted, so a chat report includes the copy of the message your own app held. If you block someone, we store that so we can hide you from each other.
• Notification tokens — so we can deliver the notifications you turn on. A token identifies a device or browser for delivery only. It is not used to build a profile of you.
  • on iOS, the Apple push token for the device;
  • on Android, the Firebase Cloud Messaging token for the device;
  • in the extension and the web app, the push subscription your browser creates: an address at your browser's push service and the keys that encrypt messages for that browser.
• Optional Layers — Illustrations, Timelines, Concepts and Language learner are off until you switch them on, and they run only on articles you open. They read the text of the article, send it to our AI provider like any other Layer, and keep the result:
  • Illustrations, Timelines and Concepts are derived from the article's own words. They are stored once per article and shared with other members who read the same article. They carry nothing about you.
  • Language learner adds a translation under each sentence. The language you are learning is kept as a setting of the Layer. A translation is stored under the sentence, the language pair, the model and the prompt version, and is shared with other members who read the same sentence. It carries nothing about you and is not deleted with your account. A translation of text that is private to you is kept for you only, and deleted with the article and with your account.
  • A selection you add to Concepts is saved as a private note: only you see it, it is not shared, published or exported with your notes, and it is deleted with the article and with your account. The explanation of a term is stored once per article and term, holds the article's words and nothing about you, and is shared.
• Locale and display preferences — for example fr or en, from your device or set by you.
• Consents — which consents you gave, when, and the policy version in force.
• Your own AI provider key, if you add one — encrypted at rest with AES-GCM and used only to call that provider for your Layers. It is deleted when you remove it and with your account.

Kept only on your device

• Android in-app browser history — the last 40 pages you visited in the in-app browser, so you can go back to them. It stays on the device and is never sent to us.

Generated by our systems

• AI usage metadata — model, tool, token counts, cost estimate and time. We do not log the text of prompts or responses.
• Web-grounding usage — counts and times of grounded fact-check lookups, to meter a capped plan.
• Layer job records — the status and time of each Layer run, in progress or finished.
• Engagement metadata — when you last opened an article, monthly counts of articles and annotations, and a search index of your own content.
• Diagnostic events — when a request fails we record the route, the error type, the HTTP status, an error message, a request id and your user id, so the fault can be traced. When you delete your account, the user id is removed from these records.
• Server monitoring — Microsoft Azure Application Insights records requests, exceptions and performance. Request logs record the address of each request, with sign-in codes, tokens and search words removed.
• None of the above carries your article text, notes or messages. Our apps contain no crash reporting or analytics SDK.

We do not collect

• Your location. We never ask for it. The map layer finds places named in an article, not you.
• Advertising identifiers.
• Any third-party analytics, attribution or advertising SDK.
• Browsing history beyond the articles you capture. A page becomes data only when you capture it, or when you open it on a site you switched on for automatic capture.
• Tracking cookies. The web app sets two first-party cookies, a session cookie and a CSRF token, so that your login is not exposed to scripts in the page. The marketing site sets one first-party cookie that remembers you dismissed the banner. No third-party cookies are set.

2. Why we process your data (lawful basis under GDPR Art. 6)

Special category data (Art. 9)

The optional political leaning in §1 is special-category data. We process it only on your explicit consent under Art. 9(2)(a), given when you pick a position. It is used only to show it on your profile to the audience you chose. Withdraw consent by removing it in your profile. That deletes it, and nothing else about your account changes.

3. Processors

Each vendor receives only the data its function needs.

Notification text is the short line you see on the lock screen: who acted and up to 120 characters of what they wrote. For chat, which we cannot read, it says only which Lounge has a new message.

We run two services on our own infrastructure instead of sending that data to anyone else:

• Whisper (audio transcription) — our own Azure container in France Central.
• The chat server — our own Azure virtual machine in the United States (East US). Message content is end-to-end encrypted and unreadable there. Room membership and timing metadata are processed on that machine, so that metadata is transferred to the US.

Transfers to the US rely on the EU–US Data Privacy Framework where the vendor is certified, and on Standard Contractual Clauses otherwise. Apple Foundation Models, when used, run on your device and no data leaves it.

4. Retention

• Active account: until you delete the account.
• Delete account: immediate and permanent. The account is erased when you confirm, with everything it owns. There is no grace period and no undo. Lounges you own that have other members pass to one of them. Your chat account is removed from every room, its name and picture are cleared, and every device is signed out; an empty account identifier remains on the chat server. Messages you sent stay in their rooms as encrypted text, and room history from before the deletion still shows the name you used. See Delete your account
• Withdrawing the privacy consent: a different route, with a 30-day window. It also ends the account, because consent is the lawful basis. During those 30 days you can sign in and cancel; changes are blocked but reading and export keep working. After 30 days the account is deleted as above.
• Database backups: 7 days, then overwritten.
• AI usage metadata and web-grounding usage: deleted after 7 days, except the current calendar month, which is kept so that quotas and budgets can be computed.
• Layer job records: deleted once the run has finished and is 7 days old.
• Diagnostic events: deleted after 7 days.
• Application Insights telemetry: 90 days.
• Request logs: 30 days.
• Reports: deleted 12 months after filing, whatever their status, so repeat behaviour stays visible for that time. A report you filed is also deleted with your account.

5. Your rights

Under GDPR you may:

• Access — ask for a copy of your data by email. We send it within 30 days.
• Rectify — edit your profile, annotations and diary in the app.
• Erase — delete your account in the app (Delete my account), or email us.
• Portability — the copy we send is machine-readable (JSON).
• Object — marketing email is opt-in; to stop it, email us. Withdrawing the privacy consent ends the account (§4).
• Withdraw Art. 9 consent — remove your political leaning in your profile. It is deleted and nothing else changes.
• Complain to your data protection authority. In France: CNIL, www.cnil.fr.

Requests sent to services@capewesley.com are answered within 30 days.

6. Security

• Passwords are hashed with Argon2id and never stored in plain text.
• All traffic to our services uses HTTPS.
• On the web app, your session is held in an HttpOnly cookie; the login token is never exposed to scripts in the page.
• Chat is end-to-end encrypted. We cannot read your messages, and neither can anyone who obtains the chat server's database.
• Stored files, including PDFs and audio, are encrypted at rest by the hosting provider.
• Service credentials are held in Azure Key Vault, not in the database or the source code.
• If you use your own AI provider key, it is encrypted at rest with AES-GCM.

7. Children

NewsDiary is not directed at children under 16, and our terms require members to be at least 16. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, write to services@capewesley.com and we will delete the account.

8. Changes

We may update this policy. The version above is recorded with every consent you give. When the version changes, the apps ask you to accept the new policy on your next session.

9. Contact

Cape Wesley — services@capewesley.com · Contact