Privacy Policy

1. Who is responsible for your information

pushfeed is responsible for deciding how your personal information is used (the data controller).

For privacy questions or account requests, email privacy@pushfeed.me.

2. Information we collect

• Account information: your email address, a unique account identifier, account creation and sign-in records, and authentication/session information. For email/password accounts, our authentication service stores a password hash, not a readable password. Do not send us your password.
• Google sign-in information: if you choose Google, our authentication service receives the account identifier, email and profile information returned by Google, which may include your name and profile image. We do not request access to your Gmail inbox.
• Your feed preferences: topic names, keywords, selected sources, matching settings, topic colours, notification preferences and the stories matched to your topics.
• Favourites: the stories you save, including their links, titles, summaries, images and when you saved them.
• Push subscription information: if you enable notifications, your browser/device push endpoint, subscription encryption keys and subscription creation time. This lets us deliver notifications to that browser or device.
• Technical and support information: hosting and authentication services may process IP addresses, browser/device information, request times, errors and security logs. If you contact us, we receive your message and contact details.

Your email is required to create and maintain an account. Push notifications and Google sign-in are optional. You can use your feed without enabling push notifications.

Keywords can reveal personal interests. Please avoid entering sensitive personal information about yourself or other people, such as health, political or religious information, in topic names, keywords or support messages.

3. Why we use information

• Providing the service: account creation, sign-in, personalised feeds, saved favourites and essential account emails such as confirmations and password resets. Where UK or European data protection law applies, our basis is performance of our contract with you or steps you request before entering it.
• Optional notifications: we send push notifications only after you enable them and grant browser permission. Where consent is required, you can withdraw it through notification controls or your browser/device settings.
• Security and support: diagnosing failures, preventing abuse, protecting accounts and answering requests. Where applicable, our basis is our legitimate interests in operating a reliable, secure service; you may object where the law provides that right.
• Legal requirements: we may process or preserve information where needed to comply with law or respond to lawful requests.

We do not sell your personal information or use your email address for unsolicited marketing. Matching stories to your keywords personalises your feed; we do not use it to make decisions that have legal or similarly significant effects on you.

4. Services and people that receive information

We use authentication and database providers, web hosting providers, domain and DNS providers, and scheduling services to operate pushfeed. These providers process the information needed for their role. Scheduled processing does not require sending your account email address or keywords in the scheduling request.

Where security verification is enabled, our bot-protection provider processes browser, device and challenge information to help distinguish genuine requests from automated abuse. API abuse controls store your account identifier, an operation category, a request count and a window expiry in our database. Rate-limit windows last 60 seconds; expired counters are removed by daily cleanup, and counters are deleted when your account is deleted.

Essential account emails are sent through our authentication and email delivery providers. Browser/platform push services receive the subscription routing information and encrypted notification payload needed for delivery. If you sign in with Google, Google also handles your sign-in under its own privacy policy.

Stories come from third-party publishers and, where enabled, public Reddit sources. Some story images load directly from publishers, which may receive your IP address and browser request information. When you open an external story, that website has its own privacy and cookie practices.

We may disclose information when legally required, to protect people or the service, or to advisers handling a dispute. We do not give publishers your account email or keywords just because you follow their feed.

5. Cookies and device storage

We use authentication cookies to keep you signed in and secure your session. Your theme preference is stored locally in your browser. Older device-stored favourites may remain locally until they are imported into your account or you clear that browser storage. The service worker and push subscription support app installation and optional notifications.

The app currently includes no advertising or analytics tracking scripts. Hosting and security logs are separate from advertising tracking. Clearing cookies can sign you out; clearing site data can remove local preferences and older device-only favourites.

6. How long information is kept

Account details, topic settings and saved favourites are kept while needed to provide your account, until you remove the relevant information or request account deletion. Saved favourites are separate from ordinary feed matches and are not removed by routine feed cleanup.

Ordinary feed matches and associated notification history older than 14 days are eligible for deletion by our scheduled cleanup. This is not a promise that every copy disappears exactly on day 14: cleanup depends on the job running successfully.

Push subscriptions are kept while registered; you can remove them using the app notification controls. Revoking browser permission prevents delivery but may not immediately remove the server-side record.

Support correspondence, security logs and backup copies may remain for as long as needed to resolve the issue, investigate abuse, meet legal requirements or complete the provider backup cycle. Deletion from active systems may therefore precede deletion from backups.

7. Security and international processing

We use encrypted connections, authentication and access controls to protect information. No system is completely secure. Keep your password and devices secure and contact us if you suspect unauthorised access.

Our infrastructure providers may process information outside your country, including the UK, EEA and United States. Where applicable data protection law restricts a transfer, appropriate safeguards are required, such as an adequacy decision or approved contractual safeguards. Contact us for details of the providers and safeguards relevant to your information.

8. Your choices and rights

You can edit or delete topics, remove favourites and control push notifications in the app. Contact us to request account deletion, a copy of your information, correction or assistance with your privacy choices. There is currently no self-service account deletion button.

Depending on your location and the applicable law, you may have rights to access, correct, erase or obtain a portable copy of your information; restrict processing; object to processing; and withdraw consent without affecting earlier lawful processing. Some rights have exceptions. We may need to verify your identity before acting on a request.

You can complain to your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO). You do not need to contact us first to exercise that right.

9. Children

pushfeed is a general-interest news service and is not designed for children. If local law requires parental authorisation for your use, obtain that authorisation before creating an account. Contact us if you believe a child has provided information without the authorisation required by law so we can review and address it.

10. Changes and contact

We will update this page and its date when our practices change, including when we introduce a new email delivery provider or other material processing. We will give additional notice of significant changes where required. You can contact us with questions or privacy requests.

See also our Terms of Service.