Privacy policy

What happens to your data when you visit news-reader.app and use the News app hosted there – in plain words.

• Controller
• Visiting the website
• Using the News app
• Your rights

Controller

The controller within the meaning of the GDPR for this website and the News app hosted at news-reader.app is:

Visiting the website

Server log files

With every request, the web server automatically processes the data your browser transmits: IP address, date and time, requested address, HTTP status, amount of data transferred, referrer and user agent. This is technically necessary to deliver the pages and the app and to keep them secure, for example to detect attacks. Log files are kept only as long as these purposes require and are then deleted. If a hosting provider operates the server for us, it acts as a processor bound by our instructions (Art. 28 GDPR). Legal basis: Art. 6(1)(f) GDPR.

Visitor statistics with Pirsch Analytics

All pages of this website use Pirsch Analytics, a cookie-free web analytics service built on privacy by design. The News app itself uses no analytics at all. To count visitors, Pirsch derives a visitor ID from the IP address, the user agent, the date and a salt using a one-way hash function when a page view arrives.

The IP address is stored neither in full nor in part and is irreversibly anonymised by the hash. Because the date and a per-website salt are included, visitors cannot be recognised for longer than 24 hours and cannot be tracked across websites. A rough location (country, city) is derived from a locally hosted database. Pirsch sets no cookies and stores nothing on your device. Only the page viewed is recorded, without query parameters or anchors – never the content of your feeds, your reading list, pairing links or addresses you share with the app.

We also count a few clicks as anonymous events, to see which information helps: opening and installing the app, the links to GitHub, the API documentation and the payment page, opening an FAQ question, choosing a Collector example, switching language, theme or animations, and visits to missing pages. Each event only carries fixed values such as the event name, its position on the page, the page language or the chosen option – never text you enter and nothing that identifies you. It is counted with the same anonymous visitor ID as page views. Legal basis: Art. 6(1)(f) GDPR.

Provider: Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany. Processing takes place on servers in Germany; no data is transferred to third countries. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in understanding which content is found and used. More: privacy at Pirsch Analytics.

Local settings instead of cookies

This website sets no cookies. If you choose a language or a colour theme, that choice is saved in your browser’s local storage (nr.lang, nr.theme) and never transmitted. The News app also keeps its display settings (news.*) there and stores your feeds, entries, offline copies and sync key in your browser’s database (IndexedDB). None of this is transmitted except as described below – for sync only in encrypted form. This is strictly necessary to provide the functions you asked for (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

Voluntary support via Stripe

News Reader is free. If you want to support it, the “Pay what you want” link takes you to a payment page hosted by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). No Stripe script is embedded on this website – data only reaches Stripe once you click the link. Stripe processes the payment details you enter there; we never see full card or bank details. We receive the amount, the time, the name and e-mail address you entered and, depending on the payment method, limited details such as the card brand and the last four digits. After the payment, Stripe sends you back to our thank-you page.

Legal basis: Art. 6(1)(b) GDPR (carrying out the payment you initiated) and Art. 6(1)(c) GDPR in conjunction with the retention obligations under German commercial and tax law (up to 10 years). Stripe may also process data in the USA; Stripe, Inc. is certified under the EU–US Data Privacy Framework. Details: Stripe privacy policy.

External links

Links to other websites, for example GitHub, are ordinary links. Only when you click one does your browser connect to that website; from then on, its operator’s privacy policy applies.

Using the News app

News is local-first: your feeds, entries, reading list and reading progress are stored in your browser (IndexedDB) on your device, not on our server. The server only steps in where a browser cannot do the job alone:

Loading feeds (Collector)

When you follow a website or refresh your feeds, the app sends the source’s address to /api/collect. The server fetches the source on your behalf and returns its entries. Feed contents are cached for all users together for up to 14 days, stored by source address only and without any link to you; like every request, the request itself appears in the server log files (see above). To prevent abuse, the server counts requests to its interfaces (feeds, offline copies, sync) per client in short time windows; for this it keeps a salted hash of your IP address (for IPv6, of your network prefix) and deletes it automatically after about two days. If a source turns the server away, the app tries to fetch it directly from your device: your browser then contacts the source itself (without cookies), so the source sees your IP address, just as when you open one of its articles. The app sends what it received to /api/collect only to have it read; the server returns the entries to you and neither stores nor shares this content. If you have installed the app and the number on the app icon is switched on, some browsers (Chrome, Edge) let the app make these requests in the background while it is closed, at most twice a day; the results only change the number on the icon. Legal basis: Art. 6(1)(f) GDPR.

Offline copies for your Later list

When you move an entry to Later, the app requests a readable copy of the article from /api/article. The server fetches the page and returns its text, which is then stored on your device. On the server, the copy is cached for up to 14 days by article address only, without any link to you; the request itself appears in the server log files like every request. Legal basis: Art. 6(1)(f) GDPR.

End-to-end encrypted sync

Sync is optional. It contains your feeds, your decisions and the posts of the last 14 days you have not sorted yet (title, address, date and image address), so all your devices show the same Inbox. When you pair devices, your data is encrypted on your device (AES-256-GCM) before it is uploaded. The key never leaves your devices, so we cannot read the content. The server stores one encrypted file per group of paired devices, named after a hash of the access token, together with its size and modification time. It is deleted when you choose Delete server copy in the app’s settings (unpair your other devices first, or they upload it again), and automatically 180 days after it was last used. Legal basis: Art. 6(1)(b) GDPR.

Content from the sources you follow

Entries and the feed list may contain images and site icons that your browser loads directly from the source website or its image server, and “Read now” opens the article on the original website. In both cases the respective operator receives your IP address and is responsible for that processing. The app sends no referrer.

Other News Reader instances

This policy applies to news-reader.app only. News Reader is open source – if you use an instance run by someone else, that operator is the controller.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). To exercise them, contact us using the details above. You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Statistics and caches contain no data that could be attributed to you (no cookies, no stored IP addresses, recognition for at most 24 hours), so we usually cannot assign individual records to a person.

Your reading data is on your devices, and your synced data is encrypted with a key only you hold. You can export your feeds as OPML at any time and delete everything in the app.

Last updated: September 2026. Translations of this page are provided for convenience; the German version is legally binding.