Privacy Policy
What's New? — the content-tracking app
Last updated: 28 September 2026
This policy explains what personal data the What's New? Android app and its backend service collect, the purpose and legal basis for each use, who the data is shared with, how long it is kept, and the rights you have. If anything here is unclear, contact us.
Who we are
Boris Vidojković ("we", "us") is the data controller for the purposes of the EU/UK General Data Protection Regulation (GDPR). Contact details are in the Contact section.
What we collect, why, and on what legal basis
The table below is the complete list of the personal data involved.
| Data | When | Purpose & legal basis (GDPR Art. 6) |
|---|---|---|
| Google account: email address, display name, and user ID, plus account timestamps: when the account was created, when it was last used, and when you last changed your chosen topics | Only if you sign in with Google (required to track custom sources; the Explore feed works without signing in). | Authenticate you, sync your data across devices, and tell which device's topic choice is newest. Basis: performance of the service you request (contract). |
| Your tracked sources, read/unread state (including which items you have opened, recorded as "read"), saved items, and chosen topics | When you use the app while signed in. | Keep your library and reading progress in sync across your devices. Basis: contract. |
| A URL you submit for tracking, and the HTML of that page | Only when the page has no standard feed and you consent in the app to AI analysis. | Generate the extraction "recipe" that lets the app read that page. Sent to our AI provider — see Who your data is shared with. Basis: your consent. |
| Search terms you type into Explore's source or feed search | Only when you search, signed in or not. | Return matching results. Search terms are not saved as records, but because they travel in the request address they can appear in our server logs until those are deleted (within 30 days). Basis: our legitimate interest in answering the search you asked for. |
| Your Explore display preferences: the content language and region you choose for the public Explore feed (first suggested from your phone's language setting, and changeable in Settings) | Sent with each request for the Explore feed, including before you sign in. | Show you an Explore feed in your language and relevant to your region. Held on our server only in a short-lived cache (minutes) and in our server logs, which are deleted within 30 days. The language and region you choose stay on the device that set them and are not synced to your other devices. This is a preference you set, not your device's location. Basis: performance of the service you request (contract). |
| Problem reports and usage limits: your user ID next to a hashed identifier of a source, and counters keyed to your user ID | When you report that a tracked source is broken, when the app reports on its own that one stopped returning items, and when you add sources. | Decide when a broken source needs repairing (a repair you request starts only after enough different people report it) and enforce daily and fair-use limits. These entries expire automatically within 7 days, including after you delete your account. Basis: our legitimate interest in keeping the service working and preventing abuse. |
| Crash diagnostics: crash traces, device model, OS and app version, and the crash-reporter's installation identifiers (Crashlytics installation UUID, Firebase installation ID, session IDs) | On every install by default; you can turn this off in Settings → Crash reporting. | Find and fix crashes. Via Firebase Crashlytics. Basis: our legitimate interest in a stable app; you may object at any time using the toggle. |
| Aggregate usage events (e.g. which setup and conversion steps occurred) | While using the app, including before you sign in. No account identifier is attached to an event; like any web request, the report reaches our server from your network address, which is not stored with the event. | Understand where the setup flow works or fails, in aggregate. Stored on our own server as daily counters per event type — individual events are not kept. Basis: our legitimate interest in improving the app. |
| Product-analytics events and a device-based identifier: a small set of custom events we define (an Explore item opened, a source added, the subscription screen shown, a purchase completed, a one-time marker when you opt in, a prompt asking for a site's specific updates page being shown, and a source being added after that prompt — none of these events carries the address, site name or any other detail of what you added), plus the events Google Analytics collects automatically once enabled (such as app opens, session starts, app engagement, and app/OS updates — automatic screen-name tracking is turned off), plus the random app-instance identifier Google Analytics assigns to your install and the approximate (coarse, IP-derived) location, device model, OS and app-version information it collects automatically | Only if you turn on Usage analytics (off by default). Collection — including the automatic events — is disabled until you opt in, and turning it off again stops collection and clears the local analytics data, rotating the app-instance identifier. | Measure retention and where people drop off after setup, so we can improve the app. Processed by Google via Google Analytics for Firebase, configured for device-based reporting only: no advertising identifier, no ads personalization, no Google Signals, and it is never tied to your Google account (we never set an analytics user ID). Basis: your consent. |
| Network address (your device's IP, as seen by servers you contact) | Whenever the app makes a request — to our server, and directly to the websites and image hosts of the sources you track. | Deliver responses; protect our public endpoints from abuse (we hash the address into a short-lived rate-limit key). Sites you track receive your address like any web request. Basis: legitimate interest (security) / contract. |
| Subscription record: purchase token, product ID, subscription state, current-period end, and acknowledgement/verification timestamps | Only if you buy a subscription. | Unlock and verify premium features. Purchases run through Google Play Billing; we store the record above on our server but never see your card details. Basis: contract. |
| Aggregate source-following statistics derived from the tracked-source URLs already stored for sync | When you track sources while signed in. | Rank sources that we have already reviewed and published in Explore. This processing is not controlled by the nomination-consent choice; we do not show other users who follows a source or its exact follower count. Basis: our legitimate interest in making the curated catalog relevant. |
| Source-nomination consent and signal: your versioned consent record and, while granted, the source URLs you follow | Only if you affirmatively opt in to "Help nominate sources for review" (off by default). | Count your follows together with follows from other people who consented, so a source may become a candidate for our editorial review. Nothing is published automatically, and no article titles, links, snippets, thumbnails, publication timestamps, or user-chosen source names are contributed. Other users never see which sources you follow or the counts. Basis: your consent. |
We do not collect your contacts, photos, messages, calendar, health data, precise location, or any advertising identifier (the Explore region above is a preference you choose, not a measurement of where your device is), and the app contains no advertising or cross-app tracking SDKs. The aggregate usage events above are our own first-party, server-side measurement. The product-analytics row is the one exception to "no third-party analytics": it uses Google Analytics for Firebase, but only if you opt in, and in a privacy-minimized, device-based configuration — no advertising identifier, no ads personalization, no Google Signals, and never linked to your account.
Who your data is shared with
We use the service providers below to run the service. We do not sell personal data.
Our AI provider (DeepSeek)
When you add a page and no standard feed can be found for it (the app checks first — RSS, YouTube, Reddit, and pages with discoverable feeds or standard markup are set up without any AI provider), the only way to track it is our AI-assisted setup. The app shows you a disclosure and asks for your consent before proceeding; only then may that page's URL and its HTML content be sent to DeepSeek to work out how to extract new items. If another user's identical request was already analyzed, the stored result is reused and nothing new is sent. Your account identity is never sent with the page.
Exactly what DeepSeek receives: the page's address; a copy of the page as our server fetched it (never from your device, so without your cookies or any login), with scripts, styling and similar non-content markup removed and cut off after the first 80,000 characters; a short list of the page structure found in that copy; and, if a first attempt did not work, a note describing why, so it can try again. Nothing else is sent: not your email, name, user ID, device details or network address. A public page can still mention people, so that content can include personal data about whoever the page is about.
Your consent choice is recorded on your device; you can withdraw it at any time in Settings → AI-assisted source setup (clearing the app's data also resets it, and you would simply be asked again).
Important, and stated plainly: we do not currently have a written assurance from DeepSeek about whether content sent to its API is retained or used to train models. DeepSeek's published privacy policy expressly does not cover data processed through its Open Platform by downstream applications like ours, and its platform terms state no retention or training commitment we could pass on to you. So there is no applicable commitment to point to: treat anything sent through the AI path as data that may be retained or used by DeepSeek, and avoid adding pages that contain personal or confidential information about you or others through it. DeepSeek is operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., in China. Its platform terms do not say where API content is processed, and its privacy policy, which says the personal data DeepSeek collects directly is stored in the People's Republic of China, does not cover content sent by apps like ours. Assume content sent through this path is processed in China. We are seeking a written answer or data-processing agreement and will update this section when we have one; until then, sending a page you add stays behind the explicit in-app consent above. Recipe maintenance and source-nomination screening, described below, do not use that consent.
What our own server keeps from this: for most pages, the fetched HTML is discarded once the recipe is generated. For pages that need in-browser rendering, our server keeps the rendered page HTML in a short-lived cache (each copy expires after 3 hours; it is re-rendered periodically for as long as the source needs it) so your device can read such pages through our server. The resulting "recipe" — a small set of extraction rules, not the page content — is cached and shared.
The examples we show you before tracking starts: once the AI has worked out how to read a page, our server applies those rules to it and keeps a short preview so you can check it before anything is tracked — up to five item titles, their links and any dates shown beside them, taken from the page you submitted. This is page content, not just technical settings, and it can reveal the subject of what you chose to follow, so we are explicit about it: it is stored on our server only while your review is open, it is erased the moment you confirm, decline, or the review expires or fails, and nothing about that page is tracked until you confirm. We never use these examples for analytics and they never appear in our application logs. After a review ends we keep only a record that it happened — no titles, links or dates — for up to 30 days, so that a second device can tell a review you declined from one that expired.
Choosing "No" does not undo the AI transfer. By the time you see the examples, the page's address and content have already been sent to DeepSeek as described above. Declining stops the source from being tracked and returns any held allowance slot; it cannot retract that transfer.
Recipe maintenance: separately from anything you submit, our server periodically re-checks pages that recipes exist for and may re-analyze one with the same AI provider when its recipe stops working. Those maintenance requests contain only the page's address and its publicly available content as fetched by our server — never your identity, account data, or anything from your device. Basis: our legitimate interest in keeping the service working.
Source-nomination screening: before a person reviews a source that consenting users' follows made a candidate, our server may ask the same AI provider to screen it. That request contains the source's address, its page title and a short excerpt of its publicly visible text, never who follows it or how many people do. The AI can only reject a candidate or pass it on for human review; it never approves one. Basis: our legitimate interest in keeping the curated catalog safe.
What your AI consent covers: the disclosure and consent described above, and withdrawing that consent, apply to pages you add. Recipe maintenance and source-nomination screening are separate requests that we make on the basis of our legitimate interest, not your AI consent. They contain publicly available page content and never your account identity, and withdrawing AI consent does not stop them. Whether they count as transfers of personal data outside the EEA/UK is part of our open review of the DeepSeek arrangement (see International transfers).
Google / Firebase
- Firebase Authentication — verifies your Google Sign-In. In addition to your email, display name and user ID, Google processes your IP address and device/user-agent information as part of authentication; per Google, sign-in IP logs are kept for a few weeks and other authentication data until you delete your account. Firebase Authentication is operated from Google's US data centres.
- Firebase Crashlytics — receives the crash data and identifiers listed above. On by default; switch it off any time in Settings → Crash reporting. Google retains crash traces and their associated identifiers for 90 days before beginning removal from its live and backup systems.
- Google Analytics for Firebase — receives the product-analytics events and the device-based identifiers listed above, only after you opt in in Settings → Usage analytics. It is configured for device-based reporting with no advertising identifier, no ads personalization, no Google Signals, no Ads linking, and no analytics user ID, so it is never tied to your Google account. Google processes this data in the US. We set analytics data retention to 14 months. Turning the toggle off stops collection and clears the local analytics data.
- Google Play Billing — processes subscription purchases; we receive the subscription record described above, never your payment-card details.
These are governed by Google's Privacy Policy and Firebase's privacy documentation.
Our own server
Your synced data (sources, read state, saved items, topics, subscription record, entitlements) and the aggregated usage events are stored on our own server, running on infrastructure we operate in Germany. This data is not shared onward except as described above.
Opening links and loading images
When you tap an article, the app first records that item as read (so your read state syncs across your devices) and then opens the article in your device's browser. From that point the website and your browser handle your visit under their own policies; the app does not observe your browsing after the link opens. Where a source or saved item has an image, your device loads it directly from that publisher or its CDN, which therefore sees your device's network address.
How long we keep it
- Account and synced data — kept while your account exists. Sign out to clear data on a device; request account deletion to remove it from our server (see Your rights). Deletion starts as soon as our server records your request and normally completes immediately; if a step is interrupted, our server completes it automatically in the background. Transaction and tax records for purchases are kept by Google Play, which processes the payment; deleting your account removes our own copy of the subscription record.
- Deletion record — while an account deletion completes, and for up to 48 hours after it completes, we keep a minimal technical record of it: your user ID, the times the deletion was requested and completed, and retry bookkeeping. Its only purposes are to ensure the deletion runs to completion and to prevent a still-signed-in session on another device from re-creating the deleted account. It is then deleted automatically.
- Disaster-recovery backups — we keep encrypted backups of our database so your account and content can survive a server failure. Because a backup is a point-in-time copy, it may still contain data from a recently-deleted account for up to 30 days, after which it expires and is deleted automatically. These backups are isolated from the live service and are used only to recover from a disaster; they are never queried to answer everyday requests. If we ever restore from one, we first reconcile it so that any account deleted after that backup was taken stays deleted — a restore cannot bring a deleted account back.
- AI recipe data — statically fetched HTML is discarded once the recipe is generated; rendered-page HTML for dynamic sites is cached for up to 3 hours per copy and refreshed while the source needs it (see the AI-provider section); the generated recipe (extraction rules, not page content) is kept without a fixed expiry for as long as it is useful for reading that page, and is tied to the page, not to any account. DeepSeek's retention is unresolved — its published terms give us no applicable commitment (see above).
- Review examples — the item titles, links and dates we show you before tracking starts are kept only while your review is open (at most seven days) and are erased on confirmation, decline, expiry or failure. The record that a review happened — carrying no titles, links or dates — is kept for up to 30 days so another device can tell a decline from an expiry.
- Crash reports — retained by Firebase Crashlytics for 90 days before removal begins.
- Usage events — stored in aggregate (by event and day) with no account identifier or network address, and kept without a fixed expiry because the counters describe no one.
- Product analytics — kept by Google Analytics for Firebase for 14 months, if you have opted in; withdrawing consent stops collection and clears the local analytics data.
- Rate-limiting — the hashed network-address key expires automatically within 2 hours.
- Problem reports and usage limits — the entries keyed to your user ID expire automatically within 7 days, including after account deletion.
- Server logs — standard operational logs of requests to our server (which include network addresses and requested paths, and therefore any search terms in them) are kept for reliability and security and deleted within 30 days. Our application logs can also record your user ID next to account operations such as sync, purchase verification and account deletion, and the address of a page being set up. Deleting your account does not remove these lines early; they are deleted on the same 30-day schedule.
- Firebase Authentication — sign-in IP logs a few weeks; other authentication data until account deletion, per Google.
How we protect your data
- Traffic between the app and our server, and between our server and every provider named above, is encrypted with HTTPS/TLS. The app itself never sends anything over unencrypted HTTP — Android's network security policy blocks it.
- One narrow exception exists server-side: when our server fetches a publisher's page and that site is only reachable over unencrypted HTTP, that server-to-publisher fetch is unencrypted. It carries the page address being fetched, never your identity or account data.
- Access to our server and databases is restricted to the operator; the service runs on infrastructure we control in Germany.
- Our disaster-recovery backups are encrypted before they leave the server and stored separately from it, so a copy exists if the server is lost. They expire automatically (see How long we keep it) and are reconciled against your current account status before any restore can serve traffic.
- We do not store payment-card details; card handling stays entirely within Google Play Billing.
- Our public endpoints keep only a hashed, short-lived key derived from your network address for abuse prevention; server access logs are deleted within 30 days (see above).
No method of transmission or storage is perfectly secure, but we take reasonable measures appropriate to the limited data we hold.
Your choices and rights
Under GDPR and similar laws you have the rights below. To exercise any of them, or if you have a complaint, email us at the address in Contact.
- Access & portability — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — delete your account and its associated data from our server at any time: in the app via Settings → Account → Delete account, or from our account-deletion page without the app. Deletion starts as soon as our server records the request and, if interrupted, is completed automatically in the background; a minimal deletion record (see How long we keep it) protects it from being undone. Signing out only clears local data on that device.
- Restriction & objection — ask us to restrict processing, or object to processing we base on legitimate interests (crash reporting, the aggregate server-side usage counters, abuse prevention). For crash reporting you can object directly with the Settings → Crash reporting toggle.
- Withdraw consent — where we rely on your consent, you can withdraw it at any time, as easily as you gave it: for product analytics use Settings → Usage analytics (withdrawal stops collection and clears the local analytics data), for the AI transfer use Settings → AI-assisted source setup (withdrawal stops future transfers of pages you add; sources you already track keep working on your device; recipe maintenance and source-nomination screening, which never carry your identity, are not based on this consent and continue), and for source nomination use Settings → Help nominate sources for review. Nomination withdrawal removes your account from nomination counting and prevents an unpublished candidate from continuing to qualify through your signal; it does not retract a source we already reviewed and published in the curated catalog. Aggregate ranking of already-curated sources is separate and continues as described above.
- Use without an account — the Explore feed works signed-out; an account is only required to track your own custom sources.
- Complain — if you are in the EU/UK you may lodge a complaint with your local data protection authority.
Children
What's New? is not directed at children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their data.
International transfers
Some providers named above process data outside the EEA/UK. For Google/Firebase (United States), transfers are covered by Google's published safeguards — its EU–US Data Privacy Framework certification and standard contractual clauses in the Firebase Data Processing and Security Terms.
DeepSeek is in China (see Who your data is shared with). For DeepSeek we do not currently have such a safeguard in place — no data-processing agreement, no standard contractual clauses. That is unresolved, and we say so rather than imply otherwise. Until it is resolved, for pages you add: the transfer never happens by default; it happens only for a page you choose, after an in-app disclosure that tells you the above, with your explicit consent (the GDPR Art. 49(1)(a) derogation) — and consent is a stopgap here, not a substitute for proper safeguards, which is why the disclosure also warns you against sending pages containing personal information. Recipe maintenance and source-nomination screening also send publicly available page content to DeepSeek, without your account identity and without that consent (see Who your data is shared with). You can ask us for details at any time.
Changes to this policy
If we change how we handle data we will update this page and its "last updated" date, and surface material changes in the app.
Contact
Questions, data requests (including deletion), or complaints:
Boris Vidojković
vidojkovicboris@gmail.com