Privacy Policy

Your email and password. The password is hashed by Supabase Auth; we never see the plaintext and we can't recover it for you.

The briefing configuration you enter: country, focus description, keyword list, and the recipient addresses you add.

The billing state that Lemon Squeezy sends us through webhooks — subscription ID, status, trial end date, cycle. Card details stay with Lemon Squeezy; we neither see nor store them.

A record of which stories went into which briefing, so the next morning doesn't repeat yesterday's news. That record keeps story identifiers and timestamps for 14 days, and is scoped to the briefing.

Standard server logs from the hosting layer: IP, user agent, request paths, timestamps.

When you add a recipient to a briefing, we store the address and a random unsubscribe token. That's the whole record.

We don't fingerprint recipients, we don't track opens with a pixel, and we don't sell or share the list. Any recipient can unsubscribe from the link in any briefing's footer, without logging in and without going through you. Once they do, we mark the address unsubscribed with a timestamp and keep the record, so the same address can't be re-added by accident.

We fetch publicly available articles from the source list for each covered country. For each article we keep URL, headline, publication date, and an excerpt for up to 180 days, then delete.

The stored copy powers the daily summaries and the in-dashboard search. We don't repackage or redistribute the articles themselves, and search is gated so that only subscribers with an active subscription in a country can search that country's archive.

We rely on a small set of processors to run the service:

• Supabase — database and authentication. Holds almost everything in §01 except logs.
• Vercel — hosts the app and ingests server logs.
• Lemon Squeezy — billing and merchant of record. Card data stays with them under their own privacy policy.
• Resend — sends the morning emails on our behalf.
• Upstash — rate limits requests. We send a hashed session identifier, not account data.
• An LLM provider— generates the summaries. We send the article text and your focus and keyword configuration. We don't send account identifiers. The provider will be named on this page before general launch.

We do not run third-party analytics in the app. No Google Analytics, no Segment, no ad pixels, no marketing SDKs.

Raw news stories

180 days, then auto-pruned by a scheduled database job.

Per-briefing delivery records

14 days.

Server logs

30 days at the hosting layer's default.

Account data

As long as the account exists. Delete the account and the row goes; briefings, recipient lists, and delivery records cascade with it.

Billing records at Lemon Squeezy

Retained under their policy, not ours.

You can export your data: email us and we return JSON within 30 days of the request.

You can delete your account from the account page once that page ships, or by email. A delete cascades across your briefings, recipients, and delivery records.

You can correct anything the dashboard exposes by editing it directly. For fields the dashboard doesn't yet surface, email us.

You can withdraw consent at any time: cancel the subscription, unsubscribe a recipient, or delete the account.

One session cookie, set by Supabase Auth so you stay logged in between page loads. No analytics cookies. No ad trackers. No cross-site identifiers.

The database runs in Supabase's EU-West region. Vercel, Resend, Lemon Squeezy, and the LLM provider operate globally; in the normal course of the service, data will be processed in the United States as well as the EU.

If your legal environment requires data residency inside a specific jurisdiction, this service isn't the right fit today.

privacy@briefer.media for privacy and data questions. hello@briefer.media for everything else. Expect a reply within 5 working days; regulator-backed requests get priority.