Security & Trust

What we hold

An account is a name, an email address, and either a password or a link to your Google account. Alongside it: the channels you follow, the stories you saved, which ones you have opened, and anything you typed into the assistant or a support ticket. That is the lot.

We do not ask for a date of birth, a phone number, or a payment card, because none of them are needed to read the news.

How it is kept

• Passwords are stored as bcrypt hashes. Nobody here can read yours, including us.
• Signing in with Google stores an identifier and never a password.
• Sign-in attempts are rate limited per address and per network, so a stolen password list cannot be tried at speed.
• Changing your password signs out every other device, because that is the one thing people do when they think somebody else is in.
• The site is served over HTTPS, and session cookies do not travel any other way.

Fetching other people's feeds

Anyone signed in can submit a channel, which means the server fetches an address a stranger chose. Those requests are checked before they are made: private and loopback addresses are refused, redirects are re-checked rather than followed blindly, and the whole thing is rate limited. It is a well-known way to turn a server into somebody else's proxy, and it is guarded rather than trusted.

We are also a guest on those servers. Fetches are conditional, so an unchanged feed costs a publisher almost nothing, and a source that starts failing is backed off rather than hammered.

Leaving

Deleting your account deletes it. Your subscriptions, saved stories, briefings, assistant conversations, support tickets and sessions go with it — not a flag on a row that stays put. Two things survive deliberately: channels you added to the directory, because other people subscribe to them, and replies you wrote on a shared thread, because a conversation should not lose half of itself. Both have your name removed.

The button is on your account page once you are signed in, and it does not route through us asking you to reconsider.

What we do not do

• We do not sell your data, and there is no arrangement under which we would.
• We do not email you unless you asked for a briefing, and every one of those carries a working unsubscribe link that needs no sign-in.
• We do not track you across other websites.

The site does carry Google advertising and Google Analytics, which set their own cookies and are described in the privacy notice. Saying otherwise here would be untrue.

Being honest about the machine

Some of what you read here is written by software: the classification of a story, the grouping of reports into one event, the assistant's answers. Wherever that is so, the page says so. Headlines and article text are the publisher's own words, unchanged.

Reporting a problem

If you have found a security flaw, please tell us before you tell anyone else, and give us a reasonable window to fix it. We will not threaten you for reporting it in good faith.

Raise a support ticket from your profile once you are signed in.

We do not run a paid bug bounty. We would rather say so than imply one.