Privacy Policy
NaasNews is a news reader. We collect as little as we can: you can read the site and use the apps without an account, and we do not sell your data, do not show you tracking-based advertising, and do not track you across other apps or websites.
Who we are
NaasNews (“we”, “us”) operates naasnews.com and the NaasNews apps for iOS and Android. For readers in the European Economic Area and the United Kingdom we act as the data controller for the information described here. Contact us about anything on this page at admin.naasnews@gmail.com.
What we collect
When you read the website
-
A session cookie (
_naas_web_key). It holds a security token, your chosen language, the edition you are viewing, and a random identifier we callanon_id. See the Cookie Policy for the detail. - Server logs. Our hosting provider records the usual request data — IP address, time, page requested, browser user-agent — to run and secure the service.
When you use the mobile apps
- Stored only on your device: the stories you save to Favourites and your chosen reading language. This never leaves your phone, is not sent to us, and is deleted when you delete the app. You can erase it at any time from Account → Privacy → Clear local data.
- No advertising identifier is read, and the apps do not use the App Tracking Transparency permission because they do not track you.
If you create an account
Accounts are optional and passwordless. If you sign in we store your email address so we can send the sign-in link or code and remember your saved stories and followed sections. For each device you are signed in on we keep a session record (the device's name and platform, how you signed in, when it was last seen), which you can see and sign out under Security.
If you choose to, you can also sign in with a passkey, a phone's Face ID, fingerprint, pattern or PIN, your face through a camera, or a fingerprint or hand reader. For a passkey or a phone we store only a public key — the private key never leaves your device, and a pattern or PIN is kept only as a salted one-way hash. For camera face sign-in we keep an encrypted face template (never a photo); this is biometric data, which we process only with your explicit consent when you enrol, use only to check that it is you signing in, and delete the moment you press Delete template on the Security page.
Why we use it, and our legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Keep the service secure (anti-forgery, abuse prevention) | Security token, server logs | Legitimate interests |
| Remember your language and edition | Language, edition | Legitimate interests / your request |
| Count free articles read, so the metered paywall works | anon_id |
Legitimate interests |
| Show advertising chosen by the page's topic, and count how often an advert was shown in total | None. Adverts are picked from the section and country of the page you
are on; the counter is a single total per advert and is not linked to
you or to anon_id. |
Legitimate interests |
| Send a sign-in link and keep your saved stories | Email address | Performance of a contract |
Who else receives data
- Hosting. The site runs on Fly.io. Our database is operated by us on the same infrastructure.
- Picture and media hosts. Article images and audio/video are loaded directly from the publisher or archive that hosts them — for example the BBC, The Guardian, Wikimedia and the Internet Archive. Because your browser or app fetches those files, those hosts see your IP address. We do not control their logging.
- Translation. When you read in a language other than the source, the article text is sent to our Langaat translation service for translating. We send the article text only — not your identity.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Advertising on NaasNews is contextual — chosen from the topic of the page, never from a profile of you — and it is measured only as a total count per advert.
How long we keep it
- Session cookie: until it expires or you clear it (see the Cookie Policy).
- Server logs: a short operational retention window, then deleted.
- Account email: until you ask us to delete the account.
- Sign-in sessions: 60 days, or until you sign that device out.
- Face template, passkeys and phone keys: until you remove them on the Security page or delete the account.
- On-device app data: until you clear it or delete the app.
Your rights in the EEA and the United Kingdom
Under the GDPR and UK GDPR you have the right to:
- ask what we hold about you and get a copy (access);
- have inaccurate data corrected (rectification);
- have data deleted (erasure);
- ask us to limit how we use it (restriction);
- receive it in a portable format (portability);
- object to processing we base on legitimate interests; and
- withdraw consent at any time, without affecting what we did before.
Email admin.naasnews@gmail.com and we will respond within one month. You may also complain to your national data protection authority.
International transfers. Our servers are in the European Union (Amsterdam). Where a provider processes data outside the EEA/UK we rely on the European Commission's Standard Contractual Clauses.
Your rights in North America
California (CCPA/CPRA)
In the past twelve months we collected these categories: identifiers
(a random anon_id, IP address, and an email address if you create
an account) and internet activity (pages requested). We collect them for
the purposes in the table above.
We do not sell personal information, and we do not share it for cross-context behavioural advertising — including for readers we know to be under 16. You have the right to know, delete, and correct your information, to opt out of sale or sharing (there is nothing to opt out of, because we do neither), to limit use of sensitive information (we do not collect any), and not to be discriminated against for exercising these rights. Exercise them at admin.naasnews@gmail.com; we will verify your request by replying to the address on file.
Other US states, and Canada
Readers in Virginia, Colorado, Connecticut, Utah, Texas and other states with comprehensive privacy laws have equivalent rights of access, correction, deletion, portability and opt-out, and may appeal a refused request by replying to our decision. In Canada we handle personal information in line with PIPEDA, including your right to access and correct it.
Children
NaasNews is a general news service and is not directed to children under 13. We do not knowingly collect their personal information; write to us and we will delete it.
Changes
If we change this policy we will update the date above, and for material changes we will say so on the site and in the apps.