> Markdown version of https://downread.com/privacy.html. Downread is a free RSS reader for people: https://downread.com/ # Downread — Privacy Policy **Last updated: 2026-10-13 · Effective: 2026-10-13** --- ## The short version - Downread is an RSS/Atom reader, on the web and as an **app for Android and iOS**. You can use it **anonymously** — then your subscriptions and reading data stay **on your device** (in your browser or the app), and we create no account and store no reading history on our servers. - If you create an account, we store what's needed to run the reader and sync it across your devices — and nothing more. - **We set one cookie** on the web (to keep you signed in; the apps use the device's secure storage instead) and use local storage only to run the app. We run **no advertising, no analytics, and no third-party tracking** — so there is nothing to consent to, and no cookie banner. - **In the EU/UK**, we **don't load** YouTube, X, Instagram, TikTok and similar embeds until **you allow each service** (you can change this any time); elsewhere they load by default. - If you're in the EU/UK, **your personal data is stored in the EU** and does not go to the US. - We never sell your data. The full detail is below. --- ## 1. Who we are (controller) The controller responsible for your personal data is: **Tim Jansen** c/o Autorenglück #56265 Albert-Einstein-Straße 47 02977 Hoyerswerda Germany Email: **(email address on the web page)** The service is provided at **downread.com** and **feeds.downread.com**, and through the **Downread apps** for Android and iOS. ## 2. What this policy covers This policy explains what personal data Downread processes, why, on what legal basis, how long we keep it, where it is stored, and your rights. It applies to the Downread web app, the **Downread apps for Android and iOS** (see §8 for what is specific to them), the public subscribe page (`/add`), and our transactional emails. ## 3. Anonymous use — your data stays on your device If you use Downread **without an account**, everything you do — your subscribed feeds, read/unread markers, starred and read-later items, folders and preferences — is stored **only on your device** — in your browser's local storage, or in the app's own storage if you use the app. We **do not** create an account, and we **do not** store your reading history on our servers. Because this data lives in your browser, it is **not permanent**: it can be lost if you clear your browser storage, use private/incognito mode, switch to another device, **uninstall the app or clear its data** - and your **browser may also remove it on its own** (for example when it runs low on disk space), which is outside our control. It is not backed up. Anonymous mode also can't store private feeds or newsletter inboxes. To display feeds, your browser or the app does send ordinary requests to our servers (see §9 and §12), which briefly process your IP address and the feed identifiers you're reading. We do not use this to build a profile of you. ## 4. What we collect when you have an account, and why | Data | Why we process it | Legal basis (GDPR) | |---|---|---| | **Email address** — kept on our servers only as a **salted hash** (to recognise your account and block duplicate/banned sign-ups); the address itself is stored **encrypted in your browser**, not retained by us as usable contact data. Used to send account emails (e.g. verification, password reset) at the time you request them. | account creation, sign-in, security | Contract (Art. 6(1)(b)) | | **Password** (stored hashed), or the **Google or Apple account identifier** (if you sign in with Google or Apple). With Sign in with Apple also an **Apple-issued token**, kept only to revoke your Apple sign-in when you delete your account (see §7) | authenticate you | Contract (Art. 6(1)(b)) | | **Your subscriptions, folders, read/unread markers, starred & read-later items, preferences** | run the reader and sync it across your devices | Contract (Art. 6(1)(b)) | | **Private feeds and newsletter inboxes** you add (their content) | deliver the private/newsletter feeds you asked for | Contract (Art. 6(1)(b)) | | **IP address, browser/user-agent, request logs** | deliver the service, keep it secure, prevent abuse | Legitimate interests (Art. 6(1)(f)): security and abuse prevention | | **Reports you submit** (the reported item, reason, your optional email, and the reporter's IP) | handle abuse reports and meet our legal duties (DSA/DMCA/CSAM) | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) | | **Who submitted a public feed** (linked to your account) | prevent abuse and repeat infringement, and meet legal obligations | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) | We do **not** process this data for advertising or profiling, and we do **not** sell it. **How we email you without storing your address.** Because we keep no usable copy of your email, account emails are sent using the address **you enter at that moment**: when you sign in, verify your address, or use "forgot password", you type your email into the form and we use it **only transiently** — held briefly in memory to send that one message, then discarded. We can't email you unprompted (which is also why an inactive account gets no reminder before deletion — see §12). ## 5. Cookies & local storage — and why there's no banner - **One cookie.** On the web we set a single, first-party cookie (`authToken`) whose only purpose is to keep you signed in. **The apps set no cookie for this:** they keep the same sign-in token in the device's secure storage (see §8). It is **strictly necessary** for a service you asked for, so under the ePrivacy Directive / §25 TDDDG it does **not** require consent (we still tell you about it here). - **Local storage.** We use your browser's local storage (in the apps: the app's own storage) only to run the app. For **anonymous users** it holds your reading data and settings (see §3); for **signed-in users** it holds your sign-in state and a cached copy of your profile, while your reading data is stored on our servers and synced across devices (see §4). The "settings" we keep are **functional UI preferences** (e.g. theme, layout) needed to present the reader the way you asked — we store **no telemetry, no usage analytics, and no non-essential data** in local storage. If you switch on **offline reading** (see §8), it also holds the posts and images downloaded for it. Either way it is **strictly necessary** for the functionality you asked for, not tracking. These rules apply to the apps just as to the website. - **No trackers.** We set **no advertising, analytics or third-party tracking cookies** of our own. Because a consent banner is only required for *non-essential* storage, and we have none, **we don't show a cookie banner** — there is nothing to consent to. The one exception is third-party embeds and Google and Apple sign-in, which only ever load on your explicit action — see §6 and §7. ## 6. Third-party content in feeds Feeds and articles are third-party content chosen by you. When you open an article, its **images** load directly from the original publisher, so that publisher's server sees your IP address and your browser sends a request to it. This is inherent to displaying the article you asked to read; those publishers act under **their own** privacy policies, which we don't control. **Embeds (YouTube, Vimeo, JW Player, Simplecast, Captivate, X/Twitter, Instagram, TikTok, Threads, Reddit, Bluesky):** these connect your browser to the third-party service and can set that service's own cookies. If you are in the **EU/UK**, we **do not load any of them until you allow that specific service** — until then you see a placeholder. You allow (and can later disallow) each service under **Settings → External content**; your choice is remembered. Outside the EU/UK, embeds load by default. We force YouTube's privacy-enhanced (`youtube-nocookie`) mode and block any embed outside a fixed allow-list. We are not responsible for the content of third-party feeds or for the data third parties collect when their content is displayed at your request. ## 7. Sign in with Google or Apple (optional) You can sign in with your Google or Apple account instead of a password. Both are entirely optional, and nothing from Google or Apple loads until you choose one: - **Sign in with Google:** your login request goes to Google under **Google's** privacy policy — on the web via Google's sign-in window, in the Android app via Android's built-in account selection (Google Play services). We receive a Google account identifier and your email to create/authenticate your account. We load no Google analytics or tracking. - **Sign in with Apple:** your login request goes to Apple under **Apple's** privacy policy — on the web and in the Android app via Apple's sign-in page, in the iOS app via the system's sign-in sheet. We ask Apple only for your email address, not your name, and receive an Apple account identifier and that email. If you choose Apple's **Hide My Email**, we receive a random Apple relay address instead of your real one, and our account emails reach you through Apple's relay. Apple also gives us a token, which we keep only to **revoke your Apple sign-in when you delete your account**; on deletion we send it back to Apple and delete it with the rest of your account. As with any account, we keep your email address only as a salted hash (see §4). ## 8. The Downread apps (Android and iOS) The apps are the same reader as the website, with its interface built into the app. They talk to the same servers, and everything else in this policy applies to them. What differs: - **Sign-in.** The apps don't use a cookie. Your sign-in token is kept in the device's secure storage (the **iOS Keychain**, or storage encrypted with the **Android Keystore**) and sent to our servers with each request. It is deleted when you sign out. (On iOS the Keychain may keep it after you uninstall the app, so sign out first if you want it removed from the device.) - **Offline reading (optional).** If you're signed in and switch on offline reading in the settings, the app downloads your unread, starred and read-later posts, their images and the feed icons, and stores them **on your device**, so you can read without a connection. To do this the app loads post images in the background, **also for posts you haven't opened yet**, directly from the publishers' servers (see §6), which then see your IP address. **Clear cache** in the settings deletes the downloaded content; signing out or uninstalling the app deletes it too. - **Permissions.** The apps ask only for **internet access**. They don't access your location, contacts, photos, camera, microphone or files, don't use an advertising identifier, and contain **no advertising, analytics or crash-reporting libraries**. They don't track you across other companies' apps or websites. - **Links** to other websites open in your device's browser, under that website's privacy policy. - **App stores.** You download the apps from **Google Play** or Apple's **App Store**. Google and Apple process data about the download and your store account as **independent controllers**, under their own privacy policies; we don't receive it. Depending on your device settings (for example "Share with App Developers" on iOS, or usage and diagnostics on Android), the store may give us **crash reports and aggregated statistics** (such as installs and app versions). They don't identify you to us, and we use them only to fix errors and improve the apps (legitimate interests, Art. 6(1)(f)). - **Deleting your account** works in the app (Account page) as on the website. Uninstalling the app does **not** delete your account. ## 9. Where your data is stored (EU / US) Downread stores each user's data on servers in the **region matching that user's jurisdiction**, determined by your IP address the first time you use the service (for anonymous use) or when you sign up (for accounts). - **If you are in the EU, UK or EEA:** your personal data — credentials, subscriptions, reading data, private feeds and newsletters, and the personal parts of any reports — is stored **in the EU**. Your data is **not transferred to the United States.** You reach public feed content only through our EU servers. - **If you are elsewhere (e.g. the US):** your data is stored on our servers in that region. - **Public feed content** (the feeds themselves, which are not personal to you) is served from a shared, non-personal store; EU users always reach it via our EU servers. - **Credentials** (the salted email hash and password) are held on a single server **in the EU** for all users. Your jurisdiction is fixed when you first use the service (or when you sign up), so if you later **move to another region** your data may remain on your original region's servers. There is no automatic re-assignment; if this matters to you, contact **(email address on the web page)**. ## 10. Who processes data for us (sub-processors) We use a small number of providers who process data **on our behalf** under data-processing agreements: - **Server4You GmbH** (Germany) — server hosting in its **EU** datacenter (EU users' data) and its **US** datacenter (non-EU users' data and the public feed store). - **Hetzner Online GmbH** (Germany) — **EU** hosting, currently for monitoring and operations (and possibly further services in future). - **Cloudflare, Inc.** (USA) — content delivery, proxying, object storage (R2), **email delivery** for our account and transactional emails, and **Turnstile** bot-protection on sign-up and logged-out report submission. Cloudflare is certified under the EU–US Data Privacy Framework and offers EU data-processing terms; Turnstile is privacy-preserving (no advertising cookies, no cross-site tracking). We use **no advertising networks and no analytics providers**, and we do not sell your data. We keep this list current and add any new provider before it starts processing your data. ## 11. International transfers For **EU/UK/EEA** users, personal data stays in the EU, so no international transfer of your data takes place for normal use. Where a provider (e.g. Cloudflare) may process limited data outside the EU, that transfer is covered by the **EU–US Data Privacy Framework** and/or **EU Standard Contractual Clauses**. Separately, where we are **legally required** to report child sexual abuse material, we may transmit the relevant data to the US-based **NCMEC** and to competent authorities (see §13) — this is a legal obligation, not a commercial transfer. ## 12. How long we keep your data (retention) - **Active accounts:** we keep your account data for as long as your account exists. - **Inactive free accounts:** if you do not sign in for **2 years**, your free account and all its data are **automatically deleted**. Because we don't keep a usable copy of your email address, we **can't send a reminder first** — sign in at least once every 2 years to keep your account. - **Private feeds & newsletter inboxes:** we keep their content for **as long as your account exists** — it is deleted when you delete your account (or under the 2-year inactivity rule above). Each plan sets limits on the number of posts and the storage a private feed or inbox may use; when a feed exceeds these, older posts may be removed to stay within the limit. These are **technical/storage limits, not a deletion schedule** — we do not guarantee a given post is deleted by a fixed age. - **Server/security logs:** kept only for a short period for security and abuse prevention. - **Data on your device** (anonymous data, the app's sign-in token and offline-reading content) stays until you clear it, sign out (for the token and offline content) or uninstall the app (on iOS the sign-in token may remain in the Keychain after an uninstall). - **When you delete your account:** we erase your data, **except** the limited records we are legally required to keep (see §13). If you used Sign in with Apple, we also revoke it with Apple (see §7). ## 13. Legal retention, reports and law enforcement Running a service that shows user-submitted feeds carries legal duties. To meet them we may **retain, beyond an ordinary deletion request**, the minimum data needed — pseudonymised wherever possible — for these specific purposes: - **Abuse & repeat-infringer prevention** (DSA / DMCA): a pseudonymous record (a hashed identifier plus strike/ban status) so a banned user cannot simply re-register. Kept as long as needed for this purpose (strike history on a rolling basis; bans indefinitely, in pseudonymised form). - **Evidence that we acted on reports:** a record of a report and the action we took, kept for a limited period. - **Child sexual abuse material (CSAM):** if we obtain knowledge of apparent CSAM, we are legally required to **preserve** the relevant material and data and **report** it to the competent authorities — in Germany the **Bundeskriminalamt (BKA)** and, where applicable, the US **NCMEC** — and we **may not notify** the person concerned. We do not otherwise search your content. - **Legal claims:** data relevant to an actual or reasonably anticipated legal dispute, until it is resolved. The legal bases are **legal obligation** (Art. 6(1)(c)) and **legitimate interests / legal claims** (Art. 6(1)(f), Art. 17(3)(e)). We disclose data to law enforcement or authorities only where legally required or permitted. ## 14. Your rights Under the GDPR (and UK GDPR) you have the right to: **access** your data; **rectify** inaccurate data; **erase** your data ("right to be forgotten"); **restrict** or **object** to processing; **data portability**; and, where processing relies on **consent** (e.g. third-party embeds), to **withdraw** that consent at any time (via Settings → External content) without affecting prior processing. You can exercise most of these directly in the app — edit your account, delete it, and **export your data** (as a standard **OPML** feed list, or a **full JSON download** of everything we hold about you: profile, subscriptions, folders, read state, starred and read-later lists). For anything else, contact **(email address on the web page)**. Note that where we are legally required to retain certain records (see §13), we may not be able to erase those. You also have the right to **lodge a complaint with a data-protection supervisory authority** — in Germany, the authority of your federal state (or ours), or the authority in your country of residence. ## 15. Security On the web we keep your session token in an HttpOnly cookie (inaccessible to page scripts); the apps keep it in the device's secure storage (iOS Keychain / Android Keystore). We hold your login token only in memory, store passwords hashed and your email address only as a **salted hash** on our servers (the address itself stays encrypted in your browser), and sanitise all third-party feed content before displaying it. On **sign-up** and when a **logged-out visitor submits a report**, we use **Cloudflare Turnstile**, a privacy-preserving bot-protection check that runs only on those forms to stop automated abuse; it sets no advertising cookies and does not track you across sites. (Signed-in users do not see Turnstile when reporting.) No system is perfectly secure, but we take appropriate technical and organisational measures (GDPR Art. 32). ## 16. Children Downread is not directed at children and is not intended for use by anyone under **16**. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it. ## 17. Changes to this policy We may update this policy. If we make material changes, we will notify you (e.g. by an **in-app notice**) before they take effect. (As explained in §4, we can't email you unprompted.) The "Last updated" date at the top shows the current version. ## 18. Contact Questions or requests about your data: **(email address on the web page)** Abuse / illegal-content reports: use the **Report** button in the app, or **(email address on the web page)**.