Privacy Policy

This Privacy Policy explains what personal data Suviy collects when you use our news-aggregation mobile app, our website suviy.com and related services, why we collect it, who we share it with, how long we keep it, and what rights you have over it.

We have written this in plain English. If anything is unclear, write to privacy@suviy.app and we'll explain.

1. Who we are (data controller)

Suviy is operated by an independent developer based in Ukraine, acting as the data controller. For all privacy matters the controller's contact address is privacy@suviy.app. Full identification of the controller (legal name and postal address) is provided on a documented request from a supervisory authority, a court, or a data subject exercising their rights under applicable law.

Suviy is not currently established in the European Union and has not designated an Article 27 representative. EU residents may still exercise all rights below by contacting us at privacy@suviy.app; we respond to GDPR requests within 30 days.

2. What we collect and why

2.1 When you create a registered account

• Email address — to identify your account and send transactional messages (verification codes, password resets, account-deletion confirmations).
• Password (hashed) — to authenticate you. We store only a one-way bcrypt hash; we never see the plaintext.
• Optional profile — display name, avatar URL, if you provide them.

Legal basis: performance of the contract you enter into when you sign up (Art. 6(1)(b) GDPR).

2.2 When you use the app anonymously

• Device-generated identifier (device_id) — a random UUID created on your device the first time you open the app. Lets the server distinguish your device from others. No personally identifying information.

Legal basis: legitimate interest in providing a working app to anonymous users (Art. 6(1)(f)).

2.3 Content and activity

• Reading history — which articles you opened, time spent, scroll depth, where you arrived from (feed, search, related).
• Favorites, comments, reactions — content you explicitly create or save in the app.
• Source subscriptions and preferences — followed topics, source language overrides, focus country, theme, app language, notification preferences.
• AI translations and summaries — when you ask for one, in the app or on the website, the article text is sent to our AI providers (Anthropic, OpenAI; § 3); nothing about you is sent with it. In the app, from version 1.7.0, these features are on by default and can be switched off in Settings → AI features. Every AI translation and summary is labelled as such.
• AI usage logs — which AI features (summarize, translate) you used, on which article, when. Used for quota enforcement and abuse prevention.
• Saved topics (“My topics”) — the short text of each topic you save (up to 60 characters), its place in your list, and its notification settings. We use the text to build your topic feed and, only for topics you turn notifications on for, to check for new matching articles. The matching runs on our own servers; the topic text is not sent to OpenAI or any other third party.
• Dismissed articles — articles you swipe away, so they are not shown to you again. If you dismiss an article without opening it, the categories it was shown under also lose a little weight in your personalized feed.
• Feed display log — which articles we showed you, in what position, and from which part of the feed (for example personalized, trending, or a saved topic). Used to avoid showing you the same articles again, to measure which of them you actually read, and to tune the feed.

Legal basis: performance of the contract (Art. 6(1)(b)), including the AI translations and summaries you ask for, and our legitimate interest in personalizing the feed and preventing AI-quota abuse (Art. 6(1)(f)).

2.4 Technical data

• IP address and request metadata — captured by web servers and our error-tracking service, used for security, abuse prevention, and debugging.
• Approximate location (country) derived from your IP address — used at device sign-in and on the website's welcome page to preselect your focus country, to personalize the feed, and on the website to put news from your region first (§ 2.7). We never collect precise location.
• Authentication tokens — short-lived JWT access tokens and refresh tokens, plus one-time codes (OTP) for email verification and password reset.
• Device record — the model name of your device (for example “Pixel 7”), its platform, and the app version, reported by the app when it signs in and stored with your device_id. Used to recognise your device across sign-ins — for example, to move what you did anonymously onto your account when you sign in — and for troubleshooting.

Legal basis: legitimate interest in operating a secure, personalized service (Art. 6(1)(f)).

2.5 Push notifications

Push notifications work both with a registered account and when you use the app anonymously.

• Push token (FCM registration token) — the app obtains a registration token from Google's Firebase Cloud Messaging (FCM) and sends it to us together with your device_id, so we can deliver push notifications to that device — for example, replies to your comments or new articles on a topic you saved. The app sends the token after its anonymous device sign-in and again after every sign-in to a registered account.
• Device time zone — the time-zone name of your device (for example Europe/Kyiv), sent together with the push token. We use it to hold topic notifications back during night-time quiet hours and to count the daily limit of topic notifications by your local day. It is not used to locate you.
• Notification opens — when you open a notification, the app tells us. We mark the notification as read, and we use opens to avoid over-notifying you: a topic whose last several notifications all went unopened automatically sends fewer (about one a day) until you open one again.

To deliver a notification we pass the token and the notification content to FCM, a service operated by Google LLC. Per Google's own disclosure, the FCM SDK also collects the registration token, the application version, and a Firebase user-agent string in order to provide the delivery service. We do not use Firebase Analytics or Crashlytics, and export of FCM delivery metrics is disabled.

The token and the time zone stored with it are deleted when you sign out of a registered account on that device, when FCM reports the device as unregistered (for example, after you uninstall the app), when your account is deleted, and — for anonymous use — together with the rest of the anonymous-account data after 90 days of inactivity (see § 5). You can switch off each notification type in the app’s notification settings. Topic notifications stay off until you turn them on for a particular topic.

Legal basis: performance of the contract (Art. 6(1)(b)) for the notifications you ask for, and our legitimate interest in notifying you about activity on your content and in not sending you notifications you ignore (Art. 6(1)(f)).

2.6 Advertising (Google AdMob)

The mobile app shows ads served by Google AdMob. The AdMob SDK, provided by Google LLC, collects and shares with Google:

• Advertising ID — the resettable advertising identifier of your device, used to serve, measure, and (with your consent) personalize ads.
• Approximate location derived from your IP address — used to show regionally relevant ads.
• Device, diagnostics, and performance data — including crash logs and diagnostics, used by Google for ad delivery, measurement, and fraud prevention.

Where the law requires it (for example in the EEA, the UK, and Switzerland), the app first asks for your consent through Google's User Messaging Platform (UMP) consent form, and you can change or withdraw that choice at any time in the app. You can also reset or delete your Advertising ID in your device's settings (Settings → Privacy → Ads on Android).

For ad serving, Google acts as an independent data controller under the Google Ads controller-controller terms; how Google uses this data is described in Google's privacy policy.

Legal basis: your consent where required (Art. 6(1)(a)); otherwise our legitimate interest in funding a free app through advertising (Art. 6(1)(f)).

2.7 The website (suviy.com)

The website and the app share one account: what you save, read, follow or set in one appears in the other. § 2.4 applies to everyone who opens the website; when you are signed in, §§ 2.1 and 2.3 apply too, with the additions below. Visitors who only read get no account and no device record (§ 2.2 does not apply), and the website sends no push notifications (§ 2.5).

• News from your region — to put news from your region first on the home page, section pages and the events list, our server derives the country of your IP address from a local database (GeoLite2, § 3); neither the address nor the country is stored for this purpose or shared with anyone for it (server and error logs: § 2.4). If you are signed in and have chosen a focus country we carry news from, that choice is used and this lookup is not made.
• Cookies we set — only the ones the site needs to work: a session cookie and an XSRF-TOKEN security cookie, set on pages with a form (sign-in, registration, password reset, the deletion request) and while you are signed in; a remember-me cookie, set when you sign in, that keeps you signed in on that browser; site_theme (your light or dark choice); and site_locale (the site language you last picked in the language switcher, so that an address without a language opens in it). How long each one lasts is in § 5. We use no analytics or tracking cookies of our own; a visitor who only reads pages without a form gets none of ours unless they switch the theme or the language.
• Browser storage — when you close the “Suviy for Android” banner on a phone, the time you closed it (app_banner_closed) is kept in your browser's local storage so the banner stays away for 30 days. Nothing is stored before you close it, and it never leaves your browser.
• Reading on the website — when you are signed in, we record the articles you open, how long the article was visible and how far you read it, as the app does (§ 2.3), marked as read on the website.
• Sign-in with Google — on the sign-in and registration pages, and on the account-deletion page of an account that signs in only with Google, the page loads Google's sign-in script from accounts.google.com; Google then receives your IP address and browser data. If you use it, Google tells us your name, email address and profile photo, as in the app.
• Profile photos — a photo that came from a Google account is loaded from Google's servers (googleusercontent.com) wherever it appears (next to comments, in notifications, in the header), so Google receives the viewer's IP address and browser data. Photos uploaded to Suviy are served from our own storage (§ 3).
• Fonts are served from our own servers; your browser does not contact Google Fonts or any other font service.

Legal basis: performance of the contract (Art. 6(1)(b)) for sign-in and the account features; strictly necessary storage for the cookies above (Art. 5(3) ePrivacy Directive); our legitimate interest in showing visitors news from their region (Art. 6(1)(f)).

2.8 Advertising on the website (Google AdSense)

Where it is switched on, the website shows ads served by Google AdSense on the home page, event pages, the events list and the article lists of a section or a source — never next to the text of an article, and not on search, account, settings or error pages. The AdSense code on those pages also shows, in the EEA, the UK and Switzerland, Google's certified consent message (IAB Transparency & Consent Framework); personalized ads are shown only with your consent, and you can change your choice at any time with the “Privacy and cookie settings” link at the bottom of a page with ads.

Google sets its own cookies or similar identifiers to serve, measure and (with consent) personalize ads, and acts as an independent data controller under the same controller-controller terms as in § 2.6.

Legal basis: your consent where required (Art. 6(1)(a)); otherwise our legitimate interest in funding a free service through advertising (Art. 6(1)(f)).

2.9 Article images and videos (website and app)

The website and the app show an article with its pictures and videos, and some of them load from servers that are not ours:

• Article images — article images, including those inside the text, are served from our own servers. Some still load directly from the publisher's servers, which then receive your IP address and browser or device data under their own privacy policies: images from publishers whose images we do not copy, animated (GIF) and vector (SVG) images, in-text images beyond a per-article limit, and the images of articles we collected before this version of the policy, including your saved copies of them.
• Embedded videos — where an article contains a YouTube video, we show our own placeholder in its place, and nothing loads from YouTube until you press play. When you do, the video loads from YouTube — on the website in YouTube's player from youtube-nocookie.com — so Google receives your IP address and browser or device data. App versions before 1.7.0 still load the video's preview image from YouTube when an article opens. How Google uses this data is described in Google's privacy policy.

Legal basis: for article images and, in app versions before 1.7.0, a video's preview image, our legitimate interest in showing articles as their publishers illustrated them (Art. 6(1)(f)); for a video, your request when you press play: performance of the contract (Art. 6(1)(b)).

3. Who else processes your data (sub-processors)

We use the following third-party services to run Suviy. Each one that processes data on our behalf is bound by a Data Processing Agreement (DPA) and processes only the data we strictly need to send them; where Google acts as an independent controller, that is said below.

We have configured Sentry to not auto-attach your email address, request cookies, or authentication headers to error reports. A summary or a translation you ask for, in the app or on the website, sends only the article content needed for that request: to the AI provider we have chosen for that feature, and to the other one only if the first one fails. We do not train AI models with your data.

For push-notification delivery, Google processes data on our behalf under the Firebase Data Processing Terms linked above. For advertising (AdMob in the app, AdSense on the website), for Sign-in with Google and for the YouTube videos you play, Google acts as an independent data controller — see §§ 2.6–2.9.

This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com. The database is stored on our server; MaxMind receives no data about you.

4. International data transfers

The primary database is hosted in Germany. Some sub-processors above are based in the United States; for those, transfers are protected by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses signed in the DPAs linked above.

5. How long we keep your data

6. Your rights

If you are in the EU, UK, Ukraine, or another jurisdiction with comparable rights, you can:

• Access the personal data we hold about you.
• Correct any data that is wrong or out of date — most fields you can edit yourself in the app.
• Delete your account and all associated data (see § 7).
• Restrict or object to processing for legitimate-interest purposes.
• Port your data to another service in a machine-readable format.
• Withdraw consent at any time where processing is based on consent (e.g. marketing communications, if we ever introduce them).
• Lodge a complaint with your national data-protection authority. EU users can find theirs at edpb.europa.eu. Ukrainian users can complain to the Ukrainian Parliament Commissioner for Human Rights (Ombudsman).

We never charge for these requests and we respond within 30 days. Where strictly necessary we may extend this by up to 60 days for complex requests and will let you know if so.

7. How to delete your account

7.1 If you can sign in

In the app, go to Profile → Account → Delete account; on the website, open Account → Delete account. Confirm it is you (with your password, or by choosing your Google account again if you signed up with Google), and confirm the deletion.

7.2 If you cannot sign in

Use our public deletion form at https://suviy.com/pl/account/delete-request. Enter the email address attached to your account; we'll send a confirmation link to that address. Click the link within 60 minutes. This is the same flow Apple and Google require for app stores.

7.3 What happens after a deletion request

Your account is locked immediately (active sessions are invalidated and you cannot sign in). For the next 14 days you can cancel the deletion using the link in the confirmation email. After 14 days, all data tied to your user is permanently removed: account row, reading history, favorites, reactions, comments, preferences, source subscriptions, saved topics, dismissed articles, the feed display log, AI usage logs, push tokens and device time zones, in-app notifications, refresh tokens, OTP codes, and outgoing-email audit rows. Two things are kept: an anonymous record (uuid, requested_via, timestamps — no personal data) for 1 year for fraud auditing, and the device record of each device you used (see § 2.4), no longer linked to any account, until 90 days after that device was last seen.

You will receive one final email confirming the deletion. After that we will not contact you again at that address.

7.4 Anonymous accounts

Anonymous accounts have no email or password — they are tied only to the random device_id generated on your device. To request deletion of an anonymous account's data, contact privacy@suviy.app with the device_id shown in Profile → About. We process anonymous-account requests manually within 30 days. Uninstalling the app or clearing the app's local data does not delete server-side rows on its own — the manual request is the way to be sure.

8. Security

Passwords are stored as bcrypt hashes. Database connections use TLS. Web traffic is served over HTTPS with HSTS. Authentication tokens are short-lived and can be revoked centrally if we detect compromise. Backups are encrypted at rest.

No system is unbreakable. If we ever discover a personal-data breach that is likely to result in risk to your rights, we will notify the relevant supervisory authority within 72 hours and contact affected users without undue delay.

9. Children

Suviy is not directed to children under 16. By using the service, you confirm you are at least 16 years old. If we learn we have collected personal data from a child under that age, we will delete it. Parents and guardians who believe their child has registered can write to privacy@suviy.app.

10. Where this service is offered

Suviy is offered globally with one exception: the service is not directed to users in the Russian Federation, and we do not actively market the app in that jurisdiction.

11. Changes to this policy

If we change this policy in a way that materially affects you (for example, adding a new sub-processor or changing retention periods), we will update the "Last updated" date above and, where required, notify you in the app or by email at least 30 days before the change takes effect. The latest version is always available at this page.

12. Contact

Privacy and DSAR requests: privacy@suviy.app
Legal and IP / takedown: legal@suviy.app
Anything else: support@suviy.app