Privacy Policy
This Privacy Policy explains what personal data Suviy collects when you use our news-aggregation mobile app and related services, why we collect it, who we share it with, how long we keep it, and what rights you have over it.
We have written this in plain English. If anything is unclear, write to privacy@suviy.app and we'll explain.
1. Who we are (data controller)
Suviy is operated by an independent developer based in Ukraine, acting as the data controller. For all privacy matters the controller's contact address is privacy@suviy.app. Full identification of the controller (legal name and postal address) is provided on a documented request from a supervisory authority, a court, or a data subject exercising their rights under applicable law.
Suviy is not currently established in the European Union and has not designated an Article 27 representative. EU residents may still exercise all rights below by contacting us at privacy@suviy.app; we respond to GDPR requests within 30 days.
2. What we collect and why
2.1 When you create a registered account
- Email address — to identify your account and send transactional messages (verification codes, password resets, account-deletion confirmations).
- Password (hashed) — to authenticate you. We store only a one-way bcrypt hash; we never see the plaintext.
- Optional profile — display name, avatar URL, if you provide them.
Legal basis: performance of the contract you enter into when you sign up (Art. 6(1)(b) GDPR).
2.2 When you use the app anonymously
- Device-generated identifier (
device_id) — a random UUID created on your device the first time you open the app. Lets the server distinguish your device from others. No personally identifying information.
Legal basis: legitimate interest in providing a working app to anonymous users (Art. 6(1)(f)).
2.3 Content and activity
- Reading history — which articles you opened, time spent, scroll depth, where you arrived from (feed, search, related).
- Favorites, comments, reactions — content you explicitly create or save in the app.
- Source subscriptions and preferences — followed topics, source language overrides, focus country, theme, app language, notification preferences.
- AI usage logs — which AI features (summarize, translate) you used, on which article, when. Used for quota enforcement and abuse prevention.
Legal basis: performance of the contract (Art. 6(1)(b)) and our legitimate interest in personalizing the feed and preventing AI-quota abuse (Art. 6(1)(f)).
2.4 Technical data
- IP address and request metadata — captured by web servers and our error-tracking service, used for security, abuse prevention, and debugging.
- Approximate location (country) derived from your IP address — used at device sign-in to preselect your focus country and personalize the feed. We never collect precise location.
- Authentication tokens — short-lived JWT access tokens and refresh tokens, plus one-time codes (OTP) for email verification and password reset.
Legal basis: legitimate interest in operating a secure, personalized service (Art. 6(1)(f)).
2.5 Push notifications (registered accounts only)
- Push token (FCM registration token) — when you sign in to a registered account, the app obtains a registration token from Google's Firebase Cloud Messaging (FCM) and sends it to us together with your
device_id, so we can deliver push notifications — for example, replies to your comments — to that device. Anonymous users do not receive push notifications and no token is collected for them.
To deliver a notification we pass the token and the notification content to FCM, a service operated by Google LLC. Per Google's own disclosure, the FCM SDK also collects the registration token, the application version, and a Firebase user-agent string in order to provide the delivery service. We do not use Firebase Analytics or Crashlytics, and export of FCM delivery metrics is disabled.
The token is deleted when you sign out on that device, when FCM reports the device as unregistered (for example, after you uninstall the app), and when your account is deleted. You can switch off each notification type in Settings → Notifications inside the app.
Legal basis: performance of the contract (Art. 6(1)(b)) and our legitimate interest in notifying you about activity on your content (Art. 6(1)(f)).
2.6 Advertising (Google AdMob)
The mobile app shows ads served by Google AdMob. The AdMob SDK, provided by Google LLC, collects and shares with Google:
- Advertising ID — the resettable advertising identifier of your device, used to serve, measure, and (with your consent) personalize ads.
- Approximate location derived from your IP address — used to show regionally relevant ads.
- Device, diagnostics, and performance data — including crash logs and diagnostics, used by Google for ad delivery, measurement, and fraud prevention.
Where the law requires it (for example in the EEA, the UK, and Switzerland), the app first asks for your consent through Google's User Messaging Platform (UMP) consent form, and you can change or withdraw that choice at any time in the app. You can also reset or delete your Advertising ID in your device's settings (Settings → Privacy → Ads on Android).
For ad serving, Google acts as an independent data controller under the Google Ads controller-controller terms; how Google uses this data is described in Google's privacy policy.
Legal basis: your consent where required (Art. 6(1)(a)); otherwise our legitimate interest in funding a free app through advertising (Art. 6(1)(f)).
3. Who else processes your data (sub-processors)
We use the following third-party services to run Suviy. Each one is bound by a Data Processing Agreement (DPA) and processes only the data we strictly need to send them.
| Provider | Role | Region | DPA |
|---|---|---|---|
| Hetzner Online GmbH | Hosting (servers + databases) | Germany (EU) | link |
| Resend | Transactional email delivery | US / EU | link |
| Cloudflare, Inc. | DNS, CDN, inbound email routing | Global | link |
| Sentry (Functional Software, Inc.) | Error tracking and performance monitoring | US | link |
| OpenAI, L.L.C. | AI summarization and translation of articles you explicitly request | US / EU | link |
| Google LLC | Push-notification delivery (Firebase Cloud Messaging) and mobile advertising (AdMob) | Global (US) | link |
We have configured Sentry to not auto-attach your email address, request cookies, or authentication headers to error reports. OpenAI is contacted only when you tap "Summarize" or "Translate" inside the app, and only the article content needed for that single request is sent. We do not train AI models with your data.
For push-notification delivery, Google processes data on our behalf under the Firebase Data Processing Terms linked above. For AdMob advertising, Google acts as an independent data controller — see § 2.6.
4. International data transfers
The primary database is hosted in Germany. Some sub-processors above are based in the United States; for those, transfers are protected by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses signed in the DPAs linked above.
5. How long we keep your data
| Category | Retention |
|---|---|
| Account data (email, password, profile) | Until you delete the account, then 14 days grace period, then permanent deletion. |
| Reading history, favorites, reactions, comments, preferences | Until account deletion (same 14-day grace). |
| AI usage logs | Until account deletion. |
| Authentication tokens (JWT, refresh, OTP) | Up to the token's natural expiry; refresh tokens revoked on logout, password change, or deletion request. |
| Push token (FCM registration token) | Until you sign out on that device, until FCM reports the token invalid (e.g. app uninstalled), or until account deletion — whichever comes first. |
| In-app notifications (e.g. a reply to your comment) | Read notifications are deleted after 90 days; unread ones are kept until read or until account deletion. |
| Outgoing email log (audit of transactional emails sent) | Up to 1 year for fraud-prevention; deleted with the account if shorter. |
Anonymous-account data (device_id + activity) |
Automatically deleted after 90 days of inactivity. You can also request deletion manually — see § 7.4. |
| Account deletion audit log (UUID, request method, timestamps; no personal data) | 1 year, for fraud audit. |
| Database backups | Up to 30 days, encrypted. Deleted user data is removed from backups as they roll over. |
| Sentry error reports | Sentry default 90 days, after which Sentry deletes them automatically. |
6. Your rights
If you are in the EU, UK, Ukraine, or another jurisdiction with comparable rights, you can:
- Access the personal data we hold about you.
- Correct any data that is wrong or out of date — most fields you can edit yourself in the app.
- Delete your account and all associated data (see § 7).
- Restrict or object to processing for legitimate-interest purposes.
- Port your data to another service in a machine-readable format.
- Withdraw consent at any time where processing is based on consent (e.g. marketing communications, if we ever introduce them).
- Lodge a complaint with your national data-protection authority. EU users can find theirs at edpb.europa.eu. Ukrainian users can complain to the Ukrainian Parliament Commissioner for Human Rights (Ombudsman).
We never charge for these requests and we respond within 30 days. Where strictly necessary we may extend this by up to 60 days for complex requests and will let you know if so.
7. How to delete your account
7.1 If you can sign in to the app
Open the app, go to Settings → Account → Delete account, re-enter your password, and confirm.
7.2 If you cannot sign in
Use our public deletion form at https://api.suviy.app/account/delete-request. Enter the email address attached to your account; we'll send a confirmation link to that address. Click the link within 60 minutes. This is the same flow Apple and Google require for app stores.
7.3 What happens after a deletion request
Your account is locked immediately (active sessions are invalidated and you cannot sign in). For the next 14 days you can cancel the
deletion using the link in the confirmation email. After 14 days, all data tied to your user is permanently removed:
account row, reading history, favorites, reactions, comments, preferences, source subscriptions, AI usage logs, push tokens, in-app notifications,
refresh tokens, OTP codes, and outgoing-email audit rows. The only thing kept is an anonymous record (uuid, requested_via, timestamps — no personal data) for 1 year for fraud auditing.
You will receive one final email confirming the deletion. After that we will not contact you again at that address.
7.4 Anonymous accounts
Anonymous accounts have no email or password — they are tied only to the random device_id generated on your device. To request deletion of an
anonymous account's data, contact privacy@suviy.app with the device_id shown in
Settings → About. We process anonymous-account requests manually within 30 days. Uninstalling the app or clearing the app's local
data does not delete server-side rows on its own — the manual request is the way to be sure.
8. Security
Passwords are stored as bcrypt hashes. Database connections use TLS. Web traffic is served over HTTPS with HSTS. Authentication tokens are short-lived and can be revoked centrally if we detect compromise. Backups are encrypted at rest.
No system is unbreakable. If we ever discover a personal-data breach that is likely to result in risk to your rights, we will notify the relevant supervisory authority within 72 hours and contact affected users without undue delay.
9. Children
Suviy is not directed to children under 16. By using the service, you confirm you are at least 16 years old. If we learn we have collected personal data from a child under that age, we will delete it. Parents and guardians who believe their child has registered can write to privacy@suviy.app.
10. Where this service is offered
Suviy is offered globally with one exception: the service is not directed to users in the Russian Federation, and we do not actively market the app in that jurisdiction.
11. Changes to this policy
If we change this policy in a way that materially affects you (for example, adding a new sub-processor or changing retention periods), we will update the "Last updated" date above and, where required, notify you in the app or by email at least 30 days before the change takes effect. The latest version is always available at this page.
12. Contact
Privacy and DSAR requests: privacy@suviy.app
Legal and IP / takedown: legal@suviy.app
Anything else: support@suviy.app