Data Policy & Service Terms

DATA POLICY

How GooseNews handles data

1. Controller and scope

The operator is responsible for how account data is used. Published operator details are listed below; missing details are identified explicitly.

Legal name

Not yet published

Postal address

Not yet published

Privacy contact

Not yet published

Operator information is incomplete. GooseNews remains an invite-only beta; this notice is not a complete operator disclosure. You can still submit a privacy or data request without signing in.

2. Data map, purpose and lawful basis

3. What remains private and what can become shared

Personal subscriptions, folders, reading state, followed events and storylines, event-version exposure history, preference signals, language choices, city requests and the list of editions on your Learning Library shelf are account-private by default. A personal feed is not placed in the Editorial candidate queue unless you select Suggest to editors. If you do, editors can review the public feed; unnecessary submitter identity should not be shown in the editorial view.

Public RSS feed records, public article metadata, de-identified event clusters and cached AI editions are shared service data and may remain after an account is deleted. They are not intended to contain the former user's account identity.

4. AI provider handling

GooseNews sends text tasks through the OpenAI Responses API with application storage disabled (store=false). OpenAI states that API data is not used to train its models by default unless the customer opts in. Under standard controls, prompts, responses and related metadata may still appear in abuse-monitoring logs for up to 30 days, subject to OpenAI's legal and safety exceptions. GooseNews does not claim Zero Data Retention or EU-only processing unless the operator separately enables and verifies those controls.

The implementation supports a separate OpenAI project for shared public Editorial briefs, which may use an optional data-sharing incentive. This must not be assumed to have the same training settings as the ordinary API project. Personal RSS and on-demand learning use the ordinary project; they are not routed to the shared-brief project. A public source may itself mention identifiable people. The operator must verify project-specific sharing settings, authority to send the source material and applicable contractual safeguards.

Service providers currently supported in the production architecture include Railway for application/database hosting, Brevo for transactional verification and recovery email, and OpenAI for AI text processing. Transactional email is not a subscription to marketing email. Railway DPA, Brevo terms and DPA, OpenAI DPA. Their published terms are not evidence that special residency or retention settings have been enabled for this service.

GooseNews does not currently publish a completed processor-contract and international-transfer inventory. Do not assume that European data residency or special retention controls have been enabled. Contact the operator for information about the safeguards applicable to your data.

5. Retention and deletion

• Login sessions expire after at most 30 days; expired sessions are purged by the worker.
• Expired email-verification and password-reset records are removed after a seven-day operational buffer; rate-limit buckets after roughly two days; completed background jobs after 30 days.
• Account-bound subscriptions, settings, reading state, follows, event-version exposures, Learning Library links, language slots, city requests and allowance records are deleted when the account is permanently deleted.
• Dated optional visit and account measurement records are removed after 90 days by hourly worker cleanup. First reading and first study timestamps remain while account measurement is enabled, so a returning reader is not counted as a new activation when older detailed records expire. Withdrawing account measurement immediately deletes linked measurement records. Account deletion also removes linked measurement data. Anonymous visit records can be removed using Measurement choices while the visit cookie is available; after it expires, those unlinked records cannot be reliably identified from your browser and expire under the 90-day schedule.
• Shared public-source records and de-identified cached outputs may remain while the source is active or the cache remains useful.
• Audit and complaint records are kept only as long as reasonably necessary for security, accountability, notice handling and the establishment, exercise or defence of legal claims. A concrete schedule for these records has not yet been published; you may request retention information using the contact form.

6. Personalization and automated processing

GooseNews uses explicit category settings and small adjustments from brief opens, saves, reading and learning activity to rank Editorial events. Automatic learning can add at most 6 points and 10% of an item’s editorial score. Public-news positions and topic variety remain part of the ranking; an unclicked subject is not automatically hidden. Language-study preferences are kept separate from news interests; private RSS is not classified for Editorial recommendations. It does not make decisions producing legal or similarly significant effects. You can disable personalization or clear learned signals in Account Settings without deleting saved reading or follows. Disabling clears optional learning evidence and stops collecting it; functional reader state remains available. Optional behavior evidence has a 180-day retention period and recommendation-page snapshots expire after 20 minutes; hourly cleanup removes expired records. We do not infer political opinions or other sensitive identities from reading interests.

7. Cookies, device access and optional measurement

A first-party, secure, HTTP-only authentication cookie keeps you signed in. A preference cookie (goosenews_measurement_choice, up to 180 days) remembers your measurement choice. These preferences do not subscribe you to marketing. The reader also uses browser storage for functional reading intent and UI preferences. There are no advertising or cross-site tracking scripts; camera, microphone and geolocation permissions are disabled.

Visitor measurement stays off until you choose Allow measurement. Accepting creates a first-party, secure, HTTP-only random visit cookie (goosenews_measurement, 30 minutes), used to count coarse channels and sample/read/signup milestones. It is not shared across GrassGoose sites and is not a count of unique people. No thanks leaves the reader and sample available. Measurement choices in the public page footer lets you change this choice and remove the current visit record. Accepting terms or continuing to browse does not enable measurement.

Account reading and study measurement has a separate, unchecked choice at registration and in Account Settings. When enabled, an administrator sees aggregate activation and return-visit reports, and the server keeps account-linked dated signals with hashed content targets. A brief open or login is not treated as meaningful reading. No past behavior is imported when you enable it. Turning it off deletes your linked measurement history; it does not change personalization, saved reading, follows or access. Administrative account totals still include your existing account. Beta approvals and plan labels are not recorded as purchases.

8. Your rights

Subject to the GDPR and applicable limits, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may also complain to Luxembourg's CNPD. Account Settings provides direct profile correction, personalization controls and permanent account deletion. For other requests, choose Privacy & data request in the request form. No special prefix or sign-in is needed. We may ask for proportionate identity verification before disclosing or changing account data. Requests are handled without undue delay and normally within one month.

9. Security, children and changes

Current safeguards include Argon2 password hashing, hashed login/reset tokens, secure production cookies, same-origin checks, tenant-scoped database access, restricted RSS fetching and encrypted transport. No internet service can promise absolute security. The beta is for users aged 16 or older and does not knowingly solicit special-category personal data. Material policy changes require a new version and, where legally required, a new notice or choice.

TERMS OF SERVICE

Rules for using the beta

Account and access

You must be at least 16, provide accurate registration information, protect your password and, when invitations are required, use only your own invitation. Public registration, when available, creates a free account with the published daily and monthly allowances. Beta access may be limited or withdrawn for security, abuse, legal or operational reasons.

The service

GooseNews follows public RSS/Atom sources, groups approved Editorial reporting by event, and provides allowance-based language-learning editions. Availability, source coverage, model output and beta features can change. Generation is not unlimited; a cached edition may be reused without another allowance charge.

Your responsibilities

Do not submit credentials, cookies, tokens, private-network addresses, paywall bypasses, unlawful material, malicious feeds or sources you are not entitled to access. Do not probe, overload or circumvent security, quotas or plan restrictions.

AI and news accuracy

AI-prepared titles, briefs, translations and learning editions can contain errors or omit context. They are labelled as AI-assisted, are not professional advice, and do not replace the publisher's report. Keep the original link and verify consequential claims with the original source.

Paid service

No payment-card collection or paid checkout is implemented in this beta. Beta allowances do not constitute an offer of an unlimited or paid subscription. Free members may request temporary feature access for administrator review. Approved access is free until paid plans launch, may be withdrawn, and never starts an automatic paid subscription. Usage and platform budget limits continue to apply. Any future paid offer will require separate published pricing, payment and cancellation information.

Deletion and mandatory rights

You may permanently delete your account in Account Settings. Nothing in these terms excludes non-waivable EU or Luxembourg consumer, data-protection or other statutory rights. These beta terms do not constitute a paid-subscription agreement.

CONTENT & COPYRIGHT

Original sources come first

By default, GooseNews shows the source, title, publication date, original link and a short source or AI-prepared event summary. For approved Editorial processing—and for a Personal RSS learning edition you explicitly request—it may temporarily fetch and store text from a publicly accessible linked page so that clustering and synthesis use the underlying reporting. It does not intentionally cache source images, display stored full source text, bypass access controls or ask the model to reproduce an article. Generated reading dossiers must synthesize and independently paraphrase multiple reports, link to the originals and avoid serving as a substitute for them. Editorial sources require a recorded rights/processing decision; publishers may request correction, catalog opt-out or removal.

RSS availability does not by itself grant every reuse right. Hyperlinks, facts and very short extracts receive different treatment under EU law, while longer excerpts, translations and commercial aggregation can require permission. The operator must continue source-by-source rights review and prompt notice handling.

REQUESTS & COMPLAINTS

Submit a request

Use this form for privacy and data requests, corrections, publisher opt-outs, copyright or illegal-content notices, and other questions. You do not need an account. Do not include passwords, tokens, identity documents or unnecessary sensitive data.