Privacy Policy

We use US-based Clerk, Inc. for registration, sign-in and session management. Clerk hosts its infrastructure in the US; authentication data is transferred outside the European Economic Area to the US and processed there. Hosting our application in Frankfurt does not prevent this transfer.

Depending on the sign-in method, data may include your name, email, profile details, account and session identifiers, IP address and device/browser information. Our legal bases are GDPR Art. 6(1)(b) for account services and Art. 6(1)(f) for our legitimate interest in preventing abuse and securing accounts.

According to Clerk’s published documents, eligible US transfers rely on the EU-US Data Privacy Framework (DPF). Its DPA includes Standard Contractual Clauses (SCCs) applicable where it cannot rely on the DPF. See the documents below; contact us for information about transfer safeguards.

This notice is not a consent request. Declining analytics cookies does not stop Clerk processing necessary for account services. Registration requires the necessary account information; you can read public news without creating an account.

When you create an account: your name and email address (via our authentication provider, Clerk).

Your preferences: favorite news categories, email language, your preferred daily delivery time and time zone.

Your account status: technical status information tied to your account.

To send you your personalized daily digest by email.

To let you sign in and save your preferences.

Legal basis: performance of the contract needed to provide the service (GDPR Art. 6(1)(b)).

Clerk: US-based Clerk, Inc., for registration, sign-in and session management. Authentication data is processed in the US. See the dedicated Clerk section.

Neon: our database, hosted in the EU (Frankfurt, Germany).

Vercel: our application servers, hosted in the EU (Frankfurt, Germany).

Resend: email delivery. This provider stores data in the US; transfers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs).

Google: Google Analytics, only with consent. Data is processed in the US. Google relies on the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses (SCCs) for international transfers. Details: https://business.safety.google/adsdatatransfers/ and https://policies.google.com/technologies/partner-sites

OpenAI: processes only news article content (for summarization/translation); your name, email, or preferences are never sent to OpenAI.

We never sell your data to third parties for advertising purposes.

We keep your data for as long as your account is active. If you'd like your account deleted, contact us at the address below and we'll delete your data within a reasonable timeframe.

You have the right to access, correct, or request deletion of your data, to object to processing, and to receive your data in a portable format.

To exercise these rights, contact: emre@punkto.fyi

You also have the right to lodge a complaint with your local data protection authority.

Clerk uses essential authentication cookies to keep you signed in. Google Analytics 4 loads only after you accept the cookie notice; declining sends no data to Google Analytics. With consent, we measure visits and completed registrations. Google processes device/browser information, page views and cookie identifiers. We do not send names, email addresses or account IDs to Analytics. Advertising features are disabled. The legal basis is your consent (GDPR Art. 6(1)(a)). Your choice is stored in this browser’s localStorage; analytics cookies last at most one year. You can withdraw consent at any time via Cookie settings in the footer, without affecting the lawfulness of earlier processing.

This policy may be updated from time to time. We'll update the date on this page when we make meaningful changes.