Privacy Policy

The short version

We keep the little we need to run a reader for you, and nothing that would be worth selling.

• No advertising, no ad networks, and no third-party analytics or tracking.
• We don't sell your data, and we don't share what you read with anyone.
• Publishers never learn who read them. Your browser doesn't contact them; ours does.

What we hold

All of it exists because the reader wouldn't work without it.

• Your account: email address, username, display name, and a hash of your password — never the password itself.
• Your library: the sources you subscribed to and the categories you filed them under.
• Your reading: which entries you've read. We keep no counts and build no profile from it.
• Technical logs: the ordinary web server record of requests, including IP address and browser, kept briefly so we can find faults and abuse.

What we don't do

• We don't load fonts, icons, or scripts from a third-party CDN. Everything is served from our own servers, so nobody else learns your address or which page you were on.
• We don't ask a favicon service for a source's picture, because the list of sources is the reading list itself.
• Images in an entry are fetched by us and served through our own origin, and a video embed loads nothing until you press play.
• A link you follow out of SteepPage carries no referrer, so the publisher doesn't learn which of our pages you left from.

Cookies

Two, for the two things cookies are actually for.

• A session cookie, so you stay signed in.
• A preference cookie, remembering whether you collapsed the sidebar.
• There are no advertising or tracking cookies, ours or anyone else's.

The few third parties involved

Running a service means somebody hosts it and somebody delivers its mail. These are the only outside parties that see anything.

• Our hosting and database providers, who store the data above on our behalf. Their servers may sit outside Canada, and data held there is subject to the laws of wherever it is.
• Our email provider, which delivers confirmation and password-reset messages.
• Google reCAPTCHA, on the sign-in, sign-up, and password-reset forms only, to keep robots out. Google's own privacy policy and terms apply to that check, and no other page loads it.

How feeds are fetched

Sources are polled from our servers on a schedule, whether or not anyone is reading. A publisher's logs show our server asking, never you — and how often we ask follows how often they publish, not who is reading them.

How long we keep it

Your account and library stay for as long as your account does. Server logs are kept briefly and then discarded.

Closing your account removes it, your subscriptions, your categories, and your read state. Backups age out on their own schedule, measured in weeks.

Your rights over your data

We operate from Saskatchewan, so Canada's federal privacy law — PIPEDA — governs how we handle your personal information, and the Office of the Privacy Commissioner of Canada is who to complain to if you think we've mishandled it. Depending on where you live you may have rights beyond it.

We'll honour all of the following wherever you live, because it's simpler and it's right. To use any of them, write to [email protected].

• Ask what we hold about you, and get a copy of it.
• Correct anything that's wrong.
• Have your account and its data deleted.
• Object to what we do with it, or ask us to restrict it.

Security

Traffic is encrypted in transit, passwords are stored hashed, and an account locks itself after repeated failed sign-ins. No service can promise perfect security and we won't pretend otherwise: if there's a breach that affects you, we'll tell you.

Children

SteepPage isn't for children under 13, and we don't knowingly hold data about one. If you believe a child has an account here, write to us and we'll remove it.

Changes to this policy

We may update this policy. The date at the top says when it last changed, and we'll email account holders before anything significant takes effect.

Getting in touch

Questions about this policy, or a request about your own data, go to [email protected].