Privacy Policy

1. Who is responsible

Artur Misztal operates zkBrief and is the controller of personal data processed for the operation of the apps and website and for handling support requests. In this policy, “we”, “us” and “our” refer to Artur Misztal.

Contact: support@bluesbit.com. Third-party services may also process data for their own purposes under their own privacy policies.

2. Data on your device

The apps store the information needed for the features you use locally: feed and topic settings, reading profiles, article content, read and saved states, reading history, AI scores, downloaded briefs and podcast files. Profiles may contain interests, occupation or workplace information that you choose to enter. On iOS, draft briefs and copies of documents you attach to those drafts are also stored locally; the current app does not submit those drafts or attachments for server-side generation.

We do not send your reading profile or reading history to our own analytics service. The apps do not include our own advertising, analytics or crash-reporting SDK, and do not use an advertising identifier. This does not exclude the platform, scanner and website processing described in this policy.

Private access links and tokens are protected using Android Keystore on Android and Keychain on iOS. A private link grants access to the corresponding material to anyone who possesses it; it is not a personal account or an end-to-end encryption key. Do not share it unintentionally.

Widgets, notifications and media controls may display topic names, article headlines or podcast titles on your home screen, lock screen or connected car display. You control their visibility through the app and system settings. Local notifications do not require a zkBrief push account.

3. Backups, exports and sharing

Android

Android’s system backup and device-transfer features can include source configuration, reading profiles and settings. The app excludes private access tokens, article content, reading history, AI model files and podcast downloads from this backup. Availability depends on the system, device and your backup settings.

iOS and iPadOS

The optional iCloud Backup feature in zkBrief is off by default. When you enable it, the app stores source configuration and private access links or tokens in an encrypted field in your private CloudKit database, hosted by Apple. The configuration includes registered briefs, RSS topics and URLs, OpenAlex search settings, priorities, filters and source-related preferences.

This app feature does not back up article content, podcast audio, reading history, reading profiles, draft briefs, attached documents or the AI model. Local content files are excluded from the system backup; other system-managed app preferences can depend on your device’s backup settings.

You need the same Apple Account to restore the CloudKit copy. Turning this feature off stops future updates but does not delete the existing cloud copy. Manage or delete stored app data through your iCloud storage settings. See Apple’s iCloud storage guidance and Apple’s Privacy Policy.

Files and sharing

Exporting configuration or OPML saves a file with the file provider you choose. Sharing an article sends the selected content to the app or recipient you select. On iOS, adding an article to Safari Reading List passes its link, title and description to Safari; Apple’s settings determine any further syncing. These copies are controlled separately from zkBrief’s local storage.

4. AI runs on your device

After you choose to download the Qwen3 model, it ranks news on the device using article titles and the reading-profile text. The apps do not send that ranking input to a cloud AI model. Reading feeds remains available without downloading the model.

Downloading model files connects to Hugging Face and its file-delivery infrastructure, which receive connection information such as your IP address and the requested file. See Hugging Face’s Privacy Policy.

Ranking personalizes the order of news. It does not make decisions that have legal effects or similarly significant effects on you.

5. Connections to content providers and scanning

• RSS and linked websites. Your device connects directly to the feeds you choose, including during enabled background refresh. Their operators receive the requested URL, IP address and technical connection information. Opening an article in a browser is also subject to that website’s privacy practices.
• OpenAlex. Searches send your chosen keywords, date range and search parameters to OpenAlex, which also receives your IP address. The apps do not send your reading profile or reading history. See OpenAlex’s Privacy Policy.
• Briefs and podcasts. Published materials are delivered through media.misztal.link using Cloudflare R2 Object Storage. The bucket uses the European Union jurisdiction for object storage. The URL may contain a private access token. Cloudflare receives the requested address, IP address and request time. Audio URLs in a feed may point to other hosting providers, which receive requests when the app reads audio metadata, streams or downloads a recording.
• QR scanning on Android. Google Code Scanner processes the camera image on the device. Google documents diagnostic and usage collection for its SDK, including device and app information, device or installation identifiers, performance metrics and feature events. Auto-zoom may also report scan-session identifiers and zoom information. See Google’s ML Kit data disclosure and Google’s Privacy Policy.
• QR scanning on iOS. The app uses Apple’s on-device scanner with your camera permission. zkBrief does not save or upload camera frames or photographs. You can enter a link manually instead. Scanned access information requires your confirmation before registration.

Network connections use HTTPS. This protects data in transit but does not conceal a request from the service receiving it. A local-only reading profile does not make feed downloads anonymous.

6. Feedback and bug reports

Sending feedback is optional. After you select Send, the app sends the report type, the text you entered, the platform label (Android or iOS) and the same technical marker, “anonymized”, for every report. There is no contact-details field. The app does not attach a user or device identifier, your private access token, reading profile or reading history to the report body.

The marker does not anonymize the text. The app sends the description as entered and does not automatically remove personal information. Please do not include personal data about yourself or others, passwords or private links.

Reports pass through n8n Cloud and are stored as issues in a private GitHub repository for investigating problems and improving the apps. We do not publish them as public issues. Saving successful and failed workflow execution data is disabled in n8n. n8n still processes each report while forwarding it; GitHub stores the resulting issue.

The infrastructure receiving the request also receives technical connection data, including an IP address and request time. These are separate from the fields in the report body. Disabling workflow history does not disable all infrastructure processing.

Reports do not provide an individual reply channel. If you need a response, email support@bluesbit.com.

7. Email support

The support mailbox uses Google Workspace. When you email us, we process your email address, sender information, message, attachments and technical correspondence information to handle the request and respond. Google provides the email service under its applicable terms, including the Cloud Data Processing Addendum.

8. The zkbrief.com website

The website is hosted on Cloudflare Workers. Cloudflare receives technical request information, including the IP address, requested URL and time, to deliver and protect the website. Workers Logs and Workers Traces are disabled for the website’s Worker.

We use Cloudflare Web Analytics with the setting “Enable, excluding visitor data in the EU”. Cloudflare omits the measurement script for requests covered by that regional exclusion. Its application depends on the Cloudflare data centre handling the request, rather than the visitor’s citizenship or residence.

For other traffic, measurements help us understand website use and performance. They include page views, paths, referring sites, country, device and browser type, and loading times. Cloudflare states that this analytics service does not use cookies, browser storage or fingerprinting to track visitors, and discards the IP address received for the measurement at its edge. This statement concerns Web Analytics, not all Cloudflare infrastructure processing.

Further information: regional exclusions and measurements, Web Analytics and Cloudflare’s Privacy Policy.

9. Purposes and legal bases

Where the GDPR applies to personal data we process, our legitimate interests under Article 6(1)(f) are operating and securing zkBrief, delivering requested content, resolving feedback and support requests, and understanding website performance. We consider these interests against your rights and reasonable expectations. You may object to processing based on legitimate interests.

Optional iCloud source backup is enabled only with your choice in the app; where this involves processing personal data based on consent, Article 6(1)(a) applies. You can turn the feature off without affecting the lawfulness of prior processing. Deleting an existing copy is a separate action. We may also process data where necessary to meet a legal obligation under Article 6(1)(c).

You are not required to send feedback, email us or enable optional backups to read feeds. A feature may need the information necessary to perform it, such as a feed URL, search keywords or a private access link. Camera and notification permissions can be managed in device settings.

We do not sell personal data or use it for targeted advertising.

10. Retention and deletion

• Feedback. We remove or anonymize personal data within 7 days after the issue is closed. This covers copies and edit history under our control, including contact details submitted through earlier app versions. An anonymous technical description of the problem and fix may remain. You can request deletion earlier.
• Support email. Each message is permanently deleted from the support mailbox after 7 days, whether or not the matter is resolved. A copy saved in a GitHub issue follows the feedback rule above. Google’s remaining system copies follow its deletion terms; section 6.1 of its Cloud Data Processing Addendum allows up to 180 days after an irrecoverable customer deletion instruction, subject to legal obligations.
• Local app data. Content stays on your device until removed through the available controls, configured retention rules or deletion of the app’s local data. Article retention does not necessarily erase saved links or the separate iOS brief-edition archive. Removing an access source may hide its history rather than delete every archived entry.
• Access and backups. Remove saved access in the app before uninstalling if you want to remove its Keychain entry on iOS. Clearing Android app data or deleting the iOS app removes its local app files, but does not delete separately stored cloud backups, exported files, Safari Reading List entries or sent reports. Offloading an iOS app keeps its data. Manage those separate copies with the relevant provider.
• Published files. Brief and podcast files in Cloudflare R2 are replaced according to the period covered by each brief. Replacement does not remove copies already downloaded to your device.
• Infrastructure and website measurements. R2 Data Access Logs are unavailable for our EU-jurisdiction bucket, and website Workers Logs and Traces are disabled. These settings do not eliminate other security and infrastructure data. On our Cloudflare Free plans, Security Analytics and Security Events provide up to 31 days of history. Web Analytics provides full-resolution measurements for 7 days, then sampled or aggregated statistics, with statistics available for the last 6 months. These are service-specific windows, not a promise that all provider copies are deleted at the same time. Other technical records are retained under providers’ applicable security, operational and legal retention rules.

References: Cloudflare security analytics and Web Analytics retention and availability.

11. Recipients and international transfers

The services involved depend on the features you use: Cloudflare for the website and hosted materials; n8n and GitHub for feedback; Google Workspace for support email; Apple for optional iCloud backup and system features; Google for Android system services and the QR scanner; Hugging Face for model downloads; and OpenAlex and your chosen feed or website operators for content.

Providers may process data outside the European Economic Area, including in the United States. The R2 EU jurisdiction applies to stored objects, not all connection data or all services. n8n describes its Cloud hosting as located in the EU; this does not mean every supplier operation is restricted to the EU.

Where required, applicable transfer safeguards include European Commission adequacy decisions, the EU–US Data Privacy Framework for covered transfers, or Standard Contractual Clauses. Their application depends on the provider, service and transfer. Further information is available in Cloudflare’s data-processing terms, n8n’s data-processing terms, GitHub’s transfer information, Google Workspace’s terms and Apple’s Privacy Policy. Contact us for information about safeguards relevant to your data and how to obtain a copy.

We may disclose data if required by an applicable legal obligation or binding lawful request.

12. Your rights and choices

Where applicable, you may request access to your personal data, correction, deletion or restriction of processing; object to processing based on legitimate interests; withdraw consent; and receive portable data where the legal conditions for portability are met.

Email support@bluesbit.com. For a report, include enough information to locate it, such as the approximate date and subject. You do not need to create an account. We may need proportionate information to verify a request, but do not ask you to send a private access token. If we cannot identify a report as yours, we will explain the limitation.

Data stored only on your device is not accessible to us remotely; use the app or system controls to manage it. You can also complain to a data-protection authority, including the President of the Personal Data Protection Office in Poland (UODO), or the authority in your country of habitual residence, work or the alleged infringement.

13. Changes to this policy

We update this policy when the apps, website or data practices change and revise the date above. Where a change requires additional notice or consent, we provide it in the relevant context.