Privacy notice

Controller

Data categories

• Account and profile data such as email address, display name, username, and avatar.
• Publishing data such as posts, edits, drafts, moderation state, comments, and reports.
• Reader interaction data such as bookmarks, likes, view events, and discussion activity.
• Technical data such as IP-related request data, timestamps, and security or error logs.

Purposes and legal bases

• Providing login, account, publishing, and moderation functions.
• Operating the service securely, preventing abuse, and documenting moderation actions.
• Displaying public author profiles, posts, comments, and engagement where users choose to publish.
• Complying with legal obligations and handling notices relating to illegal or infringing content.

Recipients and processors

• Google, where users sign in through Google OAuth.
• Vercel, which hosts the application and related runtime infrastructure.
• Neon, which provides the application database.

Retention

Account, publishing, and moderation data are retained for as long as required to operate the service, to preserve public content, to document moderation decisions, or to comply with legal obligations. Technical logs are retained only as long as needed for security, stability, and troubleshooting.

Rights

Data subjects may request information, rectification, deletion, restriction of processing, objection, and data portability where applicable. You may also lodge a complaint with a competent supervisory authority.

Cookies and session technologies

HeadlineLoop uses technically necessary session and security-related technologies to provide login and core service functions, save privacy choices, avoid duplicate view counting, and keep feed attribution during a browsing session.

• Necessary storage is always active because the service cannot operate reliably without it.
• Analytics storage is optional and controls whether client-side analytics components are loaded.
• Google advertising consent is handled separately by AdSense Privacy & messaging or another Google-certified CMP where required.

Advertising readiness

HeadlineLoop may load the Google AdSense account script to allow site review and future monetization setup. Local privacy choices do not replace a certified advertising consent flow. For personalized advertising in regions where Google requires it, advertising consent should be handled through AdSense Privacy & messaging or another Google-certified CMP before ad serving is enabled.