---
title: "Privacy Policy — freefeed"
url: "https://freefeed.app/en/privacy"
lang: "en"
description: "What is collected and how it is handled."
updated: "2026-09-22"
---

# Privacy Policy

What is collected and how it is handled.

Last updated 2026-09-22 · This content applies from 2026-09-16

## Categories of personal information collected

The following is collected. Nothing beyond this is collected.

- Identifiers: the account identifier received from your social login provider (Google, X, Discord or GitHub)
- Email address and password (only if you sign up with an email address): the email address you sign in with, and a hash computed from your password. The password itself is not stored, and it cannot be recovered from the hash
- Usage information: the feeds you subscribe to, read/star/tag state, UI settings, and when you started using the service (the time you first subscribed and first opened an article)
- Feedback and bug reports: the text you send and your browser information at that time (used to reproduce bugs). Anything sent from the public form is not linked to an account, even if you are signed in
- Network information: information passed from your browser directly to advertising and analytics providers for ad delivery and traffic measurement (IP address, browser information, cookies and similar identifiers)
- Records of a connection with an AI app (only if you allow one): the name the AI app gives itself, the host name of its provider’s site (when it can be verified), the host name you are returned to after allowing it, the scope you allowed (read-only, or including changes), when you allowed it, the last day it was used, your user ID, and the version of your sign-in state at the time you allowed it (used to invalidate the connection when, for example, you sign out on all devices). Credentials (tokens) used for the connection are stored only in a form that cannot be reversed (a hash)
- Public subscription list settings (only if you choose to publish one): the folder you published, the nickname (optional), whether you chose to be listed on search engines, when it was published, and the public URL
- Server activity logs: to investigate problems and prevent abuse, for every request to this site we record the requested URL (including query strings such as search terms), the time, the result of the response, and information accompanying the request (which may include the connecting IP address). These logs are kept on Cloudflare for 7 days and then deleted.

## Retention period

Records of a connection with an AI app are deleted when you revoke the connection yourself, or when every connection is revoked at once — by signing out on all devices, changing or resetting your password, or deleting your account. The record of the last day used is deleted automatically 31 days after that day.

Public subscription list settings are deleted when you unpublish the list, or when the folder or the account that was published is deleted. However, the public URL keeps showing "No longer published," so that URL and the date publication ended are kept. Information that could identify you (such as your user ID) is not kept.

Server activity logs are deleted after 7 days, as described above. Deleting your account does not remove logs recorded before that; they remain until those 7 days are up.

## Purposes of use

Collected information is used only for the following.

- Providing reader functionality (fetching, displaying and tracking read state for your feeds)
- Sending account emails to people who sign up with an email address: confirming the address and resetting the password (no newsletters or advertising emails). Cloudflare’s email service is used to send them
- Tuning fetch frequency, so that feeds people actually read are fetched first
- Ad delivery
- Traffic measurement (understanding how the service is used, and improving it)
- Accepting operations, within the scope you allow, from AI apps you have connected, and managing that permission (including revoking and invalidating it)
- Publishing subscription lists you choose to make public
- Investigating problems and keeping the service running (including reviewing server activity logs)
- Preventing abuse (including limiting how many times AI apps or programs can call this service)

## Categories of third-party disclosure

Personal information is not sold. When ads are shown in the reader after you sign in, information is passed from your browser directly to the ad provider being shown at that time (Adsterra or Google AdSense): IP address, browser information, cookies. Public pages — including this privacy policy page — show no ads, so this transfer does not happen there.

Google Analytics and Cloudflare Web Analytics are used for traffic measurement. Google Analytics uses cookies to measure visits. Cloudflare Web Analytics uses neither cookies nor persistent identifiers. How Google handles this information is described at https://policies.google.com/technologies/partner-sites.

In addition, page views on public pages are aggregated on this site’s own servers (page path, referring domain name, country, device type and display language). How often each step toward signing up happens (pressing the button to get started, seeing the sign-in screen, starting and returning from social login) is counted the same way. Nothing is stored in your browser, and IP addresses, browser identifiers and URL query strings are not retained. It is not used to identify individuals and is not passed to any external analytics provider.

Access from search engines and AI service programs is also aggregated on this site’s own servers. What is recorded: the program’s name and category (search engine, AI search, a fetch requested by a user, AI training, or ad review), how it was verified (a signature, a published list of IP addresses, self-identification only, or no verification), the path accessed, the format of the response (page, Markdown, JSON, etc.) and its result (accepted, declined by region, etc.), and the connecting country. IP addresses, the raw string identifying the browser, and URL query strings are not stored. Access from human browsers is not included in this count.

Businesses that provide AI apps may be located outside Japan. The connection consent screen shows, in addition to the app’s name and its provider’s site, the destination country. If the destination country cannot be identified, the screen states that fact and the reason why. Information on other countries’ personal-data-protection systems can be checked through information published by Japan’s Personal Information Protection Commission (Legal Systems in Other Countries and Regions, https://www.ppc.go.jp/enforcement/infoprovision/laws/ , in Japanese). How the business receiving the information handles it — including the measures that business takes to protect personal information — is described in that business’s own privacy policy.

In the reader, if your browser has an AI feature (WebMCP) and you have not turned it off in settings, that feature can request the same range of information described above, within what you allowed, and it is passed to the AI feature inside your browser. Actions that cannot be undone are confirmed in the reader screen each time. Where that AI feature sends the information depends on how your browser and the provider of that feature handle it.

## External transmission (Article 27-12, Telecommunications Business Act)

This site sends information from your browser to the following providers. The information sent, the recipient, and the purpose of use at the recipient are as follows. It does not all happen on every page: some is sent only in the reader after you sign in, and some only when you take a specific action. Those conditions are noted on each item. Public pages — including this privacy policy page — show no ads.

- Adsterra (ad delivery; only when Adsterra ads are shown in the reader after you sign in): IP address, browser and device information, the URL of the page being viewed, the referring URL, interactions on the page (such as scrolling and clicks), and identifiers such as cookies. Used for ad delivery, usage statistics and reporting, fraud prevention, and improving its services
- Google (ad delivery; only when Google AdSense ads are shown in the reader after you sign in): IP address, browser and device information, the URL of the page being viewed, the referring URL, and identifiers such as cookies. Used for ad delivery, measuring ad performance, and preventing invalid clicks
- Google (traffic measurement, Google Analytics): the URL and title of the page being viewed, the referring URL, browser and device information, approximate region estimated from the IP address, interactions on the page (such as scrolling and clicks on outbound links), and identifiers stored in cookies. Used for this site’s traffic measurement (understanding how the service is used, and improving it)
- Cloudflare (traffic measurement): the URL of the page being viewed, the referring URL, browser and device information, approximate region, and performance metrics. Used for traffic measurement. Neither cookies nor persistent identifiers are used
- Google (video playback, YouTube; only when you press play on a video in the reader): IP address, browser and device information, the video being played, the domain of the site embedding it, interactions during playback, and identifiers such as cookies and local storage. Used for delivering the video, measuring playback, preventing fraud, and improving its services. How Google handles this information is described at https://policies.google.com/privacy
- Cloudflare (preventing fraudulent sign-ups and sign-ins, Turnstile; only when the email address form is shown on the sign-in screen): IP address, browser and device information, and information about interactions on the page. Used to tell bots apart from people when signing up and signing in. How Cloudflare handles this information is described at https://www.cloudflare.com/privacypolicy/

## Communications our servers make to outside services

To operate the service, our servers make the following communications. None of them pass through your browser, and none of them send information that could identify you.

- IndexNow (api.indexnow.org, forwarded to participating search engines): the URL of a page on this site that was newly published, updated, or deleted, this site’s host name, and a verification key and its location. Purpose: notifying search engines of updates
- The WebSub hub (pubsubhubbub.appspot.com, run by Google): the URL of the updates feed (/updates.atom). Purpose: notifying subscribers to that feed of updates
- Fetching AI agents’ public keys (Web Bot Auth; currently only from https://chatgpt.com): a request to a fixed location for a list of public keys, sending only the request URL and ordinary HTTP headers. Purpose: verifying the identity of AI agents that connect with a signature
- Fetching an AI app’s registration information (Client ID Metadata Document): when an AI app applies for a connection, we fetch registration information such as its name and where it returns to, from the URL it gives as its own identifier. Purpose: showing the app’s information on the consent screen, and confirming where it returns to
- Investigating a website’s feeds: through the sign-in-free MCP, we fetch one page of a website specified by the caller and look for feeds listed there. Purpose: providing the feed-discovery feature

## Public subscription lists

A folder’s subscription list is published only if you choose to publish it. It is not published by default.

Once published, anyone can see, at a hard-to-guess URL, the folder name, the nickname, the names and feed URLs of the sites in the folder, and how often each site updates. The same list can also be downloaded as an OPML file. Sites for which this site does not show a public page are not included. The nickname is optional; leave it blank and it will not be shown. Even if it is not listed on search engines, anyone who knows the URL can view it.

The combination of sites you subscribe to, or a folder’s name, can reveal interests such as hobbies, work, or beliefs. Please check the folder name and the list’s contents before publishing.

Being listed on search engines is a choice separate from publishing, and applies only once the list shows five or more sites. Even if you choose to be listed, search engines may not list it.

If you unpublish a list, or the folder or account that was published is deleted, the page on this site changes to "No longer published" and the list’s contents can no longer be seen. Publishing again produces a URL different from before. However, copies already fetched by search engines, AI services, or people who viewed it cannot be deleted from this site.

## Your rights (to know, to delete, to opt out)

All of these can be exercised by you directly from the settings screen. No request or identity verification correspondence is required.

- Right to know: download a complete data export (OPML + JSON) from the settings screen. This includes your public subscription list settings. For AI apps you have connected, you can check the app’s name, its provider, the scope you allowed, the date you allowed it, and the last day it was used, in "Connected AI apps" in settings
- Right to delete: delete your account completely and immediately from the settings screen. Subscriptions, read state, stars, tags, settings, login links, connections with AI apps, and public subscription lists are all deleted, and both sessions and permissions granted to AI apps are invalidated at once. A public subscription list’s URL changes to show "No longer published," and identifying information is also removed from the public subscription list index
- Revoking a connection with an AI app: revoke permission app by app from "Connected AI apps" in settings. Signing out on all devices, or changing or resetting your password, also revokes every connection. Once revoked, that AI app can no longer access your data. To have information already sent to an AI app deleted, ask the business that provides it
- Unpublishing: you can unpublish a public subscription list at any time from the settings screen
- Right to opt out: toggle "Turn off personalised ads" in the settings screen. Available regardless of where you are. This setting applies to Google AdSense ads; Adsterra ads have no mechanism to receive it. Measurement by Google Analytics can be stopped with the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout)

## Global Privacy Control (GPC)

If your browser sends a GPC signal (the Sec-GPC header or navigator.globalPrivacyControl), Google AdSense ads switch to non-personalised automatically without you changing any setting. Restricted Data Processing is enabled on the Google side as well. This does not apply to Adsterra ads or to Google Analytics.

## Non-discrimination

Exercising any of the rights above will not result in reduced functionality, degraded quality, or a charge. There is no paid tier here in any case.

## Availability

This service is not directed at people in the EU, the EEA, the United Kingdom, or Switzerland. Browsers in those regions cannot connect, and accounts cannot be created or signed into from there.

That said, for search engine and AI service programs, we accept the following even when they come from an IP address in those regions, limited to the items below. Each is one we can verify — either through a list of IP addresses the operating business publishes, or through a Web Bot Auth signature. This does not include crawlers that collect data for AI training.

- Search engine crawlers
- Crawlers AI search services use to build their index
- Fetches an AI service makes on the spot, in response to a user’s question
- Crawlers that review pages submitted as advertisements
- AI agents we can verify through a Web Bot Auth signature

## Use through AI services

The sign-in-free MCP (/public-mcp) and /ask may be called through an AI service’s own servers. In that case, what reaches this site is a connection from that AI service’s server, and this site cannot tell where the person using it is located.

These entry points do not require signing in, and calls are never linked to an account. Nor is the content of a call (search terms, a website’s URL, the contents of an OPML file) accumulated as service data. The result of investigating a website’s feeds is kept only for up to one hour, keyed to that website’s URL, so the same investigation is not repeated. However, the "Server activity logs" described above do keep the requested URL — including the search terms, if the call used a query string — together with the information accompanying the request, for 7 days.

People in the EU, the EEA, the United Kingdom, or Switzerland are not within the intended use of this service even when using it through an AI service.