Privacy notice
What Arvamus keeps about you, why and for how long, who helps us run it, and what you can do about it. Arvamus keeps as little as it can: no advertising, no tracking cookies, no analytics companies.
The publisher's details are being finalised.
Who is responsible
Arvamus is published by the company named in the publisher's details below. That company is the controller of your personal data: it decides why and how the data is used, and it answers for it.
Write to the contact address below about anything in this notice: a question, a request to see, correct or delete your data, or a complaint. We answer within one month.
The publisher's details are being finalised.
What we keep
Without signing in: a random device id that the app creates on your device (it is not taken from your hardware), your time zone and language, and the choices you make: desks, edition times, language, story length, Day or Night.
What you do in Arvamus: the editions printed for you, your calls (Yes or No, how sure you are, and when), the stories you pin, what you read (which texts you opened, how long you read and the last paragraph you reached), the e-paper codes printed for you and the scores worked out from your calls.
When you sign in: your email address, a display name if you give one, and your passkeys (only their public part: the private key never leaves your device).
When you turn on notifications: the push address your browser gives us for this device, and a record of each notification sent to you.
To keep the service safe: the browser name and version your device reports, and a one-way code made from your network address, kept with your sign-in sessions and sign-in links instead of the address itself. Request limits count network addresses in memory only. Our servers' logs record network addresses for at most 14 days.
We never ask for your phone number, location or payment details, and we do not buy data about you or combine it with data from anyone else.
Why, and on what legal basis
To print your editions, take and score your calls, keep your back page, keep your account the same on every device and print the e-paper: this is the service you asked for (contract, Article 6(1)(b) of the General Data Protection Regulation).
To choose the stories in your edition: the desks you follow, what resolves soon and what you linger on decide the order, by fixed rules, and every story says under its kicker why it is there. No decision about you has legal or similarly significant effects (contract, Article 6(1)(b)).
To send the notifications you turned on, by push or by email: your consent (Article 6(1)(a)). Turn them off in Settings or with the link in every email; that does not affect what was sent before.
To keep Arvamus safe and working: limits on requests, stopping abuse, finding and fixing errors. This is our legitimate interest in a secure, working service (Article 6(1)(f)).
To tell the newsroom how stories do: the desk sees only rounded totals for groups of at least 20 readers, never a single reader (legitimate interest, Article 6(1)(f)).
To know whether the paper is read and cited: visits to the public story pages are counted per day and page, by kind of visitor (a person, a search engine, an AI assistant or crawler) and, for people, by where they came from (a link's utm_source or the referring site). The count holds no address, no reader id, no cookie and no browser details, so it cannot be traced to you (legitimate interest, Article 6(1)(f)).
To meet legal obligations, such as answering a lawful request from an authority (Article 6(1)(c)).
What others can see
Your calls are private. Other readers and share pages see only the crowd as a whole, and only once at least 30 readers have called a story. Your back page, your calls and what you read are yours alone.
A share card shows your call only when you share it yourself.
The newsroom never sees who called what. Nothing that identifies you is sent to the services that hold the questions and the source documents, or to any AI model.
Who helps us run Arvamus
These companies process data for us under contract and only on our instructions:
Hetzner Online GmbH (Germany): the servers in Finland that run the Arvamus API, its database and stored files, and the backups kept on the server.
A separate backup server keeps encrypted copies of the database and files for 3 days; only the publisher holds the key that opens them.
Seeweb S.r.l. (Italy): the GPU server that runs the language model which writes and checks the texts. It receives no reader data.
Vercel Inc. (United States): serves the Arvamus web app. Like any web host it sees the network address and browser of each request; it stores no reader data.
Email: our email service sends sign-in links and the notification emails you turn on.
The push service of your browser's maker (Google, Apple or Mozilla) carries the notifications you turn on to your device; they are encrypted on the way.
OpenAI (United States): only if the newsroom turns on hosted models, which are off by default, and never with reader data, only with research material.
Sentry (Functional Software, Inc.), in its EU data region: error reports from the app and the API when error reporting is switched on (it is off in this app). Email addresses and network addresses are removed before a report is sent.
Vercel, the push services and OpenAI, if it is ever switched on, are in the United States or may process data there. Those transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. Everything else stays in the European Union.
How long we keep it
What you read: 90 days, then deleted.
A reader who never signed in and has not opened Arvamus for 60 days is deleted, and their data is erased within 30 days after that.
When you delete your account, your email address, name, devices, sessions and passkeys go at once, and everything else linked to you is erased within 30 days. Your calls stay only as anonymous counts in the crowd and in other readers' scores.
Sign-in links and codes work once, for 15 minutes, and are deleted a week after they expire; a passkey sign-in request is deleted as soon as it expires.
Sign-in sessions last 30 days from your last visit and are deleted a week after they expire.
Push addresses are deleted when you turn notifications off on the device, or when your browser withdraws them.
When you sign in on a device, what you did there without signing in joins your account; the anonymous reader it came from is deleted like any unused one, 60 days after it was last used.
E-paper files are deleted 30 days after they were printed (you can print them again), and the codes printed on them 30 days after their calls close.
Everything else (your choices, editions, calls, pins, scores and the notifications sent to you) stays while you keep your account.
Server logs are kept for 14 days. Backups are kept for 14 days on the server and 3 days off-site, so erased data leaves the backups within 14 days.
What Arvamus stores on your device
The app keeps your device id and settings in the browser's local storage, and your editions and any calls waiting for the network in the browser's database (IndexedDB), so the paper works offline. The service worker keeps the app itself, the pages you opened and film posters in the browser's cache.
One cookie, thedesk_refresh, keeps you signed in. The Arvamus API sets it; scripts cannot read it; it lasts 30 days and is renewed as you use Arvamus. It is strictly necessary for the service, so it needs no consent.
There are no advertising or analytics cookies, no third-party trackers, and no third-party fonts or scripts.
Signing out or deleting your account clears what the app stored on the device. You can also clear it in your browser's settings.
Your rights
You can ask to see your data, to correct it, to delete it, to limit how we use it, and to take it with you. You can object to what we do on the basis of legitimate interest, and you can withdraw your consent to notifications at any time.
Two of these are built in: in Settings, Export my data downloads everything linked to you as a JSON file, and Delete my account deletes it.
You can also complain to the data protection authority of the country where the publisher is established, or to the data protection authority where you live.
Minimum age
Arvamus is for readers aged 16 and over. If you are younger, please do not use it. If we learn that a reader is under 16, we delete their data.
People in our stories
The research behind the stories is journalism. Personal data in them, such as what a public figure said, is processed for journalistic purposes under the exemptions of Article 85 of the General Data Protection Regulation and national law. If a story mentions you and you think it is wrong, write to us: errors are corrected in the open on the corrections page.
Changes to this notice
When this notice changes, the date at the top changes too. Before a change that matters takes effect, we tell you in the app.