Privacy Policy
Who we are
Qbeat (“we,” “us”) operates the news aggregation service at qbeat.ai. This policy explains what personal information we collect, why, and what control you have over it.
Contact: [email protected]
Operated by: Adam Rosenblum, Santa Monica, CA, USA
What we collect
Account information. When you register, we collect your email address, a display name, and a password. Passwords are never stored in readable form — we store only a one-way cryptographic hash, and we cannot recover or view your password.
Content you create. Topics you create, including their descriptions, source lists, and configuration; topics you subscribe to; and feedback you give on stories.
Technical information. IP address, browser user agent, and request timestamps, recorded in server logs and used for rate limiting and abuse prevention. Because our site is served through Cloudflare, Cloudflare also processes this information — see “Service providers” below.
Email delivery information. Whether messages we send you were delivered, bounced, or were reported as spam. We use this to stop sending to addresses that don’t work.
Analytics information. We use Google Analytics to understand how the site is used. It collects pages viewed, time on page, referring site, device and browser type, and an approximate location derived from your IP address. Google Analytics assigns your browser a random identifier stored in a cookie so it can recognize return visits. This identifier is not linked to your account. See “Cookies and your choices” below for how to opt out.
What we do not collect
- No advertising. We do not run ads, we do not embed advertising pixels, and no advertiser can pay to influence what appears on qbeat.ai.
- No sale or sharing of personal information. We do not sell your data, share it for cross-context behavioral advertising, or trade it with data brokers. Our Google Analytics configuration has Google Signals and advertising features disabled, so analytics data is not used to build advertising audiences.
- No payment information. The service is free and we do not process payments.
- No precise location data. Analytics location is derived from IP address and is approximate only.
How we use your information
- To create and secure your account, and to sign you in
- To send email you request: address verification, password resets, topic notices, and confirmed topic editions
- To display topics you own and subscribe to
- To review topics you submit for public listing
- To prevent abuse, enforce rate limits, and investigate security incidents
- To understand aggregate service usage and operating cost
- To measure how the site is used, in aggregate, so we can improve it
We do not use your personal information to train machine learning models.
Legal bases (for users in the EEA, UK, and Switzerland)
We process your information under these bases: contract (operating your account and delivering the service you requested), legitimate interests (security, abuse prevention, and service improvement), consent (analytics cookies, which we set only after you agree), and legal obligation where applicable. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Service providers
We use the following processors. Each receives only what it needs to do its job.
| Provider | Purpose | Personal information it receives |
|---|---|---|
| Cloudflare | DNS, CDN, DDoS protection, bot detection | IP address, user agent, request metadata |
| Google (Analytics) | Site usage measurement | IP address (truncated by Google before storage), device and browser type, pages viewed, referring site, a random browser identifier |
| Amazon Web Services | Server hosting and requested email delivery (SES) | Email address, message content, delivery status |
| Neon | Database hosting | All stored account and content data |
| Upstash | Caching and rate limiting | IP address, session identifiers (short-lived) |
| Inngest | Background job orchestration | Job metadata; may include topic and user identifiers |
| OpenAI | Language model processing | Topic descriptions and configuration text you write; article content we collect from publishers |
| Exa | Web search and page retrieval | No personal information — Exa receives URLs and search queries derived from topic configuration |
About OpenAI specifically: when you write a topic description or scope rules, that text is sent to OpenAI’s API so the system can evaluate articles against it. OpenAI’s API terms state that data submitted through the API is not used to train their models. We do not send your email address, password, or account identifiers.
We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a transfer of the service to a new operator (in which case we will notify you first).
Cookies and your choices
We use two kinds of cookies:
Strictly necessary cookies. These keep you signed in and protect against cross-site request forgery. They cannot be disabled without breaking sign-in. Cloudflare also sets cookies in this category for security and bot detection.
Analytics cookies. Google Analytics sets cookies (_ga and related) containing a random identifier so it can distinguish return visits from new ones. These are not strictly necessary, and we set them only after you consent. If you decline, or ignore the banner, they are not set.
You can change your choice at any time from the “Cookie settings” link in our footer. You can also opt out of Google Analytics across all sites using Google’s browser opt-out add-on, or by enabling your browser’s “Do Not Track” or tracking-prevention setting, which many browsers now block these cookies by default regardless of your choice here.
We set no advertising cookies of any kind.
Retention
| Data | Kept for |
|---|---|
| Account information | Until you delete your account |
| Topics and subscription preferences | Until you delete or unsubscribe from them, or 30 days after account deletion |
| Session records | Until expiry or sign-out, maximum 30 days |
| Server and security logs | 90 days |
| Rate limit records | 24 hours |
| Google Analytics data | 14 months from your last visit, per our configured retention setting |
| Email delivery, confirmation, and suppression records | Retained while your account is active, to honor settings and avoid sending to unconfirmed, unsubscribed, or bouncing addresses |
Articles and other material we collect from publishers are retained as part of our news index and are not personal information about you. When you delete a topic or your account, that index is unaffected.
Your rights
Whatever jurisdiction you’re in, you can:
- Access the personal information we hold about you
- Correct inaccurate information
- Delete your account and associated data
- Export your data in a portable format
- Object to or restrict certain processing
To exercise any of these, email [email protected]. We will respond within 30 days. We will not discriminate against you for making a request.
If you are in California: you have these rights under the CCPA/CPRA, including the right to know what we collect and the right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. You may designate an authorized agent to make a request on your behalf.
If you are in the EEA or UK: you also have the right to lodge a complaint with your local data protection authority.
Account deletion
Deleting your account removes your email address, display name, password hash, sessions, subscriptions, and topics. Some records are retained briefly afterward: email suppression entries (so we don’t mail an address that bounced), security logs within their normal retention window, and backups until they rotate out.
Security
- Passwords are hashed with a modern key-derivation function and are never stored or logged in readable form
- All traffic is encrypted in transit with TLS
- Sessions are invalidated on password change and on sign-out
- Administrative access to private topics is logged
- Rate limiting and bot detection protect authentication endpoints
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.
International transfers
We operate from the United States, and your information is processed there. If you access the service from outside the US, you are transferring your information to the US, which may have different data protection laws than your country. Where required, we rely on appropriate safeguards including Standard Contractual Clauses with our processors. Google, which provides our analytics, is certified under the EU-US Data Privacy Framework.
Children
This service is not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.
Content from publishers
Qbeat indexes and links to articles published on the open web. We display headlines, brief excerpts, and links back to the original source. We do not republish full articles. If you are a publisher and want your site excluded from our index, email [email protected] and we will honor the request.
Changes to this policy
We may update this policy. If changes are material, we will notify registered users by email and update the date at the top. Continued use after a change means you accept the updated policy.
Contact
Questions, requests, or complaints: [email protected]