Privacy Policy
What we do not collect
No account and no password. No phone number. No real name. No profile. No address book or contacts. No photos. No GPS or precise location. No social login tokens. No saved payment method. We do not integrate any SDK that collects device advertising identifiers (Android Advertising ID, iOS IDFA). You can read, follow, like and comment without giving us an email address; an email address is collected only if you choose to join the newsletter or write to us. Google AdSense, where enabled, sets its own advertising cookies through the browser — see "Advertising and cookies" below.
What we do collect, and why
A random session identifier (UUID) stored in an HttpOnly cookie named agyata_sid. Purpose: so the server can tell one anonymous browser from another, which is what remembers the stories you liked or followed without an account. A random two-word handle (for example, "quiet-fern") generated per session and shown on your comments; you can reroll it. Your edition choice, stored in a cookie named agyata_edition. Purpose: to show the country edition you picked. If you have not picked one, the edition is suggested from the coarse country that Cloudflare derives from your request; we do not store that country against you. Newsletter and advertiser form data, described below. Aggregate usage events and performance data, described under "Analytics". Standard request logs kept by Cloudflare for operating and securing the site.
News: what you read, follow, and post
You can like, follow and comment on story threads without an account. When you like or follow a story, we store the story against your anonymous session id so the site can show your likes and followed stories back to you and keep per-story counts. When you post a comment, we store the comment text, your random handle, your session id and a timestamp. Comments are checked by an automated moderation model before they appear (see "Third parties"), are publicly visible under the story, and are limited to 5 per 10 minutes per session. We do not build a reading-history profile and we do not personalise the news feed based on what you read — the feed is the same for everyone in an edition. You can unlike or unfollow a story at any time, which removes that association.
Newsletter
The newsletter form at /newsletter collects your email address, the edition and topics you choose, a language, the exact consent text you agreed to, a timestamp, and a salted, daily-rotating hash of your IP address plus a trimmed user-agent string (used only to rate-limit signups and detect abuse). The consent text reads: "Email me the Agyata digest when it launches. I can unsubscribe at any time." No digest is being sent yet; nothing is emailed to the list until the digest launches. To be removed from the list, email privacy@agyata.com.
Advertiser enquiries
If you submit the enquiry form on /advertise, we store what you enter (company, contact name, email, phone, website, campaign details and message) together with a salted, daily-rotating hash of your IP address and a trimmed user-agent string, so we can reply and limit abuse. This data is used to answer your enquiry. It is not shown to readers.
Breaking-news notifications
Browser notifications are off unless you switch them on. If you do, your browser gives us a push subscription (an endpoint address and keys) which we store so we can send you breaking-news alerts. Your browser remembers that you opted in using a local storage entry named agyata_breaking_optin. You can switch notifications off in the site or in your browser settings.
Cookies and local storage
Set by Agyata: agyata_sid (cookie, HttpOnly, up to 30 days, rolling); agyata_edition (cookie, 1 year); agyata_session_started (session storage, cleared when the tab closes); agyata_breaking_optin (local storage, only if you enable notifications); agyata_mk_seen (local storage, remembers that you have seen the markets strip); and a local cache of fallback-image lookups. Set by third parties: Google Funding Choices records your cookie-consent choice; Google Analytics 4 and Google AdSense set cookies only according to that choice (see below); the New Relic Browser agent can set its own cookie (see "Analytics"). You can clear all of these in your browser at any time, and reopen your choices with the "Privacy & cookie settings" link in the site footer.
Analytics
First-party: the site sends usage events (such as page views, story opens, likes, comments, shares, scroll depth, searches and ad impressions or clicks) to our own endpoint. Each event carries the event name, the page or story involved, and two pseudonymous hashes derived from your random session id — one that rotates daily and one that stays stable so we can count unique users. Events also carry the coarse country, region and city that Cloudflare derived from the request. We do not store your IP address, user-agent, or search query text with these events. The events are stored in Cloudflare Analytics Engine. Where configured, the same events are also forwarded server-side to Google Analytics 4 (Measurement Protocol) and to New Relic. Google Analytics 4: the tag runs in the browser with analytics storage denied until you consent through the cookie banner. New Relic Browser: a monitoring agent loads on every page to measure page timing and JavaScript errors; it is configured to use cookies and is not controlled by the cookie banner. Impressions and clicks on sponsored stories are also counted server-side, de-duplicated with a salted, daily-rotating hash of your IP address. Cloudflare may also provide edge analytics for the site.
What we store and for how long
Session identifier: up to 30 days, rolling (extended every time you visit). News stories and updates: retained while live, and archived (hidden from the feed but kept for direct links / search-engine references) after a period of inactivity — never sold, never deleted purely to save space. News likes / follows / comments: kept while your session is active and the story is live; likes and follows are removed when you unlike/unfollow. Newsletter and advertiser enquiry records: kept until you ask us to delete them or they are no longer needed for the purpose they were collected for. Reports: metadata (report ID, reason, reporting session ID, timestamp) plus any text evidence, retained for the time required to complete review, or longer if part of an ongoing safety or legal matter. Ban registry: session identifiers of banned sessions, retained indefinitely — the entire point of a ban is that it persists. Audit log: moderation actions, retained for operational review. Aggregate telemetry in Analytics Engine: 90-day retention (Cloudflare default). Cloudflare Workers operational logs: 7-day retention.
Where your data lives
Cloudflare Workers (compute), Cloudflare D1 (SQL — news stories, updates, likes, follows, comments, newsletter subscribers, advertiser enquiries, reports, audit log), Cloudflare KV (sessions, rate limits, bans, flags), Cloudflare R2 (report evidence — text only), Cloudflare Analytics Engine (usage events). Cloudflare edge locations are globally distributed; your request terminates at the nearest edge.
Your rights under GDPR, DPDP, CCPA, and equivalents
Right of access, erasure, rectification, portability, and objection apply where the relevant regulation applies to you. Most of what we hold is tied to a random session identifier rather than to you, so some requests resolve as "we do not hold this data about you" — but we will confirm in writing. The main data linked to a person is the email address you gave us for the newsletter or an enquiry. If you believe we hold data linkable to you, email privacy@agyata.com with enough context to identify the data (for example, the email address you used, or a story link and a rough post time for a comment) and we will investigate and respond within 30 days.
Third parties
We use Cloudflare for compute, storage, CDN and analytics. We use Cloudflare Workers AI (Meta Llama Guard 3) for text moderation classification of news comments — prompts and outputs are not used to train models per Cloudflare terms. We use Google AdSense to serve ads, Google Funding Choices for the consent banner, and Google Analytics 4 for audience measurement (see "Advertising and cookies" and "Analytics"). We use New Relic for performance monitoring and event analytics. Story pages can embed YouTube videos from youtube-nocookie.com, and the site may fetch fallback images and their credits from Openverse (api.openverse.org) and display images served from the original publishers or image libraries; your browser contacts those hosts directly when it loads them. Sponsored stories are supplied by the advertiser and labelled as sponsored; we do not hand advertisers any of your data — they simply pay to have a story shown to everyone. We do not sell data. We do not share data with advertisers beyond the standard AdSense-served placements.
Advertising and cookies
Where advertising is enabled, Agyata serves ads via Google AdSense and shows clearly-labelled sponsored stories in the news feed. AdSense and its partners may set cookies and similar identifiers on your device to personalise the ads you see, measure ad performance, and prevent repeated delivery of the same ad. These cookies are set by Google, not by Agyata, and are subject to Google's own privacy policy and ad-personalisation controls at https://adssettings.google.com. You can opt out of personalised ads at https://www.google.com/settings/ads. Every page loads with all Google storage types (advertising and analytics) set to denied by default; Google Funding Choices asks for your choice, and the Google tags only apply it. Sponsored stories are not personalised — every reader sees the same sponsored content. Agyata itself sets no advertising cookies and does not share any identifier of yours with advertisers. You can change your cookie and ad-consent choices at any time with the Privacy & cookie settings link in the site footer.
Children
Agyata is a news site for a general audience. It is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has posted personal information in a comment, email safety@agyata.com and we will remove it.
Changes
Material changes to this Privacy Policy will be announced in a site-wide banner for at least seven days before the change takes effect. The effective date and version number at the top of this page reflect the current revision. Historical versions are available on request by emailing privacy@agyata.com.
Contact
Privacy questions and data subject requests: privacy@agyata.com. General: ops@agyata.com.