Privacy Policy
The Grapevine is a private newspaper curated by friends. This policy explains how personal information is handled across our website and iOS and Android apps. Tim Rekelj operates the service and is the controller of personal information processed for its operation. Contact: hello@thegrapevine.si.
1. Information we process
- Account information: your email address, account identifier, display name, and authentication records. When you choose Google, Apple, or X sign-in, the provider supplies an account identifier and the email or profile information authorized for sign-in. Apple may supply a relay email address. We do not receive your provider password, and signing in does not by itself authorize us to read your social feed or post on your behalf.
- Group information and content: group names, membership and roles, invitation codes, submitted links and comments, source metadata and excerpts, messages, replies, reactions, uploaded images and videos, generated stories and their history, and correction reports.
- Preferences and notifications: notification settings, read status, and, on mobile, push subscription identifiers and device information used to deliver notifications.
- Usage and technical information: actions such as signing in, opening stories, or sending messages; timestamps; app and device characteristics; and diagnostic, crash, network, and security information. Infrastructure and other providers may also process IP addresses and request logs.
- Communications: information you send us when asking for support, reporting a problem, or exercising a privacy right.
2. Why we use it
We use this information to authenticate you, provide your group’s newspaper and conversations, organize and summarize sources, deliver requested notifications, respond to support and correction requests, understand feature usage, diagnose errors, prevent abuse, and comply with legal obligations.
Where data-protection law requires a legal basis, core account and service processing is necessary to perform our agreement with you. Security, abuse prevention, support, and service improvement rely on legitimate interests where permitted, balanced against your rights. We rely on legal obligations where applicable and consent for processing that requires it. You can object to processing based on legitimate interests and withdraw consent where consent is the basis.
3. Who can see group content
Group content is intended to be accessible to members of that group, rather than a public feed. Members may save or share it outside the app; we cannot control those copies. Treat invitation links and codes as access credentials. Authorized service administration and service providers may process data when needed to operate, support, or secure the service.
The service is not end-to-end encrypted. Private group access does not mean content is visible only to participants at every stage of processing. Please do not submit highly sensitive information or other people’s information without a lawful basis.
4. Service providers and AI processing
We use the following services for the purposes described below. Data sent to a provider depends on the features you use and whether that integration is enabled.
- Supabase: account authentication, database records, file storage, and backend functions.
- Vercel: website hosting and processing web requests.
- Google, Apple, and X: authentication when you choose that provider. Their own privacy policies also apply to your interaction with their sign-in services.
- Mistral AI: source titles, publisher information, excerpts, generated story text, and relevant correction notes are processed to generate headlines, summaries, categories, and numerical text representations called embeddings.
- OpenAI: source text and existing story titles and summaries may be processed to decide whether items describe the same event or contain conflicting information. These inputs can contain personal information present in the source material. Ordinary group chat messages and uploaded media are not sent to these AI services by the current editorial pipeline.
- PostHog: product events, account identifiers, device and technical properties, feature-flag evaluations, error reports, and AI performance metadata such as token usage and timing. Our current integration disables session replay and automatic interaction capture. We do not intentionally include group message text, uploaded media, or AI prompt and response content in analytics events.
- OneSignal and Apple/Google push services: mobile push delivery, using subscription information, account identifiers, generic notification text, and story links. Current notification payloads do not include the text of group messages.
- GIPHY: GIF search terms when search is enabled, and network information when GIFs are loaded. External image hosts and Google Fonts may also receive network information, such as your IP address, when the website or apps load their resources.
When you submit a link, our backend requests the linked page to extract source information. When your device loads external content or follows a link, the destination provider may receive network information and handle it under its own privacy policy.
We do not sell your personal information or use private group content for targeted advertising. Information may also be disclosed where required by law, to address abuse or protect people’s rights and safety, or in a transfer of the service subject to applicable privacy obligations.
5. Cookies, local storage, and device permissions
The website uses authentication cookies to keep you signed in. Mobile apps store session credentials using platform-protected storage. Our analytics integration can also use browser or device storage to recognize sessions and associate activity with an account. Blocking storage may affect sign-in and other features; a browser’s Do Not Track signal is not currently a built-in opt-out control for the service.
You can control notification permission in your device settings and notification preferences in the app. You choose which photos or videos to upload through the platform’s media picker. Turning off notifications or uninstalling the app does not delete stored account or group data. Contact us to object to analytics processing or discuss your privacy choices.
6. Retention and deletion
Account and group information is retained while needed to provide the service. Shared stories, discussions, and story history are not automatically removed merely because you sign out, uninstall the app, or stop participating. Diagnostic and security records, support correspondence, provider logs, and backups may have different retention periods based on their purpose, provider settings, legal requirements, and security needs. We do not promise a single automatic deletion period for all data.
To request account deletion or removal of personal information, email hello@thegrapevine.si, preferably from the email address associated with your account. We may need to verify your identity. We will assess what must be deleted, anonymized, or retained, including information in shared group records and any legal obligations, and explain applicable limits. Backup copies may remain until they expire through the backup lifecycle; copies independently saved by other members are outside our control.
7. International processing and security
Our providers may process information in countries outside your country of residence, including outside the European Economic Area. Where applicable law requires safeguards for a transfer, appropriate safeguards, such as standard contractual clauses or a recognized adequacy framework, are required. Contact us for information about the safeguards applicable to your data.
We use measures such as authenticated access, group-level database access controls, and protected mobile credential storage to reduce unauthorized access. No online service can guarantee absolute security.
8. Your rights
Depending on applicable law, you may have rights to access or receive a copy of your personal information, correct it, request deletion, restrict or object to processing, and receive portable data. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. You may also complain to your local data-protection supervisory authority.
Send requests to hello@thegrapevine.si. We will respond within the time required by applicable law, generally one month for GDPR requests, and explain any lawful extension or restriction. Editorial AI organization is not intended to make legal or similarly significant decisions about you.
9. Children and policy changes
The service is intended for people aged 16 and over. If you believe a child under 16 has provided personal information, contact us so we can investigate and address it.
We may update this policy as features, providers, or legal requirements change. We will update the date above and provide notice of material changes through the service or email where appropriate. See also our Terms of Service.