How Safe & Informed handles your information — and how little we collect.
English · Română
This Privacy Policy explains how Safe & Informed (operated by SAFE AND INFORMED S.R.L., "we", "us", "our") handles your information when you use the Safe & Informed mobile application (the "App") and our website at https://www.safeandinformed.com (the "Website"). Safe & Informed is an audio-first news reader. You add your own RSS sources and the App reads or plays the articles you choose, hands-free, including in the car. The App does not host or select news; you control your own sources.
We have designed the App to collect as little as possible. It works without user accounts, most of your information stays on your device, and only a limited amount of data reaches our servers. This Policy describes exactly what we process, why, and your rights.
The controller responsible for your personal data is SAFE AND INFORMED S.R.L., with its registered office at Aleea Slt. Adrian Cârstea 13, Bl. 37, Sc. 2, Et. 8, Ap. 141, Sector 3, Bucharest 031838, Romania. Company registration number (CUI) 55462821. You can contact us at [email protected], by telephone at +40 746 447 444, or by post at the address above.
The sections marked "Website" cover the website safeandinformed.com and its pages, including the community feed directory at /feeds and /directory and the ConsentVeil Monitor pages. They do not cover the ConsentVeil browser extension, which has its own policy, or the ConsentVeil Monitor service once ordered, which has its own policy. The Monitor Privacy Policy applies when enquiring about, arranging or using Monitor; the extension’s policy applies from the moment you install it. The Safe & Informed mobile App is covered by the sections marked "App".
The App has no user accounts. There is no registration, no login, no password and no user database. Your feeds, your reading and listening history, your preferences and the recommendation engine run and are stored locally, on your device. This information does not reach our servers. If you enable device synchronisation, it takes place inside your own iCloud account (on Apple devices) or your own Google Drive (on Android), to which we, as the developer, have no access.
The sources you add, the articles you read or listen to, your history, your searches and your preferences remain on your device and are not transmitted to us.
Our servers run on Cloudflare’s global edge network; our company is established in Romania (European Union). We are a single company with no group affiliates. Depending on how you use the App, the following limited information may be processed on our side:
| Activity | Data | Purpose and legal basis | Kept for |
|---|---|---|---|
| Serving the pages and the directory API | your IP address, request headers (browser, language, referrer), the page or API route requested, timestamps; processed by Cloudflare as our content delivery network and security layer | delivering the site and protecting it against abuse; Article 6(1)(f) GDPR, our legitimate interest in running a working, secure website | see section 11 and the Cloudflare paragraph in section 5 |
| Network error reporting | browsers may send Cloudflare automatic reports about failed connections (NEL / Report-To headers), containing the URL and the error, no page content | diagnosing delivery problems; Article 6(1)(f) | handled by Cloudflare under its terms |
| Suggesting or reporting a feed | the fields listed in section 5; we do not ask for submitter identity, and please do not include personal details | running a community directory; Article 6(1)(f) | see section 5 |
| E-mail you send us | your address, name if you give it, and the content of the message | answering you, and handling orders, support, removal requests and complaints; Article 6(1)(b) where you are ordering, otherwise Article 6(1)(f) | while needed to answer, to handle any dispute and to prove an order, then deleted (section 11) |
| Ordering a Monitor audit | covered by the Monitor Privacy Policy | ||
| Paying for a Monitor audit | by bank transfer against our invoice; the transfer details on our bank statement are kept as accounting records (see "Payment information" below and section 11) |
We do not combine any of this into profiles, we do not sell or share it for advertising, and we do not use it for automated decisions.
Subscriptions and purchases are processed by Apple and Google through their in-app purchase systems. Payment and card details are handled by them; the App never sees your card data.
Website (Monitor). The prices on the Monitor page are for business customers (website owners, publishers, agencies and consultants acting in a professional capacity). Consumer orders are not currently concluded. "Request the audit" opens an e-mail to us; the order is agreed by e-mail and the audit itself is governed by the Monitor Terms and the Monitor Privacy Policy.
Safe and Informed S.R.L. is the seller. At launch, payment is by bank transfer against our invoice only; no payment page or payment provider is used. We receive the order, the amount, the invoicing details you gave us and the transfer details shown on our bank statement. Order correspondence is kept while needed to answer, handle disputes and prove the order, then deleted; invoices, credit notes and bank statements are kept as accounting records for the statutory periods (section 11). Where we later offer a card payment link, the provider, its role, the destinations of the payment data, the payment mechanism and how to obtain its safeguards are identified before payment, on the payment page and on the invoice; card details would be entered on the provider’s page and never reach our systems. Where a merchant of record is later used, it is identified before purchase. No provider receives scan data.
The App currently does not collect any usage statistics. This function is switched off, and nothing is collected or transmitted from any user. If we enable an opt-in statistics function in the future, we will update this Policy beforehand and will not start any collection without your prior consent, without an age check for the applicable minimum age, and without describing the purpose clearly. Any such statistics would be compiled on your device as totals per category, without identifiers, and any aggregated reports would be published only above a minimum group size so that no figure could be attributed to an individual.
The Website is a static site. On the Website there are no accounts, no client-side audience-tracking analytics, no advertising and no tracking pixels, and we set no cookies of our own; infrastructure and security statistics are processed as described below. The App has its own sections of this policy. The only things the Website writes to your browser are two functional preferences in local storage, described below. The site and the directory API are delivered through Cloudflare, which sees the technical details of every request in order to serve the pages and protect them. If you suggest or report a feed, we process what you submit (see "Community submissions" below). If you e-mail us, we process what you send. If you pay for a Monitor audit, you pay by bank transfer against our invoice (section 3, "Payment information").
Our own storage. The Website sets no cookies of its own. It stores functional preferences in your browser’s local storage, which is not sent to us:
legalLang is written only when you choose a language with the English / Romanian language switch on a legal page. It holds the language code you chose (en or ro) and nothing else. On your next visit to a legal page it is read locally so that you land on the version you chose. It has no expiry: it stays until you choose the other language (which overwrites it) or clear site data for safeandinformed.com in your browser settings. Until you make a choice nothing is written; on an English legal page the script only checks, in your browser, whether your browser’s language list starts with Romanian in order to show a banner offering the Romanian version, and stores nothing.sai_add_pref is written only on the "Add a feed" page (/add) and only if you tick "remember" when choosing how to open a shared feed (in the App or on the Website). It holds that choice and nothing else, is read locally on your next visit to that page, has no expiry, and is removed when you use the reset link on that page or clear site data.Cloudflare. The Website and the directory API are served through Cloudflare. At the date of this policy Cloudflare sets no cookie on this site: bot management is switched off and no challenge service (Turnstile) is used, and plain page loads of the home page, the directory, the Monitor pages and the directory API return no cookie at all. If we ever enable a Cloudflare protection that sets a strictly necessary cookie, it would contain a technical token rather than your name or contact details, be used by Cloudflare only to tell automated traffic from human visitors and to keep a security check valid, and be listed here first.
Cloudflare also sees your IP address at the network edge and keeps request logs for its own security purposes under its terms. For the Cloudflare configuration we actually use, we can view aggregate traffic analytics and sampled request-level security events in the Cloudflare dashboard, for the retention window of our Cloudflare plan; only named staff have access. We do not export those logs into our own systems unless necessary to investigate a security incident; exported incident records are kept for 12 months and then deleted. The e-mail addresses on the site are rendered by a small Cloudflare script served from this site’s own domain, which contacts no third party.
For these reasons the Website shows no cookie banner: nothing that requires consent runs before you act.
Google "Add to Preferred Sources". The home page offers a control to add Safe & Informed to your Google Preferred Sources. Depending on the version of the page you are viewing it is either a plain link to Google’s own page or a button that loads Google’s script only after you click it. In both cases nothing is loaded from Google, and no Google cookie is set, until you click. Before you activate it, the page explains that clicking connects you to Google and may allow Google to access or store information on your device for Google’s own purposes, under Google’s privacy and cookie policies, and that the rest of the site works without it. Where the button version is shown, Google’s script runs on the page only after that click. This control is the only third-party element on the Website; there is no Google Analytics, tag manager, advertising pixel or similar tracker.
The feed directory at /feeds and /directory lists community-submitted links to publishers’ own public RSS and Atom feeds. It has no accounts, profiles, posts or discussions.
What the suggestion form collects. The "Suggest a source" form sends the following to our directory API at directory.safeandinformed.com (/api/suggest): the publication’s name (required, up to 120 characters), the feed URL (required, up to 500 characters), the categories you recommend (the form asks for recommended countries and subjects), an optional language code and an optional free-text note of up to 500 characters. We do not ask for submitter identity; please do not include personal details. The "name" field is the publication’s name. Notes are reviewed privately and are not published verbatim. Our Community Rules ask you not to include names, e-mail addresses or any personal details.
What the report button collects. "Report feed" sends only the identifier of the listed feed (/api/report), so that our server re-checks it and flags it for us. No text is collected.
Abuse prevention. The API checks that the URL is a working feed (our server fetches it), rejects duplicates and limits the number of submissions per address. For that purpose your IP address, as seen by Cloudflare, is used transiently and is not stored with the submission. Cloudflare’s own security logging applies as described above.
Moderation. A person reviews every suggestion before it is published. We may reject any suggestion and remove any listing at our discretion, as the Community Rules describe, and we generally do not provide individual explanations.
What is published. A listed feed shows the publication’s name, the host name of the feed URL, the language code if one was given, and, where we add one, a short description written or approved by us. The free-text note is for our reviewers and is not published as submitted. The form has no identity fields and we do not ask who you are; a note or a feed URL can nevertheless contain personal data if you put it there. Such a note is read only by our reviewers, is never published as submitted, and is deleted with the suggestion as described in section 11. Nothing identifying the submitter is published.
Legal basis. Article 6(1)(f) GDPR, our legitimate interest in running a community directory of public feeds and keeping it free of abuse. If a note nonetheless contains personal details, we delete them on request (see Removal).
Recipients. Cloudflare, which hosts the pages and the directory API; and our e-mail provider Zoho, where a submission or report generates a notification e-mail to us.
Retention. A submission is kept for as long as the feed is listed. Rejected submissions, including their notes, are deleted within 90 days of rejection. Report records are kept while the listing they concern exists. Rate-limiting data is transient (up to about two hours for the Website form) and Cloudflare’s security logs are kept by Cloudflare under its terms, as described above.
Removal. Because submissions are anonymous, there is no self-service deletion. Publishers, rights holders or anyone who finds personal data in a listing or note can write to [email protected] or use the Support page; we remove promptly.
The App is native and does not rely on the Website’s cookies. When you read an article inside the App, the publication’s own page and its cookies apply, not ours.
Links to other sites. The Website links to app stores, browser extension stores, publishers’ feeds and social networks. Those are run by their operators under their own policies. Following a link takes you off this site; nothing is loaded from those services while you are here, except what you explicitly load through the Google Preferred Sources control described above.
On the Pro plan, the App offers optional AI features: a natural AI voice, article summaries and an assistant ("Ask"). Summaries and the assistant rely on OpenAI and Google; the natural voice is generated by Inworld AI (Theai, Inc., United States). When you use them, only the text of the article or your request, together with the generation settings, is sent through our secured server to the AI provider. No identity, device identifier, IP address or location is attached. Your questions and interests are never sent to Inworld; it receives only text that publications make publicly available in their feeds. Inworld AI keeps that text and the generated audio in its service logs until deleted, and may use such publicly available text to improve its service; it does not receive any data about you. Our server does not log or store the content; the only server-side copy is a shared technical cache keyed to the content itself, kept for 30 days. Content behind a paywall is not sent to any AI. AI features are used only by Pro subscribers; on the free and ad-free tiers the App uses the built-in system voice, which sends nothing over the network.
Wherever a summary or an AI reading appears, the source publication is attributed (for example, "X reports that..."), and all AI-generated output is visibly marked as AI voice and AI-generated. The AI voice and summaries are provided for your personal use, may contain errors and should not be relied on as a complete or authoritative source of information.
The free tier shows advertisements through Google AdMob, Google’s advertising component. These advertisements are contextual - they are chosen by the content shown at that moment, not by a profile of who you are, and we do not enable the advertising identifier to track you across other apps or websites. However, in order to display ads and to prevent ad fraud, the AdMob component collects and shares with Google certain data on the free tier, including your IP address, device identifiers, ad interactions and diagnostic information, even when the ads are contextual. We ask for your consent through an in-app screen before the advertising component accesses your device. The ad-free tier and the Pro plan show no advertisements, and the advertising component is not loaded on those tiers.
We process personal data only where we have a legal basis under the General Data Protection Regulation: performance of a contract, to provide the paid features you request and to manage your subscription; consent, for weather-based location and for the advertising component on the free tier (and, in the future, for any statistics function); legitimate interests, to keep the service secure, to prevent abuse and to verify that requests come from a genuine copy of the App; and legal obligation, where the law requires it.
We do not sell your personal data. We share limited information only with the following recipients, as necessary: the AI providers OpenAI, Google and Inworld AI (as our processors, for the Pro AI features; Inworld AI is established in the United States and the transfer is covered by the EU Standard Contractual Clauses included in its data processing addendum); our infrastructure provider Cloudflare (as our processor); the weather provider OpenWeather (as our processor); and Apple and Google in their capacity as the stores through which the App is distributed and payments processed, where they act as independent controllers under their own privacy notices. Certain auxiliary technical services (for example, a favicon service and podcast-search services) receive only non-identifying technical data such as a domain name or a search term. On the free tier only, Google, through its AdMob advertising component, receives the advertising-related data described in section 7, to display advertisements and to prevent ad fraud. We may also disclose information where required by law.
Website. For the Website: Cloudflare, Inc. (content delivery, security and hosting of the directory API) sees the request data described in sections 3 and 5. Our e-mail provider, Zoho Corporation B.V., stores and delivers e-mail, including directory notifications. Our bank receives Monitor payments by transfer; a payment provider is involved only where a card payment link is later offered, as described in section 3. We share Website data with no one else, except professional advisers where necessary and subject to confidentiality, or public authorities where the law requires it.
Some of our processors are located outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on the European Commission’s Standard Contractual Clauses and on the data-processing terms of each provider. Details are available on request.
Website. Cloudflare is a US company and serves this site from data centres worldwide, including in the EU; its processing of EU visitor data is covered by its data processing addendum, the Standard Contractual Clauses and its certification under the EU-US Data Privacy Framework.
Our e-mail, including directory notifications and your correspondence with us, is stored primarily in the European Union (Zoho, zoho.eu region, Netherlands and Ireland data centres). Authorised Zoho personnel in India may access it to provide technical support, under the Standard Contractual Clauses incorporated into Zoho’s data processing addendum together with Zoho’s transfer impact assessment and supplementary safeguards. Zoho’s sub-processors are listed at https://www.zoho.com/privacy/sub-processors.html; those that would transfer data outside the EEA are disabled by default and we do not enable them. A copy of the relevant safeguards, or a meaningful summary of them, is available on request at [email protected].
No payment provider is in use at launch (section 3). Where a card payment link is later offered, the provider’s transfer safeguards are identified before payment.
Website.
legalLang and sai_add_pref: in your browser only, until you change or clear them.You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. Because the App has no accounts, some of these rights apply only to the limited data we hold on our servers; where we can no longer link data to you, we may be unable to identify it, as permitted by law. To exercise your rights, contact us at [email protected]. If you are in the European Union you may also lodge a complaint with your data protection authority; in Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP). Your rights under the GDPR (access, rectification, erasure, restriction, portability and objection) apply to the Website data described above in the same way as to the App; write to [email protected], and you may complain to the Romanian supervisory authority, ANSPDCP (dataprotection.ro).
The App is intended for users aged 16 and over. We do not knowingly process personal data of children below that age. Before any statistics function is ever enabled, the App will check the user’s age and will not enable collection for users below the applicable age. If you believe a child has provided us with personal data, please contact us. The Website is not directed to children, and we do not knowingly process their data through it.
We use appropriate technical and organisational measures suited to the limited data we process. By design, the App keeps most information on your device and sends very little to our servers, which reduces what could be exposed. We keep service credentials on our servers rather than in the App; our servers accept requests only from a verified, unmodified copy of the App; all traffic is encrypted in transit; and we apply rate limiting and abuse-prevention measures. The App has no user accounts and no password database, and payment details are handled by the stores and never reach us. No method of transmission or storage is completely secure, but we work to protect your information and keep these measures under review.
We may update this Policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you in the App.
SAFE AND INFORMED S.R.L., Aleea Slt. Adrian Cârstea 13, Bl. 37, Sc. 2, Et. 8, Ap. 141, Sector 3, Bucharest 031838, Romania. Email: [email protected]. Telephone: +40 746 447 444.