Privacy Policy

1. Introduction

DailyReport is an India-focused product operated by the DailyReport team as a child product of Unitlabs (the parent company). In this Policy, “DailyReport,” “we,” “us,” or “our” means DailyReport / Unitlabs as they apply to this product. We provide short-form news reading with explainable trust and conflict signals. This Privacy Policy describes how we collect, use, disclose, and protect information when you use:

• Our website at https://dailyreport.observer (the “Site”);
• Our Android application DailyReport, package observer.dailyreport.app (the “App”); and
• Related services and APIs hosted at https://api.dailyreport.observer (together, the “Services”).

By using the Services, you agree to this Policy. If you do not agree, please do not use the Services. Editorial content is curated by editors. Automated summarization may assist them and does not replace human publication decisions.

2. Data We Collect

You do not need an account to use DailyReport. Each install of the App gets a random ID (a UUID, not tied to your name or phone number) and sends it with its requests so your preferences and saved stories can be kept. This is what we collect and where it goes.

Reader ID and reading settings. Stored on our servers under that random ID: theme, font size, share-card quality, your home region and market, whether you finished the welcome screens, your saved and read story IDs, your likes, dismissals, source and language choices, and any custom RSS feed addresses you add (up to three). The same ID is how we know whether your install has DailyReport Plus.

Sign-in (optional). You can sign in with Google or with a code sent to your email. We store your email address, the sign-in method, and a random account ID. With Google we check Google’s ID token to confirm the email; we do not keep your Google account ID or name on our servers. A display name you type stays on your phone. After you sign in, the account ID replaces the random reader ID, so your settings, saved stories and Plus status follow that account. Sign-in sessions last 7 days.

Push tokens. The App does not register a push token when you install or open it. If you turn on Story alerts in Settings and allow notifications, the App gets a Firebase Cloud Messaging device token and sends it, with the platform (“android”), to our API, and subscribes the device to alert topics for your home market, your region and the daily digest. When you turn Story alerts off, or sign out, the App asks our API to delete the token, leaves those topics and discards the token. On our servers the token is not linked to your reader ID or account. Firebase stops using a token when you uninstall the App, and we delete tokens Firebase reports as no longer valid.

Purchases. Subscriptions go through Google Play and RevenueCat. RevenueCat receives your reader or account ID. Our server asks RevenueCat whether that ID has an active Plus entitlement and stores only a yes or no. We do not receive payment card numbers.

Ads (free tier). Plus subscribers see no ads and the ads library is not started for them. Otherwise, after Google’s consent step (Section 6), Google AdMob may use your advertising ID, approximate location and ad interactions, under Google’s Privacy Policy. The Google ads library adds the Android advertising-ID permission to the App.

Stored on your phone. Region, language, theme, saved stories, a cached copy of your feed state, the reader ID, your sign-in token, any display name and the push token are kept in the App’s local storage. Clearing app data or uninstalling removes them.

Technical data and logs. Our servers receive your IP address and request details whenever the App or Site contacts them. The API writes request logs, and rate limits that stop abuse are keyed on IP address. The App does not include analytics or crash-reporting services.

Videos. Some stories are YouTube clips that play inside the App in YouTube’s embedded player, so YouTube (Google) receives the usual data for playing a video.

Images from publishers. Story and promo images load straight from the host that serves them, usually the publisher’s own network, so that host sees your IP address and device details. We do not control those hosts.

Communications. If you email us, we keep the correspondence to respond to you.

3. How We Use Data

• Provide and operate the Services: feed, saved stories, settings, sign-in and the API.
• Personalize your lanes, region, language and story order from your likes, dismissals and source choices.
• Check Plus and remove ads for subscribers.
• Send story alerts and the daily digest to registered devices.
• Show ads on the free tier after the consent step.
• Secure the Services: rate limiting, abuse prevention, debugging.
• Comply with law and enforce our terms.

Editors may use an AI model (currently Google Gemini) to draft short summaries. It is sent the titles and excerpts of public news articles. It is not sent anything about readers.

4. Legal Bases (EEA / UK and similar frameworks)

Where GDPR or UK GDPR applies, we rely on one or more of:

• Contract — to deliver the App and the account and Plus features you ask for;
• Consent — for ads personalization and the Android notification permission;
• Legitimate interests — security, abuse prevention and keeping the service running, balanced against your rights;
• Legal obligation — where we must retain or disclose information.

You may withdraw consent where processing is consent-based, without affecting prior lawful processing.

5. Sharing of Information

We share information with the providers that help us run DailyReport:

• Google — Sign-In, Play Billing, AdMob and its consent messaging, Firebase Cloud Messaging (push), YouTube (embedded clips), and Google Fonts on the Site and the editors’ desk;
• RevenueCat — subscription status, using your reader or account ID;
• Resend — sends the sign-in code to your email address, so it receives that address;
• Publishers’ image hosts — see Section 2; they receive your IP address when the App loads their images;
• Cloudflare — hosts and serves the Site;
• Hosting — the cloud server and database that run api.dailyreport.observer;
• Google Gemini — summaries of public articles only, as described in Section 3.

We may disclose information if required by law, to protect rights and safety, or in connection with a merger or sale of assets (with notice where required). We do not sell your personal information for money.

6. Cookies, Local Storage & Ads

The Site does not set cookies or run analytics. Its pages load fonts from Google Fonts, so Google receives your IP address and browser details when a page loads. See our cookie policy. The App keeps its settings in on-device storage, as listed in Section 2.

On the free tier the App asks Google’s consent service (UMP) whether ads may be requested. Google decides from your location whether to show a consent message, for example in the EEA and the UK. The App requests ads only after that step allows it, and not at all if the step fails or you refuse. Where Google requires it, Settings shows a Privacy button that reopens your choice. Elsewhere you can reset your advertising ID in Android settings, turn off ad personalization in your Google account, or subscribe to Plus for an ad-free app.

7. Data Retention

• Reader settings, saved and read lists: removed once the settings have not changed for about a year. The clean-up runs while the service is in use.
• Custom RSS feeds: switched off if you stop using the App for about 90 days. The feed record stays until deleted on request.
• Sign-in records (email, method, account ID) and the Plus yes or no: kept until you ask us to delete them. Sign-in sessions expire after 7 days and sign-in codes after 10 minutes.
• Push tokens: kept while Story alerts are on. Turning alerts off or signing out deletes the token; tokens Firebase reports as invalid are deleted when we next send to them. If the App could not reach us when you turned alerts off, the token stays until Firebase reports it invalid or you ask us to delete it.
• Server logs: we have not set an automatic deletion period for them.

When you request deletion, we delete or de-identify the data we can link to you, unless we must keep it by law.

8. Your Rights & Choices

Depending on where you live, you may have rights to:

• Access, correct, or delete personal data we hold about you;
• Object to or restrict certain processing;
• Withdraw consent;
• Portability of data you provided;
• Opt out of sale/share of personal information where those concepts apply (we do not sell personal data for money).

In the App you can change region, language and theme, sign out, and, where Google requires it, reopen the ads consent choice. You can turn notifications off in Android settings. To use other rights, write to us as described in Section 12 or use our data deletion request page. We may need to verify your request.

9. Account & data deletion

The App has no delete button. Ask for deletion at https://dailyreport.observer/delete-data.html or by email to [email protected]. We aim to complete verified requests within 30 days. Data on your phone is removed by clearing app data or uninstalling. Deleting our records does not cancel Google Play subscriptions: cancel those in the Play Store. See the deletion page for what we erase and what Google and RevenueCat keep.

10. Children’s Privacy

DailyReport is not directed to children under 13, or under 16 in the EEA and the UK. We do not knowingly collect personal information from those children. If you believe a child has provided data, contact us and we will take appropriate steps to delete it.

11. International Transfers

We are building for India-first users. Infrastructure and processors (including Google and hosting providers) may process data in India, the United States, the EEA, or other locations. Where required, we use appropriate safeguards (such as standard contractual clauses or processor terms) for cross-border transfers.

12. Contact Us

The trust score and topic ranking describe stories and the order of a feed. They are not an automated decision about you that has a legal or similarly significant effect. If you are in the EEA or the UK, you may complain to the supervisory authority where you live. We are established in India and have not appointed a separate representative in the EEA or the UK. Email is how we receive those requests.

US state privacy choices, including a do-not-sell-or-share opt-out, are on the privacy choices page. Copyright notices and corrections have their own pages: copyright, corrections.

Questions about this Policy or privacy requests:

• Email: [email protected] (Unitlabs support);
• Site: https://dailyreport.observer;
• API: https://api.dailyreport.observer.

We may update this Policy from time to time. The “Last updated” date at the top will change when we do. Material changes will be highlighted on this page or in the App when appropriate.