Privacy Policy

Information we collect

• Morning-brief email address — only if you subscribe. Used solely to send the brief you asked for. Subscription is double opt-in: we email a confirmation link before anything is sent.
• On-device usage counters— a small set of anonymous counters (e.g. home views, returning visits) stored in your browser’s localStorage. They never leave your device.

What we don’t collect

• No user accounts, names, or passwords.
• No third-party analytics, advertising, or cross-site trackers.
• No location data beyond what you choose to view.

How your email is used

Subscriber addresses are stored securely and used only for the morning civic brief. Every email carries a one-click unsubscribe link; unsubscribing deletes the address from the mailing list. We do not share or sell subscriber addresses to anyone.

Your rights under Sri Lanka’s PDPA

Under the Personal Data Protection Act, No. 9 of 2022, you have the right to know what personal data we hold about you, to request correction, and to withdraw consent at any time. To exercise these rights — for example, to confirm whether an address is subscribed or to request deletion — open an issue on our GitHub repository (see the Contact page) and we will respond.

Data retention & security

Email addresses are kept only while a subscription is active and are removed on unsubscribe. Subscriber data is accessed server-side only over encrypted connections; there is no browser or client-side path to the subscriber database.

Third-party processors

When the morning brief is enabled, emails are delivered via Resend and subscriber records are stored in Supabase Postgres. No other personal data leaves our infrastructure.

Changes to this policy

If this policy changes materially, the updated version will be published here with a new revision date.