PRYSM Privacy Policy

Last updated: October 4, 2026

Overview

PRYSM ("we", "our", "the app") is a news aggregation app that clusters publicly available news articles from multiple sources to show you different perspectives on the same story. PRYSM does not require an account, sign-in, or profile creation.

This policy explains exactly what data we collect, why, where it goes, and how to remove it. If anything here is unclear, email prysmnews@gmail.com.

Data We Collect

1. Push notification data (only if you opt in)

Notification delivery is currently paused. The app does not ask new users for notification permission while delivery is paused. Devices that previously granted permission may still refresh their registration and preferences.

When you enable push notifications, the app sends the following to our server so we can deliver notifications at the right time and in the right language:

• Your Expo push token (a device-specific identifier issued by Expo, used by Apple Push Notification Service / Firebase Cloud Messaging to deliver notifications)
• Your device platform (iOS or Android)
• Your IANA timezone string (e.g. "Europe/Rome")
• Your selected language and region preferences
• Your notification preferences (breaking news on/off, morning brief on/off and hour, evening digest on/off and hour, hidden category list)

The device registration expires after 90 days without a registration refresh. You can disable notification permission in your device settings or contact us about deletion (see below).

2. Android waitlist email (only if you submit it)

If you sign up for the Android launch waitlist on prysm.fyi, we store:

• Your email address (kept until launch notification is sent)
• Your IP address, truncated to 64 characters (used for spam/abuse prevention)
• Your browser's user-agent string, truncated to 256 characters (same)
• The timestamp of your signup

The IP address and user-agent are deleted after 365 days. The email is retained until we send the Android launch notification, after which you can request deletion.

3. Usage analytics (PostHog)

We use EU-hosted PostHog to understand how the app is used and improve it. Events include an installation-scoped identifier that links activity from the same installation. PRYSM does not associate that identifier with a name, email or account, but this is pseudonymous data, not a guarantee of anonymity. We collect:

• App opens, screen views, button taps
• The app version, build number, update/runtime identifiers, device and operating-system information
• Onboarding funnel events (e.g. which step you completed)
• Aggregate timing data for performance monitoring
• Story categories, outlets interacted with, feed order and preference changes such as editions, interface language and theme
• Feed-loading, stale-edition and image-loading signals; search events include query length rather than the search text

PRYSM does not deliberately send your name, email or push token to PostHog. Earlier app builds allowed PostHog to derive approximate location, such as country, city or postal area, from network IP addresses. Starting with version 1.0.10, iOS build 25 and Android build 53, IP-based location enrichment is disabled. Older installed builds and previously collected data are not changed by that setting. Our servers and service providers still process IP addresses to handle network requests.

4. Crash and error reports (Sentry)

We use Sentry for crash, error and sampled performance reports. Reports can include stack traces, device and OS details, app/build information, installation/session identifiers, technical breadcrumbs and request metadata. These identifiers can link reports from the same installation. Earlier builds could attach a screenshot of the app when an error occurred. Starting with version 1.0.10, iOS build 25 and Android build 53, automatic screenshot attachments are disabled; this does not remove older reports or change older installed builds.

5. Server-side anonymous metrics

Our API server records:

• Anonymous daily active user counts via HyperLogLog (a probabilistic counting method that estimates uniques without storing individual IPs)
• Daily request counts per endpoint, for operational monitoring

These statistics are retained for up to 90 days and then automatically deleted. We do not store individual IP addresses for analytics purposes.

6. Operational logs (third-party hosting)

The app's API runs on Vercel, the article-clustering worker runs on Railway, and our cache uses Upstash Redis. These providers retain short-lived server logs (typically including IP address and request path) as part of normal operations. We do not access these logs except for debugging incidents. See each provider's privacy policy for retention details.

7. News requests, search and images

News requests include the editions and story language requested. Searching within the loaded feed happens on the device. If you choose to search all news, the query and selected editions are sent to our API, which requests results from Google News. Search results are cached for five minutes under a hash of the query and editions. Hosting providers may process the query in request logs. Images may be served by the original publisher or optimized through images.weserv.nl; these services receive the network information needed to deliver the image.

Data Stored on Your Device

The app stores the following lists and settings locally using AsyncStorage. There is no PRYSM account-based synchronization of these lists. Related interaction and preference-change events may still be sent for analytics, and news/push requests include relevant preferences as described above:

• Your bookmarks (saved stories)
• Your read history (which topics you've opened)
• Your category interaction counts, hidden categories and preferred category order
• Your selected skin / theme
• Your hidden categories
• Your selected outlets and regions
• Your interface language
• Onboarding flags
• Recent search history and cached news content

Top ranks stories by breadth and freshness of coverage, not by your click or save history. Local data remains until you clear it or remove the app; device backup and restore behavior is controlled by your operating system.

What We Do Not Collect

• We do not collect your real name, physical address, phone number, or date of birth.
• We do not request access to your contacts, photo library, microphone, camera or device location services. Historical IP-derived analytics location and error screenshots are described above.
• We do not use advertising identifiers or third-party advertising SDKs in the app.
• We do not sell, rent, or share your data with brokers, advertisers, or any third party for marketing.
• We do not track you across other apps or websites.

Third-Party Services

To provide the service, PRYSM relies on the following processors. Each is bound by its own privacy policy, linked below:

• Expo / Apple Push Notification Service / Firebase Cloud Messaging — push notification delivery
• PostHog (EU) — product analytics — privacy
• Sentry — crash and error reporting — privacy
• Vercel — API hosting — privacy
• Railway — clustering worker hosting — privacy
• Upstash — Redis storage for cache, push tokens, and waitlist — privacy
• Anthropic and, when enabled, OpenAI — article clustering, summaries and quality evaluation. These processes use public news content and source metadata, not readers' analytics, bookmarks or account profiles — Anthropic privacy, OpenAI privacy
• Google News and images.weserv.nl — external news search and image delivery as described above

We use usage and crash data only to operate and improve PRYSM, not for advertising measurement, data-broker sharing or forwarding to advertising services.

When you tap "Read Full Article", you leave the app and visit the original outlet's website, which has its own privacy policy.

Legal Basis for Processing (GDPR)

For users in the European Economic Area, our legal bases are:

• Consent — for push notifications (you opt in) and for the Android waitlist (you submit your email)
• Legitimate interest — for product analytics, crash reporting, abuse prevention, and operational logs

Your Rights

• Access / portability — Email us about data associated with your use of PRYSM. We may need additional information to locate records associated with an installation rather than a named account.
• Deletion — Email prysmnews@gmail.com with the subject "Delete my data". For waitlist data, include the email you signed up with. We will help identify relevant records and respond within 30 days.
• Analytics choices — There is currently no in-app analytics opt-out toggle. Contact us with an objection or deletion request. Removing the app stops future app events, but does not automatically erase reports already received by our services.
• Disable notifications — Revoke permission in your device's notification settings. Notification settings inside PRYSM are hidden while delivery is paused.
• Withdraw consent — You can withdraw consent for notifications or request removal from the waitlist. The 90-day expiry applies to the push registration record, not to all analytics or diagnostic data.

Data Retention Summary

• Push notification record: 90 days of inactivity
• Waitlist email: until launch notification, then on request
• Waitlist IP / user-agent: 365 days
• Anonymous server analytics: 90 days
• Search results cache: 5 minutes
• Article caches: replaced as editions refresh; last-good news may be retained during failures. These are news content, not a reader's history.
• PostHog and Sentry data: subject to the retention settings of those services; contact us about deletion. The push-registration expiry does not apply.
• On-device data: until cleared or the app is removed, subject to operating-system backup behavior

Children's Privacy

PRYSM is not directed at children under 13. We do not knowingly collect information from children. If you believe a child has submitted data, contact us and we will delete it.

International Transfers

PRYSM operates with EU-hosted analytics (PostHog EU) and Upstash Redis. Some processors (Sentry, Vercel, Railway, Anthropic) may store data in the United States. Where required, transfers rely on Standard Contractual Clauses (SCCs).

Changes to This Policy

We may update this policy as the app evolves. Changes will be reflected in the "Last updated" date at the top. This policy distinguishes older installed builds from the replacement builds so that a release change is not mistaken for deletion of historical data.

Contact

Questions, deletion requests, or complaints: prysmnews@gmail.com.

See also: Terms of Service