Privacy notice

Last updated 2 November 2026

CoinBriefDaily (the website, the iPhone and Android apps, and our emails) is run by Codelivly, the data controller. This notice explains what we collect, why, how long we keep it and your rights under UK GDPR. You can use almost everything without an account.

What we collect, and why

Your account (to provide the service you signed up for): your email, a hashed password if you set one, your name if you give it, and your settings (explain level, time zone, quiet hours, appearance).
Sign in with Google or Apple, if you choose it: we receive your email address, your name if you share it, and an account number from Google or Apple. Apple may give us a private relay address instead of your real one. We never receive your Google or Apple password.
Where you are signed in (to keep your account secure and let you sign out other devices): for each session, the device name, browser or app, IP address and when it was last used.
What you choose to keep: saved stories, followed people, companies and topics, your watchlist of software, the alerts it raises, your quiz answers, streak and points.
History, checklist ticks and your region: kept in your browser or phone; if you are signed in, your history (the stories you opened, newest 200) and checklist ticks are also kept on your account so they follow you to other devices. You can clear your history at any time. Your region choice is kept on the device and, if signed in, on your account.
Teams, if your company uses it: the team name, billing email, members and their roles, the team’s software list and who looks after each product, and the Slack, Microsoft Teams, webhook or email destinations for alerts (stored encrypted).
Ask AI: to give signed-out readers a few free questions a day, we count questions per day against a hashed form of your IP address and a random id in a cookie, deleted after two days. The questions you ask and our answers, kept 30 days so we can stop abuse, then erased. Your question is sent to the AI provider we use at the time (for example Anthropic) to write the answer, as text only, without your name, email or account.
Push notifications, if you allow them: your phone’s push token (a random ID from Apple or Google), used only to deliver notifications through them. If you aren’t signed in, we keep just that token, whether it’s an iPhone or Android phone, the app version and the region you picked, so we can send breaking news. It isn’t linked to you or to any account. We delete a token as soon as Apple or Google tell us it no longer works, and any token not used for 90 days. Signed in, the token is kept with your account’s phone session and goes when you sign out.
Emails: account emails (confirming your address, password resets) are needed for the service. The weekly digest and other newsletters are sent only if you subscribe and confirm (double opt-in); every one has an unsubscribe link. We send email from our own mail server.
Jobs (closed on 2 November 2026): we no longer have a job board, Easy apply or CV uploads. CVs, applications and employer details people gave us before then are kept encrypted on our own server, not shown or sent to anyone, until we archive and delete them. Ask us and we delete yours straight away.
Payments (donations, Teams subscriptions, sponsorships) are handled by Stripe. We never see or store card details. We keep the amount, the date, its status, Stripe’s reference numbers and the email for the receipt, as UK law requires for our records. Sponsors also give billing contact details for invoices.
Usage counts (to see what is useful): we count page views, story opens and shares with the page, the referring website, whether it was the website, the iPhone app or the Android app, your country from your device’s time zone, and your browser, system and device type in plain words (for example “Chrome, Android, phone”). To count visitors without cookies, each visit gets a code made from a secret that changes every day, your IP address and your browser’s description; we keep only that code, never the IP address or the browser description, and the day’s secret is deleted when the day ends, so nobody, including us, can link a code to you or to another day. Crawlers and bots are not counted.
Security: to limit abuse we briefly keep counts of requests per IP address (deleted within a day), and our servers keep short technical logs.

What we never do

No advertising trackers, no tracking pixels, no third-party analytics, and we never sell your data.
Sponsors never get your data. Sponsor logos are copied to our own server, so your device never contacts a sponsor’s website unless you click their link; clicks are counted by us without cookies.
We never store the text of the articles we link to.

Cookies

Only the ones the site needs: your sign-in session, a security token that protects forms, your light or dark and region choices, the random id that counts free Ask AI questions, and short-lived ones while you sign in. No advertising or analytics cookies. The cookie notice lists every one.

Who else handles it

Our hosting provider runs the server our database and files live on.
Stripe (payments), the AI provider in use (Ask AI and story summaries), Apple and Google (push delivery, and sign-in if you use it).
If your team connects them: Slack, Microsoft or your own webhook receive the team’s alerts (product, vulnerability and severity, never personal data).

Where your data is stored

Our server, and so our database and files, is in India, run for us by our hosting provider, Hostinger. Stripe, the AI provider in use and Apple and Google may handle data in the United States and other countries. The UK has not ruled that India’s data protection laws give the same protection as UK law, so when your data leaves the UK we rely on the UK’s approved data transfer clauses in our contracts with these providers, alongside our own safeguards: everything travels encrypted, old CVs are encrypted at rest, and the AI provider never receives your name, email or account.

How long we keep it

Your account and what you keep in it: until you delete your account. Deleted accounts are erased within 30 days.
Signed-out or expired sessions: 7 days. Ask AI questions: 30 days; free-question counts: 2 days.
Newsletter sign-ups never confirmed: 14 days. Teams checkouts never finished: 7 days.
Payment records: as long as UK tax law requires.

Your rights

You can see, correct, download (Profile > Download my data) and delete your data, and delete your account at any time from the website or the app. You can object to or ask us to restrict how we use it. If you are unhappy with how we handle your data, please tell us first; you can also complain to the Information Commissioner’s Office (ico.org.uk).

Contact

support@coinbriefdaily.com

Questions: hello@coinbriefdaily.com. CoinBriefDaily is run by Codelivly.