Privacy policy
Your data, in plain words.
Who we are
econfeed is run by Bendik Nyheim, based in Norway. We are the data controller for the personal data described here. Contact us about privacy at [email protected].
The waitlist
Only what you give us when you request early access, plus what we need to keep the form safe.
| Data | Why |
|---|---|
| Your email address | To email you about early access and the launch. |
| Your name, company and role (optional) | To know who is asking and to plan who gets access first. |
| What you would use econfeed for and which releases matter to you (optional) | To plan access and to decide which sources and features to build first. |
| When you gave consent, and which version of the consent text you saw | To prove that you agreed to be contacted. |
| When you confirmed your email (if we ask you to) | To make sure the address is yours. |
| When you signed up and from which page | To keep the list in order. |
| A one-way scrambled form (hash) of your IP address | To stop abuse by limiting how many signups come from one network. Deleted within 24 hours. |
We do not buy data about you, combine it with other sources, or sell it.
Legal basis
Your consent (GDPR article 6(1)(a)). You give it by ticking the box on the form, which is never ticked in advance. Norwegian marketing law also requires your consent before we send you email about our service. You can withdraw consent at any time by writing to us. Withdrawing does not affect what we did before.
The short-lived IP hash is kept on the basis of our legitimate interest in protecting the form from spam and abuse (article 6(1)(f)).
How long we keep the waitlist
We keep your early-access request until you ask us to delete it. To be removed, write to[email protected] from the address you signed up with; we delete the entry, answers included. If econfeed does not launch, we delete the whole list. If we ask you to confirm your email and you do not, we delete the entry after 30 days.
Your econfeed account
When you sign up in the app (with an email link, no password) and use the API, we store the following. We never store your password (there is none), your API keys or your sign-in and session tokens in readable form: only a one-way hash, so a copy of our database cannot be used to sign in or call the API.
| Data | Why | How long |
|---|---|---|
| Your email address, the account name (your email address until you change it), plan, and when the account was opened | To sign you in, run the account and tell you about it. | Until you delete the account. |
| Which version of the terms and this policy you accepted, and when | To show what you agreed to. | Until you delete the account. |
| Sign-in links: your email address, a hash of the link, a hash of your IP address, the page to open afterwards, and when the link was asked for and used | To sign you in once per link and to limit how many links one address or network can ask for. | IP hash: 1 day. The rest: 30 days. |
| App sessions: a hash of the session token, when it started, was last used and ends (30 days), a hash of your IP address and your browser's user agent | To keep you signed in, and so you can see your session and sign out. | 30 days after the session ends (signed out, expired or ended by deletion). |
| API keys: the name you give each key, its first 12 characters, a hash of the key, its scopes, an IP allowlist and expiry if you set them, who created it (your email address for keys made in the app), and when it was created, last used and revoked | To check each API call and show you your keys. | Until you delete the account (revoked keys stay listed as revoked). |
| Usage: per key, the number of requests and values returned each minute and each day, and per endpoint each day, with errors and requests refused by your limits | Your plan's limits, the usage page, billing, capacity planning and abuse checks. | Minute counts: 35 days. Daily counts: for the life of the account, then as below. |
| Webhook endpoints: the URL, description and filters you set, the signing secret, status and failure counts; and per delivery attempt: time, event, HTTP status, response time and error | To deliver events, retry failures and show you the delivery log. | Until you delete the endpoint or the account. Deleting it erases the URL, description, filters and secret; its delivery records stay until you delete the account, then as below. |
| Your watchlist: the series, releases and countries you follow and their alert settings | To show your dashboard and send the alerts you asked for. | Until you remove them or delete the account. |
| A change log of the account and its keys: what changed, when, and who (your email address for changes made in the app) | Security: to see who changed access, and to undo mistakes. | For the life of the account; your name and address are removed on deletion. |
We do not record the IP address of API calls; the rate limit counts per key in memory. Our server logs refer to accounts by number and are rotated by size, so old lines are overwritten. Until we have an email provider, sign-in emails (address and link) are written to that log instead of being sent. Rows deleted after the periods above stay in our database backups until those expire, at most about 30 days later. You can see your keys, current session, usage, webhooks and watchlist in the app, change or remove each of them there, and delete the whole account (below).
Legal basis: running the account you asked for (GDPR article 6(1)(b)), and for the IP hashes, the change log and abuse checks our legitimate interest in keeping the service secure (article 6(1)(f)).
Deleting your account
If you have an econfeed account, you can delete it yourself at any time: on the Account page of the app ("Delete account", type your email address to confirm), or with DELETE /v1/account in the API. Accounts on a custom plan are closed by us: write to [email protected].
Deletion takes effect at once. Every API key stops working, every webhook is deleted, you are signed out everywhere and open sign-in links stop working. Your name, your email address, your webhook addresses, the names you gave your keys and your watchlist are erased, including from our change log. Your email address is free again, so you can sign up later as a new account.
What we keep, with nothing in it that names you:
| Kept | Why |
|---|---|
| The account number, its plan and the dates it was opened and deleted | Billing and accounting records. |
| Each API key's short prefix, its dates and that it was revoked | To recognise a revoked key if it is used again. |
| Which version of the terms and this policy the account accepted, and when | To show what the account agreed to. |
| Usage counts (requests per day and endpoint) | Billing, capacity planning and abuse checks. |
| Webhook delivery records (time, event, status code, kind of error), without the address | To answer questions about deliveries and to account for them. |
| The change log of the account and its keys, with your name and address removed | Security and audit: who changed what, and when the account was deleted. |
| The scrambled IP address (hash) of sign-in links from the last hour | The sign-in rate limit. It is no longer linked to the account. |
Database backups still contain the old data until they expire, at most about 30 days after the deletion, and are only read to restore the service. Emails we already sent you stay in your mailbox and in our email provider's logs for as long as that provider keeps them.
Who processes it for us
The site, the form and the waitlist database run on Cloudflare (Cloudflare Pages, Workers and D1). Cloudflare processes the data on our behalf under a data processing agreement. Cloudflare may process data outside the EEA, covered by the EU-US Data Privacy Framework and the EU standard contractual clauses. The app, the API and their database run on our own servers in Norway, and the database backups stay there. Traffic to the app and the API reaches those servers through Cloudflare (a Cloudflare Tunnel), so Cloudflare sees your IP address and requests and may keep them in its logs for a short time. The sign-in form can ask Cloudflare Turnstile to check that you are not a bot; that check sends your IP address to Cloudflare.
Email to and from our econfeed.io addresses runs on Google Workspace (Google Cloud EMEA Limited, Ireland), which processes it on our behalf under Google's data processing terms. Google may process data outside the EEA, covered by the EU-US Data Privacy Framework and the EU standard contractual clauses. Before the app sends you any email itself (sign-in links), we will name that provider here.
Cookies and analytics
This site sets no cookies and does not use local storage to track you, so there is no cookie banner. Fonts are served from our own site, not from a third party.
The app sets one cookie once you sign in: the session cookie, which keeps you signed in for up to 30 days and is removed when you sign out. It is strictly necessary, so it needs no consent. If you paste an API key into the app's docs page to try calls, it is kept in that browser tab only (session storage) and sent only to the API.
We may use Cloudflare Web Analytics to count visits. It does not use cookies or fingerprinting and does not track you across sites. It records things like the page, the referring site, the country and the browser type, in aggregate.
The live board and the status page load data from our own API. To stop abuse, the API keeps a request counter per IP address in memory for a few minutes. It does not log or store your IP address.
Your rights
Under the GDPR you can ask us to:
- show you the data we hold about you (access),
- correct it (rectification),
- delete it (erasure),
- limit how we use it (restriction),
- give it to you in a machine-readable format (portability),
- stop using it (objection, and withdrawing consent).
Write to [email protected]. We answer within one month. If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet.
Changes
If we change this policy, we update the date at the top. If a change affects what we do with your email, we tell you by email first.