How Reafrac handles your information.

When you create an account, Reafrac stores your name, email address, username when present, and the authentication records needed to sign you in. For email and password accounts, the password is stored as a hash rather than readable password text. If Google sign-in is enabled and you use it, Google provides the profile and account information shown in its authorization flow, and Reafrac stores the provider information needed to link your account.

Reafrac uses this information to authenticate you, keep your reader synchronized, fetch feeds and article content, remember your settings, and maintain and secure the service. Reafrac does not sell your personal information or use it to serve advertising.

To provide the service and synchronize your reader, Reafrac stores:

• Your feed subscriptions and feed settings.
• Article read or unread state and bookmarks.
• Account preferences and, when enabled by the operator, an optional content-proxy URL.
• Feed records and entries, including content supplied by those feeds.

Feed records and entries may be shared between accounts at the application level. Reafrac can also fetch an article from its original site when you request the full article; that extracted article is returned for reading and is not saved as your personal reader data by the web app. Your subscriptions, feed customizations, bookmarks, and reading state remain associated with your account. Removing a feed removes your subscription and personal reading state for it, but shared feed records and entries may remain for other users.

Reafrac and its hosting systems may record session details such as expiration time, IP address, browser or user-agent information, request method, and request URL. These records help operate, secure, and troubleshoot the service.

Reafrac uses Umami to understand page visits and interactions, including outbound article-link clicks. It uses Sentry to diagnose application errors and performance problems. Depending on the event, Sentry may receive browser information, IP address, request headers, visited route, account identifier, feed or article URL, search input, email address submitted during authentication, and error context. Reafrac does not use this information for advertising.

Reafrac contacts feed publishers and article websites to retrieve feeds, article content, and icons. Those sites receive the requested URL and ordinary network information from the Reafrac server or its configured proxy. When you use feed discovery, Reafrac sends the website address you enter to Feedsearch.dev unless the service operator has configured a different provider. Opening an original article connects your browser to the publisher's site, where that publisher's privacy policy applies.

If a content proxy is configured, it receives the feed or article URL needed for extraction. A proxy URL saved in your account is restricted by the service operator's allowlist, but the proxy operator may have its own logs and privacy policy.

Reafrac uses Resend to deliver requested password-reset and account-security messages. Resend receives the recipient email address, sender and reply-to details, message subject and body, the short-lived reset link, and ordinary delivery metadata.

This information is disclosed to deliver, secure, and diagnose transactional email. Reafrac does not send passwords or password hashes to Resend. Resend may retain message and delivery records under its own retention terms; see its privacy policy.

Reafrac uses session cookies to keep you signed in and protect your account. It also uses a cookie for the sidebar state and browser local storage for your theme preference. The service does not intentionally set advertising cookies. Disabling required cookies can prevent sign-in from working.

Reafrac keeps account and reader data while your account is active and keeps other records for as long as they are needed to operate, secure, and troubleshoot the service. Retention periods can vary by data type and service provider, including transactional-email delivery records retained under the provider's retention schedule. Password-reset messages are requested security communications, not marketing, and are not repurposed for promotion. There is currently no self-service account deletion control. To request access, correction, or deletion, use the private contact option on the Contact page and write from the email address associated with your account. We may ask for information to verify the request. Do not include your password or session tokens.

Reafrac may update this policy when the service changes. The date at the top of this page will show the latest revision.