NaraNews privacy notice

This notice describes the account and email features in this project.

What the account features use

Your email address is used to verify sign-in and, if you opt in, send news digests. It is not used for marketing. Account records include an identifier, verification and login times. Consent records keep the decision, notice hash, button text, time and IP address.

Session and access records

The website uses a strictly necessary HttpOnly session cookie named naranews_session to keep you signed in for up to 30 days. Signing out removes that cookie. The extension stores its own session separately. API access records include time, IP address, route, status, browser details and account/session identifiers where available.

Service providers

The website and API are hosted by Vercel, with server code running in Singapore. The project database is hosted by Supabase in Seoul, South Korea. Emails are sent through Google’s Gmail service, which processes recipient addresses and email content to deliver sign-in codes and digests and may process them outside Thailand, including in the United States. The project’s provider agreement status must be confirmed by the project team before a public rollout.

Retention and your choices

The configured retention job removes access logs after 365 days, sign-in code records after 24 hours, and anonymizes contact details after two years without login. Those timeframes depend on the deployment running that job. Consent records are append-only and do not currently have an automated deletion schedule.

You can enable or withdraw email consent on the same settings screen. Signing out alone does not withdraw consent. Account export, correction and deletion are not yet available as self-service features.