Privacy Policy

The short version

Spoonfed collects the minimum data needed to run an RSS reader. There are no analytics, no tracking pixels, no third-party scripts, and no advertising. Your reading habits are not shared with anyone.

What data is collected

Account information

When you create an account, Spoonfed stores your username, email address, and a hashed version of your password. Your password is never stored in plain text, it's hashed with bcrypt before it touches the database.

Reading data

Spoonfed stores which articles you've read, your current reading position (scroll position), bookmarks, quotes, and any notes you add. This data is used to power the reader, showing you unread articles, restoring your scroll position, and displaying your library.

Feed subscriptions

The feeds you subscribe to are stored so Spoonfed can fetch and display articles for you. Feed data (articles, titles, content) is fetched from the original publishers and stored on Spoonfed's servers.

Settings and preferences

Your chosen theme, font preferences, content filter keywords, auto-discard settings, and other preferences are stored to personalise your experience.

Public profiles

If you enable a public profile, your display name and the bookmarks and quotes you choose to share will be visible to anyone. Your email address, username, reading history, and other private data are never exposed on your public profile.

Public profiles also have an RSS feed, so others can subscribe to your shared items. You can disable your public profile at any time, which immediately removes it from public view.

Image proxy

Spoonfed includes an image proxy that fetches images from article sources through Spoonfed's server. This means the original image host never sees your IP address or browser information, they only see Spoonfed's server. The proxy does not log which users request which images.

Cookies and authentication

When you log in, Spoonfed sets a session cookie in your browser to keep you signed in. It lasts for 30 days, after which you'll be asked to log in again.

Alongside it, Spoonfed sets a small security cookie used to confirm that requests are coming from the Spoonfed app itself and not from another website trying to act on your behalf. It contains no personal information.

That's the only cookie usage. There are no analytics cookies, no tracking cookies, and no third-party cookies of any kind.

Third-party services

Spoonfed does not use any analytics services, advertising networks, or tracking tools. There are no third-party scripts loaded in the app.

Spoonfed uses a third-party email provider to send transactional emails. This is purely to ensure reliable delivery to your inbox, running a mail server yourself is notoriously unreliable. The provider is not used to track you or your behavior.

The emails sent through the provider are limited to:

• Account verification emails when you sign up
• Password reset emails when you request one
• Email change confirmation when you update your address
• Occasional service notices, for example, if the Terms of Service or Privacy Policy change in a meaningful way

The provider offers delivery reports (whether an email was accepted, delivered, or bounced) which are used to debug delivery issues. No marketing emails, newsletters, or promotional messages are ever sent. Your email address is shared with the provider only for the purpose of delivering these specific messages.

Server logs

Like any web server, Spoonfed produces operational logs that may include IP addresses and request paths. These logs are used for debugging, monitoring errors, and understanding traffic patterns, never for marketing analytics, and never shared with anyone.

Data retention and deletion

Your data is kept for as long as you have an account. Articles in your reading queue may be auto-discarded based on your settings, but bookmarked and quoted items are kept indefinitely. Read history is retained to ensure you don't see the same article twice.

You can delete your account at any time from the settings page. This permanently removes all your personal data, your profile, bookmarks, quotes, reading history, subscriptions, and settings. This action cannot be undone.

That said, data retention is on a best-effort basis. Spoonfed is a small indie project, not an enterprise service. While I do my best to keep your data safe, I can't guarantee that data won't be lost or deleted in the course of keeping the service operational. Don't rely on Spoonfed as your only copy of anything important.

Data security

Passwords are never stored in plain text, only a one-way hash is kept, so your actual password can't be recovered by anyone, including me. All communication between your browser and Spoonfed is encrypted in transit via HTTPS.

Changes to this policy

If this policy changes in a meaningful way, I'll do my best to notify you through the app or via email. The "last updated" date at the top of this page will always reflect the most recent revision.

Questions?

If you have any questions about how your data is handled, reach out at hello@spoonfed.fyi.