We respect your data and your choices.

The website and reader app are run by Gair Rhydd, Cardiff University’s student-led newspaper, within Cardiff University Students’ Union. Cardiff University Students’ Union is responsible for personal information handled through the website and app. The Gair Rhydd editorial team manages messages, tips and contributions sent to the newsroom.

We may collect:

• your name, email address and the contents of a message, correction, story tip or contribution you send;
• your verified email address, account and session information, names you provide, saved-story references, and reader settings and following choices when you use a reader account;
• your cookie choices, language and text-size preferences;
• article views, active reading time and reading progress if you allow article analytics;
• public page views, grouped page path, referring page or site, approximate location, browser, operating system and device type if you allow website analytics;
• page loading, visual stability and interaction timing, grouped page path, browser, device, network speed and country if you allow performance analytics;
• the map area you request, and location used by your browser or the app only when you grant location permission; and
• basic connection and security information needed to deliver and protect the website and app.

We remove search text, query strings, fragments and story IDs from page addresses reported to website and performance analytics. Private newsroom pages are not reported. Performance analytics adds no personal reader identifier and does not run in the native app. You do not need to give us a name or email address when sending a story tip unless you want the newsroom to contact you.

We use information to deliver and protect the website and reader app, provide the account features you request, remember choices you ask us to remember, understand how articles are read and how public pages are visited, improve page speed and responsiveness, respond to messages, assess tips and contributions, and keep editorial records.

We rely on your consent for optional reading preferences, article analytics, website analytics, performance analytics and location access. We rely on our legitimate interests when we operate and secure the website and app, respond to enquiries and carry out ordinary editorial work. We may also use information where the law requires it or where it is needed to protect someone’s vital interests.

Reading the newspaper does not require an account. When reader sign-in is available and you choose to use it, we keep your verified email address, an account identifier, verification and session information, and any first, last or preferred name you provide. Your account can also store your language, text size and home-section settings, the sections and writers you follow, and references to stories you save.

If you choose Sign in with Apple or Google, that provider handles sign-in and shares the identity information you authorise, including your email address and any basic profile information it supplies. We do not receive your Apple or Google password. Supabase provides account authentication and stores the associated identity and session records. The sign-in provider’s own privacy policy also applies.

Your personal reader account is separate from newsroom role accounts and is not transferred when an editor changes. Signing in does not subscribe you to a newsletter or enable optional analytics.

Guest saved stories stay on your device and are not synced to an account. When you sign in, saved-story references sync with your reader account and can be available on other devices where you sign in. The app keeps a separate protected account cache and pending save changes on your device. Signing out clears that private account cache and pending changes; it does not delete your server-side saved list or your separate guest saves.

Guest saves are not automatically added to an account. You can choose to add them, and you can remove saved stories yourself. Saved-story sync does not upload article bodies, PDFs, precise location or a reading history.

Settings and following choices you save to a reader account are kept with that account. They are separate from optional website reading preferences, which are remembered in the browser for up to 180 days when you allow them. Changing a cookie choice does not delete account settings or guest saved stories.

When new story alerts are available in the native app, following a section or writer does not enable them automatically. If you choose Enable alerts and allow notifications on iOS or Android, we link a random app-installation identifier and a device push-notification token to your signed-in reader account and this device’s notification preference. We use those details to send alerts for newly published stories matching your follows and story-language setting through Apple Push Notification service on iOS or Google Firebase Cloud Messaging on Android.

Notifications contain a public story headline or a count of new stories and a reference that opens a story in the app. Your device settings determine whether they appear on your lock screen. You can turn alerts off in the app or in your device settings. An app opt-out made while offline is retried when connected; use your device settings to stop notifications immediately. Turning alerts off removes the stored push token. Signing out, unfollowing and account deletion stop future matching delivery; notifications already handed to Apple or Google may still arrive.

Supabase stores the private device registration and delivery records, Vercel runs the delivery service, and Apple or Google receives the token and public notification content for its delivery service. Completed or cancelled delivery records are removed after 30 days when the worker runs. Account deletion removes associated device registrations. Alert choices are separate from newsletter membership and analytics.

In the Gair Rhydd app, open your profile, choose Manage account, then Delete account and confirm Delete permanently. To request account deletion without the app, email editor@gairrhydd.com and ask to delete your Gair Rhydd reader account.

When account deletion is available, a verified reader can request it through the account service. You can also contact editor@gairrhydd.com about deleting your personal information. An accepted account-deletion request immediately disables reader access while removal is completed. Completion removes the reader’s authentication account and its server-side profile, preferences, following choices, saved-story references and sessions. The app clears the private account library from the device when deletion is accepted.

A small deletion receipt is valid for 30 days so you can check the result or retry an interrupted request. Unfinished deletion requests are retained until they can be completed; they do not become active accounts again when the receipt expires. We retain limited operation records for security and reliable request handling. Deleting a personal reader account does not delete published journalism, contributor records or separate guest saved stories held only on your device.

The iOS reader uses Apple MapKit. The Android reader uses MapLibre with OpenFreeMap tiles based on OpenStreetMap. The location button requests your device’s location permission while the app is in use; opening the map alone does not request permission. Your position and distance ordering are handled on the device, with no background location updates. Precise coordinates are not sent to Gair Rhydd’s API or stored in your reader account. Apple provides the map area displayed on iOS; OpenFreeMap provides Android tiles and OpenStreetMap provides website tiles. These services receive the requested map area and connection information. You can browse the map without sharing your location.

A story tip may contain information about you or another person. It may also contain sensitive information. Access is limited to people who need it for editorial review, fact-checking and reporting.

If you do not want follow-up, leave your contact details blank or untick the contact option. Please avoid sending personal information that is not needed for the story. Journalism and freedom-of-expression rules may affect how some data protection rights apply to editorial material.

We use trusted suppliers to host the website, store editorial records and reader account data, deliver editions and provide maps. Vercel hosts the website and API, Supabase handles reader authentication and account data, and Cloudflare delivers the edition reading copies. Apple provides iOS maps, OpenFreeMap provides Android map tiles and OpenStreetMap provides website map tiles. Apple or Google delivers native story alerts when you enable them. Apple or Google also handles sign-in if you choose that method. If you allow website analytics, Vercel receives public page-view data to provide aggregate traffic reports. If you separately allow performance analytics, Vercel Speed Insights receives public website timing and device information to report page speed and responsiveness. These suppliers receive the connection and other information needed to provide their service.

We may also share information with Cardiff University Students’ Union staff where support, safeguarding or legal advice is needed, or with another organisation when the law requires it. We do not sell personal information.

Cookie choices and remembered reading preferences last for up to 180 days. Individual article-visit records are kept for up to 30 days to prevent double counting; anonymous daily totals may be kept for longer. Vercel Web Analytics does not use a visitor cookie; its visitor identifier resets daily, and traffic reports follow Vercel’s service retention settings. Speed Insights adds no personal reader identifier; performance reports follow Vercel’s service retention settings.

Messages, tips and contribution enquiries are kept only for as long as they are needed for editorial review, follow-up, record-keeping or a legal requirement. The period depends on the nature of the message and whether it leads to published work or an ongoing matter. We review records and remove them when they are no longer needed.

Some suppliers may process information outside the UK. Where this happens, Cardiff University Students’ Union requires an approved legal safeguard or another lawful basis for the transfer.

Depending on the circumstances, you may ask to see your personal information, correct it, delete it, restrict how it is used, receive a copy or object to its use. Where we rely on consent, you may withdraw it at any time. Some rights may be limited where an exemption for journalism or another legal duty applies.

To make a request, email editor@gairrhydd.com. You may also contact the Data Protection Officer at Cardiff University Students’ Union, University Union, Park Place, Cardiff CF10 3QN.

We use appropriate access controls and security measures to protect information. No online service can guarantee complete security, but we limit access to people who need the information and review how it is handled.

Please contact us first if you have a privacy question or concern. You can email editor@gairrhydd.com or find another editor on the Team page.

You also have the right to complain to the Information Commissioner’s Office (opens in a new tab), the UK regulator for data protection.