Privacy

What each part of the system can see about you. For the decisions behind it, see ARCHITECTURE.md (D5, D7, D10).

Nearly everything below rests on one assumption: your configuration repository stays private.

• Sources — indirectly reveal your preferences, since subscribing to a feed is itself a signal.

  • Sent to the AI model on every run — see below, this is where most of the risk lies.

  • At rest, stored in your private configuration repository.

  • Per-published article, the source feed’s name appears in that entry’s <author> — the full subscription list is never exposed, only the source of whatever gets selected.

• Editorial policy — reveals what you care about directly, and is the most sensitive document in the project.

  • Sent to the AI model on every run.

  • At rest, intended to be stored in your private configuration repository.

  • The published rationale can’t leak it: it’s built in code from the independent-source count alone, never from model output. Matched topics — the one piece of model output that would leak the policy — are deliberately kept out of the feed and stay in the private selection log instead (D5).

• Model provider — sees both documents above, and therefore learns your preferences.

  • Each run sends the day’s headlines and summaries, which are already public, the engine’s scoring prompt, and the runner’s editorial policy.

  • Anthropic does not train on API inputs by default.

  • The provider is a seam, not a hard dependency (D7): swapping to a self-hosted model is one class away, not a rewrite.

• Publish target — the feed is public by default, so anyone with the URL could infer your preferences from what’s selected.

  • Mitigated at two layers: an unguessable URL, and robots.txt plus a noindex header so a crawler that fetches anyway still won’t index it.

• RSS reader — sees the curated feed’s URL and content, same as any other subscription.

  • Low incremental risk in the intended use case: since the curated feed is read alongside the raw subscriptions, the reader already sees the same articles and more via those.

• Source publishers — see a request for their feed on every run, and nothing more, unless paywall detection is enabled for that runner.

  • With it on, a publisher additionally sees a request for each of their articles the model graded worth considering that day — a much narrower signal than “subscribed to this feed”, since it names the individual articles. It is off by default for this reason as well as the traffic.

  • The request carries the configured User-Agent and no cookie or credential, so it is not tied to any account with that publisher.

The privacy-maximalist version of this would be a self-hosted LLM with no published feed at all — reading selections from a local file instead. That’s not what’s implemented here for convenience, but the architecture doesn’t rule it out, and could be investigated in the future.