Your data is yours. Always.
1. The short version
- We never sell, rent or trade your data, and we don’t build advertising profiles of you.
- Your feed comes from the choices you make on each board, not from tracking you.
- We keep reading data only to pay publishers fairly, and we take your name off it after about two months.
- One cookie: the one that keeps you signed in. No tracking cookies.
- Every company that handles data for us is listed below, with what it gets.
2. Who we are
Bulletin is made by BTN Media, run by its founder, Pablo Melchor, in the United Kingdom. BTN Media is the data controller for the personal data described here.
Questions, requests or complaints: hello@bulletinmedia.co. A person reads every message.
3. What we collect, why, and for how long
| Data | What it is | Why | How long we keep it |
|---|---|---|---|
| Account | Your email address, and if you give them: first name, display name, photo, a short bio, up to three home towns. | To sign you in, write your briefing, and show local news and events near you. | Until you delete your account. |
| Your boards | The subjects, sources, keywords, places and layout you choose for each board, plus your settings (theme, accessibility, email choices). | This is what builds your feed. You set it; we don’t guess it. | Until you delete the board or your account. |
| What you’ve been shown | Which articles appeared on your boards. | So you don’t see the same cards day after day. | Deleted after 60 days. |
| What you read in full, like and tip | A record that you read, listened to or watched a piece inside Bulletin; your likes, saves, shares and tips. | To pay publishers fairly: this is how the money is shared out. Saves are just for you. | Full reads: your name is removed after about two months, and only the anonymous count stays for the accounts. Likes, saves and tips: until you remove them or delete your account. |
| Assistant chats | What you type to the board assistant when it helps you set up a board. | To carry the conversation. | Deleted after 30 days. The search assistant keeps only a daily count of uses, not what you asked. |
| Feedback | Your message and your device and browser type. Your account is linked only if you tick “you can contact me”. | To fix problems and reply to you. | Until the issue is dealt with, or until you ask us to delete it. |
| Edition alerts | If you switch them on: your browser’s push address and its type. | To send the alert. | Until you switch alerts off or the browser stops accepting them. |
| Adverts | Which adverts were shown or clicked on your boards. | To count impressions honestly and get paid for them. | Until you delete your account; after that, kept without your name. |
| Visitor counts | A daily code made from your IP address and browser with a key that changes every day and is then thrown away. No IP address is stored. | To count unique visitors per day without knowing who they are. | The code is deleted within a week; only daily totals remain. |
| Sign-ups and publishers | If you sign up on this site or apply as a publisher: name, email, website or feed address, your message. | To reply, onboard publishers and check who owns a publication. | While the relationship lasts, or until you ask us to delete it. |
We don’t ask for your age, gender, politics, health, religion or exact location. Home towns are optional and only as precise as a town.
We don’t take payments yet. Tips use credits inside the app, so we hold no card or bank details.
4. How your feed is built
Each board shows articles that match the subjects, sources, keywords and places you chose. They are ordered by freshness, source quality and how well they fit your board, and Impress-regulated and Independent Media Association publishers get a small lift. We also check what you’ve already been shown, so cards don’t repeat.
We don’t use your reading history to guess what you want, and we never use it to target adverts. More detail: How we curate and Ethical AI.
5. AI, and what it sees
- Mistral AI (France) writes your board briefings and powers the assistants. It gets your board’s subjects and settings and the articles involved. For the briefing it also gets your short bio and your first name, if you gave them. It never gets your email address or your reading history.
- Jev, by TypeSafe AI (US), reached through Vercel’s AI Gateway with zero data retention, sorts public articles by subject and helps pick the stories a briefing covers. It sees public article text and a board’s topics only, nothing that identifies you.
- Mistral also checks article images for content that should be blurred. That uses the publisher’s image, nothing about you.
Our goal is for all of it to run in Europe, and we move each piece as soon as we can without making Bulletin slower or costlier.
6. Who handles data for us
| Company | What for | What it gets |
|---|---|---|
| Supabase | Database and sign-in | Everything in section 3, stored encrypted. |
| Vercel (US) | Runs the app and its scheduled jobs | Your requests as they pass through, including your IP address, in short-lived server logs. |
| Mistral AI (France) | Briefings, assistants, image checks | See section 5. |
| Vercel AI Gateway and TypeSafe AI (US) | Sorting articles | Public article text and board topics, with zero data retention. |
| Resend (US) | Sending emails | Your email address and the email itself. |
| Ethicly | Ethical adverts | Our server asks for adverts using your board’s subjects and your country, never who you are. Your browser then loads the advert and reports when it was seen or clicked, so Ethicly sees your IP address. No cookies. |
| Your browser’s push service (Google, Apple or Mozilla) | Edition alerts, if you switch them on | The same alert everyone gets; nothing personal. |
When data goes outside the UK, the transfer is covered by UK adequacy rules or by standard contractual clauses in that company’s data processing agreement.
Publishers’ own content. Article images load straight from the publisher’s website, so the publisher sees your IP address, just as when you visit them. YouTube and Mixcloud players load only after you press play and agree, every time. “Read on site” takes you to the publisher, whose own privacy policy then applies.
7. Emails and alerts
- Sign-in emails are needed to use Bulletin.
- Your board’s morning briefing email is switched on when you join. Turn it off or make it weekly in Settings, or use the one-click unsubscribe link in every email. You don’t need to sign in.
- Edition alerts stay off until you switch them on, on each device.
8. Cookies and storage
Bulletin sets one kind of cookie: the sign-in session cookie, which is strictly necessary. We use no advertising or analytics cookies and store nothing else in your browser. Your theme and accessibility choices are saved to your account instead.
9. Our legal bases
- Providing the service you asked for (contract): your account, boards, feed, briefings and alerts.
- Legitimate interests: paying publishers fairly, counting visitors anonymously, counting advert impressions, keeping Bulletin secure. We’ve weighed these against your interests, and you can object.
- Consent: YouTube and Mixcloud players, edition alerts, and contact about your feedback. You can withdraw it at any time.
10. Your rights
Under UK GDPR (and EU GDPR if you live in the EU) you can:
- get a copy of your data in a portable format;
- have it corrected;
- have it deleted: delete your account yourself from the menu (You, then Delete account), or ask us;
- object to, or restrict, how we use it;
- withdraw any consent you gave.
Email hello@bulletinmedia.co. We reply within one month, free of charge. Deleting your account removes your profile, boards, likes, saves and chats. The publisher payment records and advert counts we need for the accounts stay, without your name.
If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d like the chance to put it right first.
11. Security
- Data is encrypted in transit and at rest.
- Database rules let each reader’s data be read only by that reader’s account.
- Only the founder has administrator access.
- If a breach puts you at risk, we’ll tell you, and the ICO within 72 hours.
12. Children
Bulletin is a news reader for adults and isn’t meant for children under 16. Some images are blurred until you choose to see them.
13. Changes
We’ll tell you about any important change by email or in the app, in plain language, before it takes effect.
Last updated: 13 October 2026.
Privacy by design. Transparency by default.