Privacy

Who processes your data

The data controller is MaGa Srl, Via Privata Borghesio 4, 25081 Bedizzole (BS), Italy, VAT and tax code 04391330984, REA BS-611083. MaGa Srl publishes News & Ideas, the site at newsideas.app and the daily email.

On this page, "we" means MaGa Srl. For anything about your data, write to contact@newsideas.app. We reply within one month.

What this page covers

This page says what newsideas.app and the newsletter collect, why, for how long, who processes it for us, and how you can use your rights. You can read the site without giving us personal data. Declining analytics does not change that. Data reaches us when you subscribe, confirm, unsubscribe, vote in a quiz, or use an invite link.

The site runs no advertising. Analytics starts only if you accept it, as the next section says. The cookies page lists the names. A Watch link, when an issue has one, leaves this site. Nothing from that other site loads here.

Analytics

Google Analytics 4 starts only if you accept analytics cookies in the banner. Before that choice, the analytics script is not loaded and no analytics hit is sent. Decline keeps it that way. Closing the banner counts as Decline. Accept and Decline have equal weight.

With your consent, Google Analytics records the page you viewed, and these actions: submitting the subscribe form, opening the confirmation result, a quiz vote, an invite link, a Watch link, and a source link. Google states that for traffic from the European Union the IP address is used only to derive a location and then discarded. The stream uses Google Consent Mode. Advertising signals stay denied at all times, because the site runs no advertising.

In Google Analytics, event data is kept for 2 months and data tied to the individual user for 14 months. Aggregate reports do not expire. The cookies are _ga and _ga_ZW2QS60FYK. Each lasts up to 2 years in the browser unless you clear it. The choice itself is stored in the browser as ni.consent, not as a cookie. It is asked again after 6 months, or when this policy changes.

Legal basis: your consent (art. 6(1)(a) GDPR). You withdraw it from Cookie settings in the footer. Withdrawal does not affect what was already sent. Google LLC processes this data for us. The measurement id is G-ZW2QS60FYK.

The newsletter

If you subscribe we store, in Cloud Firestore:

• your email address, because the send needs it
• the consent text you accepted, its version (currently 2026-10-21.2), and the time you accepted it
• the time of the latest signup attempt, while the address is still waiting to be confirmed
• your IP address, kept for 24 months from the signup, as a record that this consent was given and to limit abuse
• a salted hash of that IP address, so we can limit repeated signups without reading the address on every check
• the country derived from the IP address on our servers, and the region and city when that local lookup returns them
• the language of the browser, from the Accept-Language header and from the language the browser reports
• the time zone the browser reports, so a later send can be timed to the day where you are
• the page path where you submitted the form, which form it was, the origin of the page that linked you here, and the utm_source, utm_medium, utm_campaign, utm_term, and utm_content values from the first page of the visit
• the device type (mobile, tablet, or desktop), the browser family, the operating-system family, and the user-agent string cut to 256 characters
• a hash of a confirmation token, and the time that link expires
• an unsubscribe token, and a hash of that token, so each email can carry a working unsubscribe link

Current consent text: I agree to receive a daily email from News & Ideas with that day's Shorts and sources. I can unsubscribe at any time. Unsubscribing deletes my address. News & Ideas stores this consent, the time, my IP address for 24 months, the country from that address, my language, time zone, signup page, and device type. The privacy page explains how.

The list is double opt-in. We send a confirmation message, and the digest starts only after you open that link. The link expires after 48 hours. If you open it after it has expired, we delete the pending record. A pending record that is never opened stays until you ask us to delete it or we delete it ourselves. There is no separate job that sweeps abandoned signups.

Legal basis for the newsletter itself: your consent (art. 6(1)(a) GDPR). You withdraw it with the unsubscribe link in every email, or from the unsubscribe page. Withdrawal does not affect sending that already happened.

Legal basis for the IP address: legitimate interest in being able to show that this consent was given, and in limiting abuse (art. 6(1)(f) GDPR), together with the duty to demonstrate consent (art. 7(1) GDPR) and to be able to account for the processing (art. 5(2) GDPR). The address is deleted 24 months after signup. Unsubscribing deletes the whole subscriber record, including the address, at once.

Legal basis for the country, the browser language, the time zone, the signup page, the referrer origin, the UTM values, and the device type: legitimate interest in sending the letter at a sensible hour and in understanding, in aggregate, which pages and devices the list comes from (art. 6(1)(f) GDPR). These fields are not used for advertising. You can object by writing to the contact address on this page.

A confirmed address that tries to subscribe again gets the same reply and no second record. A hidden field on the form is for bots. If it is filled, or if the form is submitted too quickly, we store nothing and show the same reply.

Unsubscribe, bounces, and complaints

Unsubscribing deletes the subscriber record. A permanent bounce or a complaint from the email provider does the same. In each case we keep a salted hash of the address, with the reason and the time, so a later signup does not add that address again. We do not keep the address itself in that record.

Legal basis: legitimate interest in honouring the unsubscribe and in keeping the list deliverable (art. 6(1)(f)), and the rule that commercial email must stop when the person opts out.

Copies of messages already prepared for sending can remain in an outbox record, and that copy includes the address. Unsubscribing does not delete those copies by itself. You can ask us to delete them.

Quizzes

A poll in the email is a set of links. Each link is signed and contains a hash of your email address, the quiz, and the option. Opening the link records that choice. We store the quiz, the option or options, and that hash. We do not store the address on the vote. A single-choice poll keeps the first choice and ignores a later click. A multi-choice poll adds choices until you open Done, or until every option has been chosen.

The totals are counts per option. The results in a later email and on the issue page are those counts, as percentages. The issue page keeps the quiz until a results file has at least one vote. It then shows the percentages. An empty tally is not shown.

Legal basis: consent, given when you subscribed and again when you open a choice. You can ask us to delete your vote. The aggregate count may already have been sent in a later issue.

Invites

When you confirm, we store an invite code derived from your subscriber id. The link is https://newsideas.app/invite/<code>/. If a new reader subscribes with that code, we store the code on their pending record. The first code on that record is the one we keep.

We add one to your count only after that reader confirms. We do it once. We do not count a reader whose email hash is the same as yours. The credit record stores the two internal ids and the time. It does not store a second copy of the addresses. The status page shows the count to someone who has the signed link from the welcome email.

Legal basis: consent of the new reader for their own subscription. For the referrer's count, legitimate interest in running the invite programme you used, and in refusing a self-referral. The count has no cash value. The terms say when we may remove a credit.

Abuse prevention and logs

Signup is limited to 5 attempts an hour for a salted hash of the IP address. Invite and status pages are limited to 30 an hour on a separate counter. The rate-limit record stores the hash, the start of the hour, and the count. It does not store the IP address. That record stays until it is overwritten or deleted. The subscriber record is separate: it stores the full IP address for 24 months, as the newsletter section says.

The signup forms and the deletion form also use Firebase App Check with reCAPTCHA Enterprise. The script loads when you focus or type in one of those forms, including if you declined analytics. It is there to limit scripted signups. It is not used for advertising or for Analytics. Google may set a cookie named _GRECAPTCHA for that check. The cookies page lists it. Confirm, unsubscribe, quiz, and invite-status links do not load it.

Our own log lines for a sent message contain the outbox id, the kind of message, and the subject. They do not contain the address. Google Cloud, which runs the functions, also writes request logs. Those logs can include an IP address and the URL. We have not set a custom retention. Google Cloud's default for that log bucket is 30 days.

Legal basis: legitimate interest in keeping the forms from being abused and in seeing whether a send failed (art. 6(1)(f)).

Who processes it for us

These providers process personal data for us, as processors under art. 28 GDPR:

• Google LLC. Firebase Hosting serves the pages. Cloud Functions run in europe-west1 (Belgium). Cloud Firestore, where the subscriber, quiz, invite, suppression, and outbox records live, is in the eur3 location (Europe). Google Analytics 4 counts pages and the actions listed above, only after you accept. Advertising signals stay denied. Event data is kept for 2 months and user-level data for 14 months. Firebase App Check with reCAPTCHA Enterprise runs when a signup or deletion form is used, to limit scripted signups. That check is separate from analytics.
• Mailgun Technologies Inc., part of Sinch. It sends the email from the EU region (the API host is api.eu.mailgun.net) for the domain nl.newsideas.app. Message content for that domain is processed in the EU. It also receives bounce and complaint notices, which we use to suppress an address.
• Cloudflare Inc. provides DNS for newsideas.app. It does not proxy the site. A lookup tells Cloudflare the name that was asked for and the address of the resolver that asked. It does not see which page you read.

YouTube is not a processor for this site. The Watch link on an issue is the only place this site sends you there. What YouTube does after that is under YouTube's own terms and privacy policy.

The country is derived on our servers from a GeoLite database created by MaxMind and bundled with the functions. That lookup does not send the IP address to a location service and does not add a processor. We do not share the signup record with anyone other than the processors named above.

We do not sell your data. We do not share it for anyone else's marketing. We disclose it where the law requires it.

International transfers

The newsletter records and the functions are in the EU, and Mailgun's EU region keeps the message content in the EU. Google LLC and Cloudflare Inc. are established in the United States. Where a processor in this list accesses personal data from the United States, the transfer relies on the EU-US Data Privacy Framework, where that company is certified, and on the European Commission's standard contractual clauses.

For how long

If you do not provide data

No data is required to read the site or to open a Watch link. If you decline analytics cookies, the site works the same way. Without an email address we cannot send the newsletter. Without the confirmation click we do not add you to the digest. A quiz and an invite are optional.

Automated decisions

We do not make a decision about you by automated means that produces a legal effect or a similar significant effect. A quiz result is a count of choices. It does not score you. An invite count does not grant money, access, or a different edition of the letter.

Your rights

You can ask for access, rectification, erasure, and restriction, and for a portable copy of data you provided (arts. 15, 16, 17, 18, and 20 GDPR). You can object to processing that is based on legitimate interest (art. 21). You can withdraw consent at any time. For the newsletter, the unsubscribe link does that. For analytics, Cookie settings in the footer does that. Withdrawal does not affect what was done before it.

Write to contact@newsideas.app. We reply within one month. If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (art. 77): garanteprivacy.it.

Minors

News & Ideas is not aimed at anyone under 16. We do not knowingly collect data from anyone under 16. If we learn that we have, we delete it.

Updates

When this text changes we publish the new version on this page and change the date at the top. If the consent sentence changes, the version stored with new signups changes with it. The terms are a separate page.