What Zotpaper keeps about you, and how to get rid of it.

Zotpaper is a newspaper written by software. It has no advertisers, no data brokers and no reason to know more about you than it needs to deliver the paper. This page lists everything it records, by where you meet it, who else handles it, and what you can ask of us. If you are in the EU or the UK, it is also our notice under the GDPR.

Who is responsible

Zotpaper is responsible for (the “controller” of) the data on this page. Write to editor@zot.news about anything here; a person reads it.

Reading the site

Without an account, nothing about you. Analytics are self-hosted, cookieless and aggregate: page counts, not people. Signed in, see your reading activity below. Market data, images and fonts are served from zot.news. The one outside script is Cloudflare Turnstile, a check that you are a person, which loads with the sign-up, sign-in and feedback forms when you are signed out.

Your timezone. Your browser’s timezone name (for example Europe/London) is kept in a cookie called zp_tz. If you have an account, we use it to send the newsletters and notifications at the time you chose in your own day, and at sign-up to know whether newsletters may start on (only in Australia, New Zealand and the US; everywhere else they wait until you ask). It is not used to track you, and it is just the zone name, not your location.

The newsletter

Subscribing creates an account. A reader and a subscriber are the same person, so they are the same record. Subscribing creates your account on the spot, without a password, and the code we email both proves the address is yours and signs you in. That is what gives you one place to change editions, add app notifications, or leave.

What we store. Your email address, which editions you chose, when you confirmed, and the IP address and browser you signed up from. The last two exist so we can show you asked for this if anyone ever claims otherwise.

What we measure. In Australia, New Zealand and the US each issue carries a tracking image, and everywhere its links pass through zot.news before reaching their destination. That tells us whether an issue was opened (only where the image is used) and which stories were clicked, per subscriber. Readers elsewhere, including the EU and UK, get no tracking image. We use it to see what lands, to notice when we’ve stopped reaching inboxes, and to stop emailing people who haven’t opened anything in months. We do not store the IP address of an open or a click.

Leaving. Every issue has a one-click unsubscribe that takes effect immediately and needs no sign-in. Unsubscribing keeps a record that you left so we don’t accidentally re-add you, and leaves the account in place so you can come back. Deleting the account removes everything (see below). Emails are sent through Resend (resend.com) from edition@zot.news.

A reader account

What we store. Your email address and name, a password hash if you chose one (most readers never do), or the identifier your sign-in provider (Apple, Google or GitHub) gives us and never their password. Your notification settings, and the articles you save.

How you sign in. We email a six digit code and a link, and either one signs you in. Both are single use and expire in ten minutes. A password is optional and second: you can set one, but you never need to.

What starts on. In Australia, New Zealand and the US a new account receives the Daily Edition at 7am on weekdays and the Research Digest at 7:30am on Fridays, your time, by email and in the app. Everywhere else, including the EU and UK, email waits until you ask: the “Get the Daily Edition” button at sign-up, or the switches on your account page. Every email has a one-click unsubscribe, and every setting, including the time, is on your account page. We record when you signed up, what you chose and which notice you saw.

What it’s for. Saving articles, and managing the newsletter and app notifications in one place. There is no separate subscriber list: your editions are switches on this account, alongside the app’s.

What we don’t do. We don’t use your account to personalise the paper: every reader gets the same edition. We don’t sell anything, and share only what this page lists.

The papers you open. Research papers are metered, so we remember which ones you have opened: your account, the paper, and when. Opening a paper you have already opened costs nothing, which is why this record exists, wherever you are. Subscribing removes the meter; deleting your account deletes these rows with everything else. What else is recorded about your reading, and where, is under your reading activity.

Paying for membership

On the web, payment is taken by Stripe (stripe.com), which handles your card and any sales tax or VAT; we never see or store card numbers. In the apps, Apple or Google take the payment the same way. We keep what we need to give you access: your plan, its status, when it renews or ends, and the payment provider’s reference for it. Payment records are kept for as long as tax law requires, even after you delete your account.

Your reading activity

Where it is on. For reader accounts in Australia, New Zealand and the US. It is off in the EU, the UK, and wherever we cannot tell where you are.

What is recorded. Which stories and papers you open and where from (the front page, a section, a notification, an email), how far down you read and for how long, what you save, share, follow or search for, which notifications and emails you open, and each step of the paywall and checkout. Not every tap or scroll: only those actions.

What it is for, and who sees it. To choose, time and improve what we send you and to see what is worth writing. It is first-party: recorded by zot.news into our own database, never sold, never shared with advertisers or analytics companies.

How long. The detail is kept for 90 days. After that only daily totals across all readers remain, with nothing that identifies you.

Opting out. Write to editor@zot.news from the address you sign in with to have it switched off for your account or what we hold deleted. Deleting your account deletes it too. Without an account, the site counts visits anonymously (above) and the apps record nothing.

If you came from an ad

We advertise Zotpaper on Reddit, X and Google. When you arrive by clicking one of those ads, the link carries the platform’s click identifier, which we keep for 30 days in a cookie of our own, zp_src, with the campaign tags on the link or the site that sent you. If you then make an account, our server tells that platform the ad led to a sign-up, and later to your first paid subscription and its price. It sends the click identifier and your email address hashed (SHA-256, so the platform can match it to an account it already knows but cannot read it), and with a sign-up reported to Reddit or X, the IP address and browser you signed up from. Each is reported once. There are no tracking pixels or ad scripts on zot.news, and nothing about what you read is sent. We do this only for readers in Australia, New Zealand and the US. Everywhere else, including the EU and the UK, where it would need your consent, nothing is sent; if you have asked us to switch off your reading activity, nothing is sent either.

Cookies

Cookies the site needs, set for everyone: zp_tz, your timezone (above); the sign-in cookie, if you sign in; zp_pass and zp_pass_at, when an ad link opens a paper for you; and zp_consent, which remembers your cookie choice.

The optional one is zp_src, where you came from (see If you came from an ad). In Australia, New Zealand and the US it is set without asking. Everywhere else, and wherever your browser’s timezone does not tell us, it is set only if you choose Accept, and Essentials only removes it. You can change your choice at any time with Cookie choice at the foot of every page.

The apps

Without signing in the app records nothing. It fetches the paper and keeps a copy on your device so it opens instantly.

Signed in, the app registers a push token with zot.news so we can send the notifications your account is set to receive: breaking news, the Daily Edition and the Research Digest, each one a switch on your account page. The token identifies your device to Apple’s or Google’s push service and nothing else; it is retired when you sign out, turn notifications off, or the device stops accepting them. The app carries no analytics or crash-reporting SDKs. The app version is recorded alongside the token so we know which builds are still in use. Where reading activity is on, the app also tells us which notifications you open and what you read.

Feedback you send

When you send feedback or report a problem with a story, on the site or in the app, we keep your message with the page or article you were on, the app version, your device type and display setting, and any screenshot you attach, so we can see what you saw. If you are signed in it is linked to your account so we can reply; if not, it carries only the email address you chose to give, if any. Messages are read by the people who run Zotpaper and are not shared. If you delete your account, your messages are kept but no longer linked to you.

Comments on papers

Comments on research papers are public under a name we give you (two or three words), never your own name or email. We keep each comment with your account, the paper, when it was posted and edited, the result of the automated check, any votes and any reports, so we can moderate them. Comments, votes and reports are deleted when you delete your account. How comments work: discussing papers.

Who else handles it

Only the companies we need to run the paper, each for its own part and nothing else:

• DigitalOcean: the server and database, in Sydney, Australia.
• Cloudflare: Turnstile, the check that a signed-out form is filled in by a person.
• Resend (USA): sends our emails, so it sees your address and the email.
• Stripe: card payments on the web.
• Apple and Google: app purchases and push notifications.
• Reddit, X and Google: only if one of their ads brought you, and only in Australia, New Zealand and the US: that the ad led to a sign-up or a subscription (see if you came from an ad).
• OpenRouter and the AI model makers it routes to: the text of a comment you post on a research paper is checked by an AI model before it appears. Nothing else about you is sent to an AI model.

None of them may use your data for anything but that service; for Reddit, X and Google that service is measuring our ads, under their own privacy policies. We do not sell or share data with anyone else.

Why we may hold it (the legal basis)

Running your account, delivering the paper and the app’s notifications, metering research papers and giving members access is the service you asked for (GDPR article 6(1)(b)). Newsletter email outside Australia, New Zealand and the US is on your consent (article 6(1)(a)), which you can withdraw at any moment from any email or your account page. Recording your reading activity is on your consent where consent is asked first, and otherwise in our legitimate interest in improving the paper you read, which you can refuse at any time by writing to editor@zot.news (article 6(1)(a) or (f)). Telling Reddit, X or Google that their ad brought you is in our legitimate interest in knowing which ads work, and is never done where consent is asked first (article 6(1)(f)). Keeping the IP address you signed up from and checking comments for abuse is in our legitimate interest in proving consent and keeping the paper safe (article 6(1)(f)). Payment records are kept because tax law requires them (article 6(1)(c)).

Outside the EU. Our server is in Australia, which the EU has not formally assessed as offering equivalent protection, and our email and payment providers are in the US. We send your data there because running the account you asked for needs it (GDPR article 49(1)(b)), and we keep it to what this page lists.

What you can ask of us

You can see everything we hold about you and take it with you: download your data (a JSON file, from your account page too). You can have it corrected, deleted (see below), restricted, or object to how we use it, and withdraw consent to email at any time. Write to editor@zot.news and we answer within a month. If you are unhappy with the answer you can complain to your data protection authority: in Spain the AEPD (aepd.es), in the UK the ICO (ico.org.uk), elsewhere in the EU your national authority.

Deleting your account

In the app: Account → Delete account. On the web: your account page → Delete account. It takes effect immediately and removes your account, sign-in links, saved articles, notification settings, push tokens, reading activity and your newsletter subscription. Because the account is the subscription, deleting it stops the email too: there is no second record left behind. Nothing waits on a support ticket.

Where it lives, who to ask

Everything is on a single server we run, in a database we control; backups are kept for 30 days and then gone. Questions or requests: editor@zot.news.

Last updated 24 October 2026.