Privacy policy

The short version

• You can read everything on Marble without giving us anything.
• If you sign up, sign in, make a watchlist or write to us, we keep what you give us and use it only for that.
• We don’t sell or share your data, run advertising, or use analytics or tracking tools.
• You can see, change or delete what we hold at any time.

Who we are

Marble (“we”, “us”) runs this website, which is based in Australia. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). For anything in this policy, contact us.

What we collect

Only when you use a feature that needs it:

• Today and accounts. Your email address; when you signed up and the page you signed up on; the website that sent you there (its address only, never the full link); your country, worked out from your connection rather than your location; the exact consent wording you agreed to; and when you confirmed, signed in or unsubscribed.
• Signing in. A one-use sign-in code while it’s valid, and for each device you sign in on, a session that we store only as a scrambled code we can’t turn back into the original.
• What you follow. The names and sections you follow. When you’re signed out these stay in your own browser and never reach us; when you’re signed in they’re saved to your account so they work on every device.
• Watchlists. The name you give a watchlist, the words you watch and, if you ask for email alerts, the address to send them to.
• Messages. If you use the contact form: your name, email address, organisation if you give one, the topic and your message.
• Pro, if you buy it. Which plan you’re on and until when, how you paid (the website or the App Store), and for website payments the customer and subscription reference Stripe gives us and the subscription’s status. Whether you’ve turned Pro alerts off.
• Counts that aren’t about you. How quiz answers were spread, and how many visits arrived from each kind of place (TikTok, Instagram, search, a link someone shared, another site, or directly) and on which page, and how many times something was shared from Marble and of what kind. These are daily totals, not linked to anyone.

We don’t collect your name unless you give it in a message, and we never ask for your date of birth, phone number or address. We never see your card details: Stripe takes payment for Pro on the website, and Apple in the app.

The Marble app

The iPhone app reads the same stories as the website. Using it doesn’t need an account, and it has no advertising, analytics or tracking tools.

• Kept on your phone only. Your region, what you follow, stories you’ve saved or opened, your recent searches and copies of pages for reading offline. Deleting the app deletes them.
• An account, if you make one. Your email address, so we can send you a six-digit sign-in code, and the follows and saved stories you choose to keep with it, so they come back on a new phone. An account made in the app isn’t signed up to Today; you can turn Today on from the account screen if you want it. Your session is kept in your phone’s secure storage (the iOS Keychain).
• Notifications, if you turn them on. A notification token (a random code from Apple that lets us send to your phone, via Expo’s notification service), your region and what you follow, so we know which alerts to send. Turn notifications off in the app or in iOS Settings and we stop.
• Pro in the app, if you buy it. Apple takes the payment. RevenueCat checks the purchase with Apple and tells us which plan your account has and until when; it knows your account by a random account number, not your email address. Cancel or change the subscription in iOS Settings, under your Apple ID and Subscriptions.
• Deleting your account. In the app, open More, then your account, then Delete account. Your email address, sessions, follows and saved stories are deleted straight away.

Information collected automatically

Like every website, the servers that deliver Marble receive your IP address and browser details with each request. Our hosting provider keeps these in short-lived logs to run and secure the service. We also hold IP addresses briefly in memory to stop people flooding the sign-up and contact forms; they aren’t written to our database.

When you open a story, your browser loads the newsroom’s photo directly from that newsroom’s website, so that newsroom receives your IP address in the same way. Freely licensed photos may load from Wikimedia. Following a link to an article takes you to that newsroom’s site, under its own privacy policy.

Cookies and browser storage

We don’t use advertising or tracking cookies. Visits are counted without cookies (see Vercel below). We use your browser’s storage for these things only:

• Sign-in cookie (wc_session): set only when you sign in, keeps you signed in for up to 180 days, and is deleted when you sign out.
• What you follow: your list of follows, kept in your browser.
• Sign-up reminders: whether you’ve signed up for Today or dismissed the invitation, and how many pages you’ve viewed this visit, so we don’t ask too often or ask twice.
• Visit counted: a note that this tab’s visit has been counted, so it’s counted once. It lasts until you close the tab.
• Region (wc_news): set only if you pick Australian or US news first in the menu (everyone starts on All). It holds only that choice and lasts a year.
• New since your last visit: when you were last here, kept in your browser, so we can mark stories that are new to you. It never reaches us.
• Arrived from a shared link: if a friend’s link brought you here, the date, kept in your browser. If you come back a week or more later, we add one to a daily count of readers who came back. Nothing else is sent.
• Staff sign-in: a cookie for our own editors’ desk, never set for readers.

Clearing your browser’s storage removes all of it. You’ll need to sign in again, and follows saved only in that browser will be gone.

How we use it

• To send Today, sign-in links and the alerts you asked for.
• To keep your follows and watchlists, and show you the stories that match them.
• To reply to your messages.
• To keep a record of your consent and of any unsubscribe, so we can prove we only email people who asked and never email people who stopped.
• To see, in total, which sign-up forms work, by counting sign-ups by the page they came from.
• To keep the service secure and stop abuse.

Email

Today only starts after you confirm your address. Every email we send has a one-click unsubscribe link, and you can turn Today off from your account. Sign-in links and alerts you set up are sent when you ask for them. We comply with the Spam Act 2003 (Cth).

Who handles it for us

We use these service providers to run Marble. They process information only on our instructions and only to provide their service:

• Supabase: our database, where the information above is stored.
• Vercel: hosts the website and delivers its pages, and counts visits with Vercel Web Analytics, which uses no cookies and doesn’t identify you or follow you to other sites.
• Fly.io: runs the system that reads news feeds and sends email.
• Resend: delivers our emails.
• Stripe: takes payment for Pro on the website. It receives your email address and card details directly; we never see the card.
• Apple and RevenueCat: Apple takes payment for Pro in the app; RevenueCat checks those purchases and tells us which plan your account has. RevenueCat receives your random account number and Apple’s purchase records, not your email address.
• Expo: delivers the app’s notifications to Apple, using the notification token. It receives the alert’s text, not your email address.
• Cloudflare: stores copies of freely licensed photos. It holds no personal information.
• Anthropic: we send it news headlines to help put together our daily video. We never send it personal information.

Some of these providers store or process information outside Australia, including in the United States. We choose providers that protect it to a standard comparable with the Australian Privacy Principles.

We don’t sell, rent or trade personal information, and we don’t share it with advertisers. We’d only disclose it if the law required us to.

How long we keep it

• Sign-in codes stop working after 30 minutes (15 in the app) or once used; sessions expire after 180 days or when you sign out.
• Your account, follows and watchlists are kept until you delete them or ask us to.
• Messages are kept for as long as we need them to deal with what you wrote about.
• If you unsubscribe, we keep your address and the date so we never email you again by mistake. Ask us to delete it entirely and we will, though that removes the record that stops future emails.

Your choices and rights

You can ask to see the personal information we hold about you, to correct it, or to delete it. Contact us from the address concerned and we’ll respond within 30 days. Signed-in readers can also see their email, follows and Daily setting on their account page, and unfollow or turn off Today there.

If you’re in the European Union or the United Kingdom, you have the same rights under the GDPR, along with the right to object and to take your information elsewhere; we rely on your consent for email and on our legitimate interest in running a secure service for the rest.

If you’re in California or another US state with a privacy law, you have the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing. We don’t sell or share personal information, for money or for advertising, and we don’t use it to build profiles about you. We won’t treat you differently for using these rights.

Security

Information is sent over encrypted connections and stored with providers who protect it. Sign-in codes are single-use and short-lived, and sessions are stored only in scrambled form. No system is perfectly secure; if a breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner, as the law requires.

Children

Marble isn’t designed for children. Please don’t sign up if you’re under 16.

Complaints

If you’re unhappy with how we’ve handled your information, tell us and we’ll respond within 30 days. If you’re still not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If we change how we handle personal information, we’ll update this page and the date at the top. If a change matters to people on our list, we’ll tell them by email before it takes effect.