What PIE knows about you, and what it doesn't.

Email address (for sign-in and digest delivery). Lens declarations (the dial on /lens). Subscriptions (the topics you've subscribed to). Reading record (which stories you opened, in your account only — never aggregated, never displayed elsewhere). Skip / set-aside record (Phase 8.5, same scope). Inferred lens drift (Phase 8.5; observational, not used to filter). Magic-link tokens (15-minute lifetime, single-use, deleted on use). Highlights and the private notes you attach to them (see section 05).

Resend sends our email — they receive your address and the body of any message we send you, and nothing else. Anthropic, Google Vertex, xAI run the language models that draft framings — they receive outlet text only, never reader data. Voyage embeds outlet coverage for clustering — same scope, no reader data. Google Cloud hosts the database. That's the list.

One cookie, for sign-in session. No analytics cookies. No advertising cookies. No “consent banner” because there is nothing to consent to beyond keeping you signed in.

Unsubscribe (per-email link, immediate). Sign out (anywhere). Delete account — email hello@pie.news; we soft-delete for 30 days then hard-delete. The sources page lays out our editorial choices in the same plain register.

When you mark a fact, framing, or steelman as worth remembering, we store the passage you marked, the entity it's anchored to, the time you saved it, and any private note you attach. The full set lives at /notebook, visible only to you. We do not project it into any public surface, do not share it with subprocessors, and do not use it to train any model. When you delete your account, we delete your highlights and notes with the rest of your data; we don't currently offer an export on the way out — if that matters to you, write to hello@pie.news.