Privacy

A newspaper does not need to know much about its readers, and neither does arXane.

Who is responsible

arXane is run by Luca Giunti, a private individual in Italy, who is responsible (the "data controller") for the personal data described on this page. For anything about your data, write to [email protected].

Reading without an account

arXane sets no cookies unless you sign in, uses no third-party analytics (we count visits ourselves, from the server log below) and loads nothing from other websites: fonts and scripts come from arXane's own server. Your searches are kept in the page address. Your browser keeps your categories, so arxane.org opens your newspaper next time, and your appearance settings (theme, day or evening, article text size, layout and whether cross-lists start open) and whether you folded away the tools at the foot of the newspaper; they stay on your device.

Every request passes through Cloudflare, which protects the site from attacks and caches its files. Cloudflare sees your IP address and, when it needs to check that a visitor is not a bot, may set a short-lived security cookie (such as __cf_bm or cf_clearance). These cookies are needed for security and are not used to follow you around the web.

Our server logs each request: your IP address, the address asked for (without any search words), the time, your browser's name and the page you came from. We use the log only to keep the site running and to stop abuse, which is our legitimate interest (Article 6(1)(f) GDPR). It is deleted after 15 days, and the copies in the server's backups are gone within a further 7 days. From it we also count, each day, how many people visited and which pages and sections they opened; only these totals are kept, never an address. A few actions (trying a theme, making your newspaper, opening it again, copying a feed address, staying on a page for half a minute, coming back on another day) send a small request of their own, so they show up in those totals; it carries nothing about you. To know you came back, your browser keeps the date of your last visit; the date itself is never sent, only whether it was within the last week.

With an account

• What we store: your email address, your name if you sign in with Google, when you made the account and when you last signed in, the categories you saved, the searches you saved as keywords (at most three, with where to search) and your appearance settings (theme, day or evening, paper tint, article text size, density, layout, cross-lists open or folded). Saved keywords are kept only because you asked for them; Forget in the search panel deletes one. Your browser also keeps a copy of your appearance settings, so the page opens in your theme.
• Google sign-in: we receive your email address and name from Google and store Google's account identifier to recognise you next time. We do not access anything else in your Google account. Google handles the sign-in under its own privacy policy.
• Email sign-in: we store your address with the link's token, the token only in hashed form. The link expires after 15 minutes and the record is deleted within two days. If someone else typed your address, ignore the email: no account is made unless the link is used.
• Session: one signed, HttpOnly cookie keeps you signed in for 30 days; signing out deletes it. During Google sign-in a second cookie holds a one-time check for ten minutes. Both are strictly necessary, so they need no consent.

We keep this for as long as you have an account. We use it only to provide the service you signed up for (Article 6(1)(b) GDPR).

Authors of papers

The newspaper shows each paper's authors as they appear in arXiv's public metadata. That is the point of the newspaper: our legitimate interest, and readers', in the day's research (Article 6(1)(f) GDPR). The names come from arXiv, not from the authors. Past editions are deleted from our server after a week. To correct a name, change it on arXiv and the next edition will follow; to object, write to us.

Writing to us

Email to [email protected] is forwarded by Cloudflare to our own mailbox. We keep messages as long as we need them to deal with what you asked, and delete them within two years.

Who else handles data

These services process data for us, on our instructions, under data processing agreements:

• Hetzner (Germany) hosts the server, in Nuremberg.
• Cloudflare (USA) carries every request, as described above, and forwards email sent to our contact address.
• Resend (USA) sends the sign-in emails.

Where data leaves the European Union, those agreements rely on the EU's standard contractual clauses or the EU–US Data Privacy Framework.

These services are separate. Each is responsible, under its own privacy policy, for what you give it:

• Google (USA), only if you choose to sign in with Google.
• Buy Me a Coffee (USA), only if you choose to give.

Gifts

The Buy me a beer button is a plain link: nothing from Buy Me a Coffee loads on arXane until you click it. If you give, you do so on Buy Me a Coffee's own site and arXane never sees your card details. Buy Me a Coffee shares with us the name you give, your email address, any message you write and the amount, and for a monthly gift, its amount and schedule. We keep these to answer you and to be able to show, if a tax authority asks, that they were gifts. That is our legitimate interest (Article 6(1)(f) GDPR). We keep them until the end of the seventh year after the gift.

Backups

The database is copied every night and each copy is kept for 14 days. Hetzner also backs up the whole server daily and keeps each backup for 7 days. When you delete your account, it is gone from the live site at once and from every backup within a month.

What we do not do

No tracking pixels, no advertising, no profiling, no sale or sharing of data, and no reading history beyond the short-lived server log described above.

Your rights

You can ask to see the data we hold about you, to correct it, to receive a copy, to have it deleted or its use restricted, and you can object to how it is used. Write to [email protected] and we will answer within a month. If you think we have handled your data wrongly, you can complain to the Garante per la protezione dei dati personali (garanteprivacy.it) or to the data protection authority where you live or work.

Deleting your account

Signed in, open the menu with your name at the top of the page and choose Delete account: the account, its preferences and saved keywords, and any pending sign-in links are deleted at once. You can also write to us from the address on the account, and we will do it for you and confirm by email.

Last updated 5 October 2026.