The short version
No account is required to read. The launch edition has no behavioural advertising, cross-site tracking or personal fingerprinting. Data collection is limited to operating the service, protecting it and fulfilling your request.
What we collect
If you use newsletter or contact forms, we may store email, supplied name, topic, message, language preference, consent time and status. Security logs may briefly contain request time, route, response status and provider network signals; passwords, tokens, full headers and message bodies are not logged.
If you choose current-location weather, the browser rounds latitude and longitude to two decimal places before sending them to PATA's same-origin weather route. The rounded city-level coordinates can appear briefly in request logs and cache keys and are forwarded to MET Norway; PATA does not store them in the newsroom database.
What stays on your device
Bookmarks and the movie watchlist stay in your browser localStorage. Reading size applies only while the current page is open and is not stored in localStorage. Admin sign-in requires a Secure, HttpOnly session cookie; it is not a reader-tracking cookie. You can clear local preferences through browser settings.
External services
Weather, sport, market, earthquake, prayer-time, development and movie metadata are fetched server-side from named providers. Your browser does not send personal queries directly to those APIs. Editorial images may come from Unsplash or approved Supabase storage; every live panel identifies provider and delay.
Resend receives an email address to deliver confirmation and future PATA letters. Supabase stores contact and subscription records; when enabled, Upstash receives a one-way-hashed abuse-control key and short-lived counter. Each provider's privacy and retention terms also apply.
Retention and security
Reader analytics collection is currently disabled and will not be enabled without a lawful consent basis and retention job. Unconfirmed newsletter links expire after 48 hours. TLS, row-level security, least privilege and MFA are implemented in code and schema; production backups, retention cleanup and restore tests are deployment gates and are not claimed active until verified.
Your choices and rights
Use the contact form with the privacy topic to request a copy, correction or deletion of information you submitted. Some records may be retained where law, the public-interest editorial record or legitimate security needs require it; the reason will be explained.