Privacy Policy

Last updated: August 24, 2026

elsewhere ("we" or "us") takes your privacy seriously. This Privacy Policy explains what information we collect when you use elsewhere.news, why we collect it, who we share it with, and what rights you have over your data.

This is the initial version of this Policy and will evolve with the product. We will mark material changes prominently at the top of this page.

If you do not accept this Policy, please do not register on elsewhere.news; you can still browse public articles and podcasts without agreeing to this Policy.

1. Scope

This Policy applies to all visitors and registered users who access, register, sign in to, or use any feature of elsewhere.news via the web.

elsewhere.news is operated by Elsewhere News Limited (留得旌山在科技（香港）有限公司), a company incorporated in the Hong Kong Special Administrative Region of the People's Republic of China with registered office at Rm 701, Unit 108, 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Hong Kong; that entity is the data controller for the purposes of this Policy.

This Policy does not cover content creators who have joined elsewhere under a separate creator agreement. Creator-side data handling — including WeChat Open Platform compliance and translation licensing — is governed by that separate agreement and is not covered here.

2. Information we collect

2.1 Information you provide directly

  • Email signup: your email address and the password you set (we only store a salted hash; we never store plaintext passwords);
  • Google sign-in: when you choose Google, Google provides us with your email, name, and avatar URL;
  • Profile: the handle, display name, bio, and avatar image you set at /me.

2.2 Information generated automatically as you use elsewhere

  • Reading and interaction events: which articles or podcast episodes you have viewed, played, or liked — aggregated per content item (first-seen time, last-seen time, cumulative count) in the user_content_views table;
  • Search, Q&A, and persona queries: the queries you type into /search, the questions you submit at /ask, and the messages you send in creator-persona conversations (/<creator>/chat);
  • Basic access logs: IP address, browser type, request time — recorded by the hosting platform (Vercel) for security defence and incident investigation, not for personal profiling;
  • Cookies and browser storage: the authentication cookie used when you sign in, the language preference you deliberately choose, and small interface-state values stored locally in your browser, such as theme and temporary session state.
  • Interactive-exam answers: when you answer the AI application midterm exam, we store your current answer to each question, including text you type. Anonymous answers remain unlinked to an elsewhere account and use a dedicated random first-party cookie for same-browser recovery. If you sign in, your answers are linked to your account solely so you can claim an anonymous answer sheet and restore it across devices. Answers and private text are not made public or sent to model-processing pipelines. For abuse prevention, the server turns your IP address into a purpose-specific HMAC rate-limit bucket; the raw IP is not written to the exam database or application logs.

2.3 Content you post publicly

If you participate in the topic community (proposing topics, voting, commenting), that public content is shown alongside your handle.

3. How we use this information

  • Core service: registration, sign-in, persisting your reading history and interactive-exam answers, including optional account recovery, and generating search and Q&A results;
  • Personalisation: surfacing your own consumption history back to you at /me/context;
  • Service improvement: aggregated, de-identified analytics (e.g. which content categories perform best, where retrieval is failing) — not used to identify any specific individual;
  • Security and compliance: anomaly detection on sign-in, abuse defence, retention and disclosure required by applicable law.

We do not: sell your personal data to third parties; train our own large language models on your search, Q&A, or persona-conversation content; show you targeted ads via any ad network.

4. Who we share information with (sub-processors)

To run elsewhere we use the following third-party services and share data with them only to the extent necessary:

  • Supabase — database and authentication infrastructure. Data involved: registration data, profiles, reading history, and interactive-exam answers — essentially all our business data.
  • Vercel — hosting and edge runtime. Data involved: access logs, IP addresses.
  • Google (only if you sign in with Google) — OAuth identity. Data involved: email, name, avatar (provided by Google to us).
  • Moonshot (Kimi LLM) — handles search and Q&A queries to generate results. Data involved: your search keywords or question text.
  • Creators you choose to contact (opt-in, not a sub-processor) — if you fill in the contact card during a creator-persona conversation and tick the consent box, we forward your contact details together with the content of that conversation to that creator, one way, so they can follow up with you. Nothing flows back to you automatically.

Your queries are sent to Moonshot to generate results; please refer to Moonshot's own privacy policy for how they handle data on their platform. We currently do not train our own models on your query content.

We do not proactively share your data with third parties beyond the list above. Where disclosure is required by law (for example, a valid law-enforcement request), we comply with that law and notify you to the extent permitted.

Separately, a creator whose persona you converse with can review those conversations in their studio in de-identified form — the conversation content, without your account, email, or profile attached — to monitor and improve the persona. Your identity is attached to a conversation only if you choose to leave your contact as described above.

5. Cookies and browser storage

We currently use only first-party cookies and browser storage needed to provide features you request:

  • Supabase authentication cookies: maintain your sign-in session and protect authenticated features. They are set when you sign in; blocking them prevents account features from working.
  • NEXT_LOCALE: remembers Chinese or English for up to 12 months, and is written only when you deliberately use the language switcher. Without it, an unprefixed elsewhere URL follows your browser-language preference.
  • Interactive-exam cookie: a random, signed, HttpOnly first-party identifier used only to restore the same browser's anonymous exam answers and, after sign-in, to claim that browser's anonymous answers into the account answer sheet. It has a rolling lifetime of up to 12 months. Clearing it makes that browser a new anonymous participant; it contains no answer text, account identifier, or IP address.
  • localStorage: remembers your light/dark theme and a small amount of interface state on your device until you clear it.
  • sessionStorage: holds temporary interface state and prevents duplicate interaction events within the same browser tab; it is normally cleared when that tab or browser session ends.

Interactive-exam answers and text drafts are not stored in localStorage, sessionStorage, IndexedDB, service-worker caches, or URLs. We do not currently use third-party analytics cookies, advertising cookies, or cross-site behavioural tracking, and these technologies are not used to build advertising profiles. You can remove or block first-party cookies in your browser, but sign-in, saved preferences, and exam-answer restoration may stop working.

If we later introduce non-essential analytics, advertising, or similar device storage, we will update this notice and, where required, ask for consent before enabling it.

6. Data location and cross-border transfer

elsewhere's core infrastructure (Supabase, Vercel) is hosted in the United States; data covered by this Policy is processed and stored on US servers.

In addition, when you use the search (/search), Q&A (/ask), or creator-persona chat (/<creator>/chat) features, the text you submit is also transmitted to Moonshot (Kimi LLM) infrastructure located in the People's Republic of China for large-language-model processing. This is a technical requirement of those features; if you do not want your text transmitted to Moonshot, please refrain from using search, Q&A, and persona chat (other features such as browsing articles and podcasts are not affected).

We take reasonable technical measures, including encryption in transit, to protect your data. By registering and using the site you acknowledge and consent to the data processing and cross-border transfers described above.

7. Data retention

  • Account information: retained until you delete your account;
  • Reading and interaction events: retained until you delete your account; also deleted when the underlying content is removed;
  • Search and Q&A query logs: currently retained for 365 days, then aggregated and de-identified;
  • Interactive-exam answers and identifiers: anonymous answers are retained while that web exam remains public. Signed-in answers are also deleted, together with their private text, when the linked account is deleted. If we explicitly retire the web exam, its remaining private text, identifiers, and current answers are deleted within 30 days. Removing or taking down the related WeChat post does not itself retire the web exam;
  • Persona conversations and contact you forward: a persona conversation is stored like your other Q&A history; if you leave your contact for a creator, that consent record and the forwarded contact are retained as proof of the disclosure you authorised, and are also held by the creator under the separate creator agreement;
  • Access logs: retained by Vercel under their default policy, typically no longer than 30 days.

8. Your rights

You can at any time, from /me:

  • View your profile, reading history, and credit ledger;
  • Edit your handle, display name, bio, avatar, and password;
  • Export your reading history (in development; planned ship in the current cycle);
  • Delete your account — once deleted, data directly tied to you (including your profile, reading history, account-linked exam answers and their private text) is removed from our active database; public UGC such as topic posts and comments are kept but disassociated from your identity. Contact details you have already chosen to forward to a creator cannot be recalled — the creator has already received them; deletion stops further processing on our side but does not retract a completed forward.

If self-service does not cover your need, reach us at the email at the bottom of this page.

Regional rights: If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the GDPR / UK GDPR, including access, rectification, erasure, portability, restriction of processing, and objection. If you are a California resident, you have rights under the CCPA / CPRA, including the right to know and the right to deletion; we expressly confirm that elsewhere does not sell your personal information and does not use it for cross-context behavioural advertising. As a Hong Kong-incorporated operator, elsewhere is also subject to the Personal Data (Privacy) Ordinance (PDPO); you may submit data-access or correction requests under the PDPO via the email below.

9. Children

elsewhere does not offer services to children under 13 and does not knowingly collect personal information from children under 13. If you are the guardian of a child under 13 and discover your child has shared personal information with us, please contact us at the email below to request deletion.

10. Data security

Technical and organisational measures we take include: site-wide HTTPS, bcrypt password hashing, row-level security (RLS) at the database, server-side audit logging, and regular backups. That said, no internet service can guarantee 100% security — please keep your account credentials safe.

11. Changes to this Policy

We may update this Policy from time to time. Material changes — for instance, expanding the purposes of data use or adding new third-party sub-processors — will be brought to your attention prominently at the top of this page, with reasonable lead time before the change takes effect.

12. Contact

For any questions about this Policy or your data, please email info@elsewhere.news.