Privacy Policy

Last updated: May 29, 2026

elsewhere ("we" or "us") takes your privacy seriously. This Privacy Policy explains what information we collect when you use elsewhere.news, why we collect it, who we share it with, and what rights you have over your data.

This is the initial version of this Policy and will evolve with the product. We will mark material changes prominently at the top of this page.

If you do not accept this Policy, please do not register on elsewhere.news; you can still browse public articles and podcasts without agreeing to this Policy.

1. Scope

This Policy applies to all visitors and registered users who access, register, sign in to, or use any feature of elsewhere.news via the web.

elsewhere.news is operated by Elsewhere News Limited (留得旌山在科技（香港）有限公司), a company incorporated in the Hong Kong Special Administrative Region of the People's Republic of China with registered office at Rm 701, Unit 108, 7/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Hong Kong; that entity is the data controller for the purposes of this Policy.

This Policy does not cover content creators who have joined elsewhere under a separate creator agreement. Creator-side data handling — including WeChat Open Platform compliance and translation licensing — is governed by that separate agreement and is not covered here.

2. Information we collect

2.1 Information you provide directly

  • Email signup: your email address and the password you set (we only store a salted hash; we never store plaintext passwords);
  • Google sign-in: when you choose Google, Google provides us with your email, name, and avatar URL;
  • Profile: the handle, display name, bio, and avatar image you set at /me;
  • Invite codes: the invite code string you used to register, plus the credits granted as a result.

2.2 Information generated automatically as you use elsewhere

  • Reading and interaction events: which articles or podcast episodes you have viewed, played, or liked — aggregated per content item (first-seen time, last-seen time, cumulative count) in the user_content_views table;
  • Search and Q&A queries: the queries you type into /search and the questions you submit at /ask;
  • Basic access logs: IP address, browser type, request time — recorded by the hosting platform (Vercel) for security defence and incident investigation, not for personal profiling;
  • Preference cookies: your interface language (Chinese / English) and theme (light / dark) choices.

2.3 Content you post publicly

If you participate in the topic community (proposing topics, voting, commenting), that public content is shown alongside your handle.

3. How we use this information

  • Core service: registration, sign-in, persisting your reading history, generating search and Q&A results;
  • Personalisation: surfacing your own consumption history back to you at /me/context;
  • Service improvement: aggregated, de-identified analytics (e.g. which content categories perform best, where retrieval is failing) — not used to identify any specific individual;
  • Security and compliance: anomaly detection on sign-in, abuse defence, retention and disclosure required by applicable law.

We do not: sell your personal data to third parties; train our own large language models on your search or Q&A content; show you targeted ads via any ad network.

4. Who we share information with (sub-processors)

To run elsewhere we use the following third-party services and share data with them only to the extent necessary:

  • Supabase — database and authentication infrastructure. Data involved: registration data, profiles, reading history — essentially all our business data.
  • Vercel — hosting and edge runtime. Data involved: access logs, IP addresses.
  • Google (only if you sign in with Google) — OAuth identity. Data involved: email, name, avatar (provided by Google to us).
  • Moonshot (Kimi LLM) — handles search and Q&A queries to generate results. Data involved: your search keywords or question text.

Your queries are sent to Moonshot to generate results; please refer to Moonshot's own privacy policy for how they handle data on their platform. We currently do not train our own models on your query content.

We do not proactively share your data with third parties beyond the list above. Where disclosure is required by law (for example, a valid law-enforcement request), we comply with that law and notify you to the extent permitted.

5. Cookies

We use three categories of first-party cookies only:

  • Necessary cookies: the HttpOnly Supabase sign-in session, and a short-lived invite cookie el_invite (5-minute TTL) — disabling these will prevent sign-in;
  • Preference cookies: storing your interface-language and theme choice;
  • No tracking cookies: we do not currently use any third-party tracking or advertising cookies.

6. Data location and cross-border transfer

elsewhere's core infrastructure (Supabase, Vercel) is hosted in the United States; data covered by this Policy is processed and stored on US servers.

In addition, when you use the search (/search) or Q&A (/ask) features, the query text you submit is also transmitted to Moonshot (Kimi LLM) infrastructure located in the People's Republic of China for large-language-model processing. This is a technical requirement of those two features; if you do not want your queries transmitted to Moonshot, please refrain from using search and Q&A (other features such as browsing articles and podcasts are not affected).

We take reasonable technical measures, including encryption in transit, to protect your data. By registering and using the site you acknowledge and consent to the data processing and cross-border transfers described above.

7. Data retention

  • Account information: retained until you delete your account;
  • Reading and interaction events: retained until you delete your account; also deleted when the underlying content is removed;
  • Search and Q&A query logs: currently retained for 365 days, then aggregated and de-identified;
  • Access logs: retained by Vercel under their default policy, typically no longer than 30 days.

8. Your rights

You can at any time, from /me:

  • View your profile, reading history, and credit ledger;
  • Edit your handle, display name, bio, avatar, and password;
  • Export your reading history (in development; planned ship in the current cycle);
  • Delete your account — once deleted, data directly tied to you (profile, reading history, invite code) is removed from our active database within 30 days; public UGC such as topic posts and comments are kept but disassociated from your identity.

If self-service does not cover your need, reach us at the email at the bottom of this page.

Regional rights: If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the GDPR / UK GDPR, including access, rectification, erasure, portability, restriction of processing, and objection. If you are a California resident, you have rights under the CCPA / CPRA, including the right to know and the right to deletion; we expressly confirm that elsewhere does not sell your personal information and does not use it for cross-context behavioural advertising. As a Hong Kong-incorporated operator, elsewhere is also subject to the Personal Data (Privacy) Ordinance (PDPO); you may submit data-access or correction requests under the PDPO via the email below.

9. Children

elsewhere does not offer services to children under 13 and does not knowingly collect personal information from children under 13. If you are the guardian of a child under 13 and discover your child has shared personal information with us, please contact us at the email below to request deletion.

10. Data security

Technical and organisational measures we take include: site-wide HTTPS, bcrypt password hashing, row-level security (RLS) at the database, server-side audit logging, and regular backups. That said, no internet service can guarantee 100% security — please keep your account credentials safe.

11. Changes to this Policy

We may update this Policy from time to time. Material changes — for instance, expanding the purposes of data use or adding new third-party sub-processors — will be brought to your attention prominently at the top of this page, with reasonable lead time before the change takes effect.

12. Contact

For any questions about this Policy or your data, please email info@elsewhere.news.