Legal

Privacy

Last updated 11 October 2026

allnoos is a news platform, so most of what you make here is meant to be seen. This page is the plain version of what that means: what we collect, where it sits, who else touches it, how long it stays, and how to get rid of it. If anything below is unclear, email support@allnoos.com and ask.

What we collect

Only what the product needs to work. In full:

• Your account. An email address and a password. The password is hashed by our authentication provider and we never see it. At sign-up you also pick a username and confirm you are 18 or older, and we note when you did. Every account starts free; if you came to sign-up from a plan on the website’s Accounts page, the plan you picked is noted too, and nothing is charged.
• Your profile. Whatever you choose to fill in — display name, avatar, bio, an “about” note, specialty, location, website — plus counts we keep for you: followers, following, stories filed and total views. A station or broadcast account can also add a business address; the app asks the phone to turn it into a point on the map, and both are public.
• What you publish. Story headline and text, the place and event name you attach, the photos and video you selected, the credits and tags you add, which of your stories you pin to your profile, and when it was filed. Arcs — the short clips and photos you post to your profile picture — too.
• What the News Room keeps. Each draft the News Room writes for you and the edits you make to it, and a short text profile of how you edit, so later drafts sound more like you. Nobody else can read either, and both go with your account.
• What you do here. Comments, likes, the smile or frown you give a comment, follows, the reporters and stories you block or mute, reports you file against a story, a comment, an arc or an account, Gather messages and the screenshots you send in them, and the notifications generated for you when someone likes, comments on, or follows your work.
• What you read. When you are signed in and open someone else’s story, we record your account, the story, the day and the language you read it in — once per story per day. That record is what makes a view count once a day, and it lets a report from someone who opened a story weigh more than one from someone who never did. Nobody can read it through the app or the website — not the reporter, not other readers; only our own server works with it, and a reporter sees a total, never names. Reading without signing in is not recorded or counted at all. The arcs you have watched are recorded too, so the ring around a profile picture knows what is new; only you can read that.
• What you share. When you send a story to X, Facebook, Instagram, Messages or TikTok from its share row, we record your account, the story, where you sent it and when, once per story, so its share count goes up once. Like the view record, only our own server reads it.
• Sponsored stories. An account can set one of its own stories to run as an advertisement, paying its budget up front from its wallet. The ad market is not live yet: today a campaign exists only on the phone or browser that set it up, until the app or page is closed, and it is shown to nobody else, so no other reader’s viewing is recorded or charged for it. Before campaigns reach other readers, this page will say what that records.
• Money records. Your wallet is a double-entry ledger, so every deposit and every spend is a stored record, alongside promos, comment boosts, sponsorships, bounties and any withdrawal request you file.
• Your agreements. Which version of the terms you agreed to, the reporter’s accord you agree to before first opening the camera, and your agreement to allnoos sharing your material with Gemini (Google’s AI) and any withdrawal of it: which version, when, and from which app or the website — kept as the record that you did.
• Your profile photo. On a Free or Journalist account it is taken with the allnoos camera, in the app or on this site, and nowhere else — that is how every face here is a real one. It is stored as two files: a still, and a clip of about three seconds that plays once in a while where your picture appears. Both are public, like the still has always been. Retaking it replaces both; deleting your account deletes both when the deletion completes. After you save it, the still (never the clip) is shared with Gemini (Google’s AI) to check it against our standards (described below), with the location, camera and other details stored inside the file removed first. A photo that breaks them is taken off your profile and its files are deleted, unless the law requires us to keep them; you are told, and you can take a new one.
• A Station or Broadcast account’s profile picture. These accounts upload their picture — a logo works best — instead of taking it with the camera, and it is checked before anyone else sees it. Until the check approves it, the file waits in a private folder that only the account and our server can read, and everyone else sees a plain placeholder (an account that was already Station or Broadcast before this check began keeps its earlier picture until it uploads one). The copy shared with Gemini (Google’s AI) for the check (described below) and the copy that is published have the location, camera and other details stored inside the file removed. An approved picture is public, like any profile photo. A refused file is deleted at once, unless the law requires us to keep it: a file kept that way is taken out of the account’s reach and kept with the record of its check. A file that was never checked, or whose check could not finish, stays in the private folder until another picture is sent or approved, or the account’s deletion completes.
• The camera and microphone. The app uses them only on its own camera screens: filming a story or an arc, or taking your profile photo.
• Where you were filming. When you capture something in the app, your phone is asked once for its position, and the phone’s own maker turns that position into the name of the place it is in: Apple on an iPhone, Google on an Android phone. Two things come out of it. A place — the city and country, never a street, and, where it can be named, the state or province the city is in — is published with the story, because a report nobody can place is not much of a report. The state or province is taken from the place name your phone gives, or from the city itself, never worked out from your exact position, so it never says more than the city on the story already does. If the place name has no city in it, only the country is published, with no state or province. If no place name comes back, nothing is published: no city, no country, no state. The exact position is stored separately and is readable by you and nobody else: not other reporters, not readers, not a search engine. What everyone else sees is a scene — the middle of a circle drawn around everyone who filed from that place and hour, rounded to about a hundred metres. You can refuse. If you do, your story publishes with no place on it, it will not appear in a local feed or on any map, and nothing else changes.
• When something breaks. If a screen in the app or a page on this site fails, it sends us a short error report: what the error said, the first lines of where in our code it happened, which screen or page it was, the app’s version and whether it was an iPhone, an Android phone or a browser. It carries no account and nothing you wrote, filmed or were reading, and anything in it that looks like an email address, a key or an id is removed before it is sent. We keep these reports for 30 days to find and fix the fault.

There is no analytics service, no advertising network, no tracking pixel and no third-party script anywhere on this site. The security policy this site ships with permits the browser to talk to our database and our video host and nothing else, so nothing else can load. The app carries no analytics or advertising code either. Error reports go to our own database, not to a crash-reporting company. We do not buy data about you, and we do not build a profile of what you read.

Where it is stored

• Profile photos and their clips go to their own public storage bucket, capped at a few megabytes, under a folder only you can write to. A Station or Broadcast account’s uploaded picture goes first to a private bucket of its own, which only that account and our server can read; only our server copies it into the public bucket, and only once the check approves it.
• Your exact position sits in the same database, in its own table, with a rule on it that only lets your own rows out. It is never sent to the video host, never put in a file name, and never written into a photo we store.
• Accounts, profiles, stories, social records and the ledger live in a Supabase-hosted Postgres database in the United States.
• Photos go to a Supabase storage bucket that is public by configuration. Anyone who has a photo’s URL can open it, whether or not the story was ever published. Nobody can browse the bucket to find those URLs — only you can list your own folder — but a photo is uploaded when you select it in the News Room, before you publish, so treat every photo you upload as public from that moment. Do not shoot something into allnoos that you would not publish. A photo or clip that ends up on no story and no arc is deleted about a day later.
• Gather screenshots go to a private storage bucket. Only the people in that conversation can open one, through a link that expires.
• Video goes to Cloudflare Stream, which transcodes and delivers it. Cloudflare records your account identifier against the upload.
• On your phone, the app keeps your sign-in session, a copy of who and what you have blocked, muted and reported so that works offline, your reading language, whether you agreed to the accord, a few display choices, and the progress of each video upload so an interrupted one can carry on. Clips you film sit in the app’s own storage until they upload. Your notes and the captures waiting in the News Room are held only while the app is open; nothing saves them on the phone. Deleting the app removes all of it, and signing out ends the session.
• In your browser, the website keeps your sign-in session, the same copy of your blocks, mutes and reports, your reading language, which of your followers you have already seen, and, before you sign in, whether you have read the welcome message in Gather. Signing out ends the session.

What is public

Published stories are world-readable by design. No account is needed to read one, and once we open to search engines they can be indexed. These are public too:

• your profile — username, display name, avatar and its clip, bio, “about” note, specialty, location, website, your account type, whether it is verified, when you joined, which version of the terms you agreed to and when, and your follower, following, story and view counts;
• your comments, unless moderation has hidden one, and the smiles and frowns you give comments, wherever the story they belong to is readable;
• your likes and your follows — anyone can see which stories you liked and who you follow;
• your arcs, for a day on your profile picture, and for as long as the story is up once one is filed with a story;
• a station or broadcast account’s business address, the map point it was turned into, and when it was added and checked;
• events you register for or sponsor;
• the places you have filed from — each country and state or province, and how many of your stories came from each. Your Wander map shows them to anyone who opens it, and the heat map and the Voyager board count stories the same way. They only ever count stories the person looking could already open: a followers-only story counts only for you and your followers, a story moderation has hidden counts for nobody, and a story with no place counts nowhere.

Kept to you: your notifications, your wallet ledger and withdrawal requests, your blocks and mutes, the reports you file, your News Room drafts, and Gather messages — a thread’s messages and screenshots are readable only by the people in that thread. Whom you read and what you share is kept from everyone, you included.

Who else sees your material

A handful of companies, each for one job, and nobody else. We do not sell your data or share it for advertising.

• Supabase — database, sign-in, photo storage and the server-side functions behind the newsroom.
• Cloudflare — hosts this website and stores, transcodes and delivers every video.
• Google — the newsroom’s drafting, footage review and learning how you write, writing a planned event’s listing from its host’s answers, the review of reported stories, comments, accounts and arcs and of revised stories, the check of profile pictures (a camera profile photo’s still, and a Station or Broadcast account’s uploaded picture), and translation when it is switched on, all run on Google’s Gemini models. Details below.
• Apple and Google, as your phone’s maker — the phone’s own service turns your position into a place name when you capture something, as described above, and turns a business address you type into a point on the map. On an iPhone, the map you drop an event’s pin on is Apple Maps, and Apple turns the pin into an address.
• Expo — builds the app, and delivers its updates: when the app opens it asks Expo’s servers whether there is a newer version, which shows them your phone’s IP address, an identifier for the installation, the app’s version and the phone’s system.

We will also hand over material if the law requires it — a valid court order, for instance — and we will tell you when we are allowed to.

What the newsroom shares with Gemini (Google’s AI)

Using allnoos means agreeing that it uses Gemini (Google’s AI). Every story is drafted and checked against our standards with Gemini, and reported posts are checked with it, so the terms window you see after creating an account asks for that agreement with its own box, separate from the box for the terms: the words beside it name Gemini and what is shared with it, nothing is ticked for you, and we keep the record of your answer. Nothing you give the News Room is shared with Gemini before you agree. To stop, delete your account (Control Room → Account → Delete Account) or write to support@allnoos.com; the News Room then shares nothing more for you, and the app and the website ask you to agree again before you carry on using them. If we change what that box says, we ask again.

Once you have agreed, drafting is not local. When you draft a story we share with Gemini (Google’s AI): your field notes, the event name and the place name on your story, the photos you selected, and the opening frames of your clips. When footage review runs on a clip, the clip itself is shared with Gemini: it is uploaded to Google’s file storage, analysed for what is visible and audible in it — scene, key moments, an audio summary, verbatim quotes, text on signs — and then deleted from Google’s file storage at the end of the run. If other reporters have published public allnoos stories from the same scene, their headline, summary and name go along as context so the draft can cite them. Followers-only stories are never used this way. When you revise a story the desk took down and send it again, its text and footage reviews go to Gemini for the same check.

When you plan an event and ask the News Room to write its listing, we share with Gemini the answers you typed: the event’s name, place, times, parking, admission, contact and notes.

To learn how you write, the News Room now and then shares with Gemini pairs of a draft it wrote for you and the version you published, and keeps the short profile of your style that comes back.

A Station or Broadcast account’s uploaded profile picture is shared with Gemini to be checked before anyone else sees it, with the location, camera and other details stored inside the file removed first, and with the account’s name and handle so the check can tell its own logo from someone else’s. An account that has not agreed cannot send one. The check’s findings are kept on our side with the record of the upload; the account is told the outcome in one of our own fixed sentences.

The still of a profile photo taken with the allnoos camera is shared with Gemini after you save it, to be checked against our standards, with the location, camera and other details stored inside the file removed first. The clip is not shared. If an account is reported, its picture is checked the same way, together with what the people who reported it wrote. An account that has not agreed is not checked this way. The check’s findings are kept on our side; a photo that is taken down is announced to its account in one of our own fixed sentences.

Translation into other languages is switched off today. When it is switched on, a published story’s headline, text and audio will be shared with Gemini to be translated and dubbed.

Email

Confirmation, sign-in-link and password-reset emails are not switched on yet. When they are, they will be the only routine emails we send — no marketing list, no newsletter you have to escape from.

How long it stays

Most of it stays until you delete it. A few things go on their own: an arc that was never filed with a story comes down once its day on your profile picture is over, unless a report on it is still open or moderation has taken it down; a photo or clip that ends up on no story and no arc is deleted about a day later; and the News Room clears out old drafts as you keep drafting, one it has learned from after about 45 days and any other after about 120. Error reports go after 30 days. A bounty or a credit buyout offer that runs out of time closes and its money goes back, but its record stays. What deleting does today:

• Deleting a story removes it and its media records from the database, deletes the photo files from our storage, and deletes the video at our video host. It disappears from every feed and every map. One honest caveat: a photo that someone opened shortly before you deleted it can keep loading from a content-delivery cache for a short window afterwards, until that cache expires. The file itself is gone.
• Deleting your account hides it from everyone at once and, 30 days later, removes your profile and handle, your stories and arcs, your drafts, your comments, likes, comment votes, follows and credits, your blocks and mutes, the record of what you read and shared, your Gather messages, the screenshots you sent and your group memberships, and your notifications, along with the photo files (a Station or Broadcast account’s uploaded pictures included) and the videos at our video host. Stories other reporters published that credit or quote you stay up — they are their work, not yours.

These records outlive a deleted account:

• Accounting records of money that moved through your wallet, including transfers you started. They are financial records, so they stay, with the wallet closed and unlinked from you.
• Withdrawal requests that were already paid or rejected, unlinked the same way.
• Reports you filed about other people’s stories, comments, arcs or accounts, kept as a record, with your name off.
• Moderation findings about your stories, comments, arcs and account, and copyright notices about your work, with your name off. The text a finding was about stays with it when a review took down a comment or cleared part of your profile. A copyright notice or counter-notice you filed yourself is kept as you filed it, with the name and contact details the law required it to carry. A finding about a story stays so that the same text published again brings it back.
• The records of which version of the terms and the reporter’s accord you agreed to, of your agreement to allnoos sharing your material with Gemini (Google’s AI) and any withdrawal of it, and when, kept with an identifier for the account as evidence.
• Records other people share with you, with your name off: Gather groups you opened, bounties you claimed from someone else, event listings you contested, and notifications other people received about something you did.

How to get it deleted

In the app, open your profile, use the three-dot button and choose Control Room → Account → Delete Account. Type your username to confirm. The account is hidden at once — nobody else can find your profile, stories, comments or anything else you posted, though a link to a photo or video that someone saved earlier keeps working until the files are deleted — and you are signed out. It is deleted for good 30 days later. Changed your mind? Sign in before then and choose Restore my account, and everything comes back as it was. After the 30 days there is no undo. One account covers the app and the website, so it goes from both.

If you have not agreed to the current terms, or to allnoos using Gemini (Google’s AI), the terms window keeps you out of the Control Room. Email support@allnoos.com from the address on the account instead; we will confirm the request with you, then delete it at once (or, if you ask, start the same 30 days), and keep a record that we did — the account’s identifier, the reason and a count of what went.

Deletion waits only for money we owe you or a claim that should not vanish with the claimant — earnings you have not withdrawn, a pending withdrawal request, a bounty you posted or claimed that is not settled, or a legal hold. The delete screen says which, and if one of them comes up during the 30 days, the account stays hidden and is deleted once it is settled. Anything else left in the account, simulated credits included, is forfeited when the deletion completes; it had no cash value.

For anything narrower — one story, or the files behind a story you already deleted — email support@allnoos.com from the address on the account and say what you want gone. We will confirm it is you, do it, and tell you when it is done. The same address gets you a copy of what we hold on you.

What you can control today

• Edit or clear any profile field, whenever you want.
• Delete any story or arc you published. A story can’t be deleted while a report that a child is at risk is being checked, or while a finding that it may involve a child waits for us.
• Unlike or unfollow.
• Block or mute anyone, and undo it in the Control Room.
• Take back the Gemini consent by deleting the account or by writing to support@allnoos.com; the News Room shares nothing more for you after that, and allnoos asks for it again before you use it further.
• Delete the whole account yourself, from the Control Room in the app.
• Ask us, by email, for a copy of your data.
• Location. Turn it off for allnoos in your phone’s settings at any time. Stories you already filed keep the place they were filed with, and stay on your map; new ones will have none. To take the place off a story you already filed, delete the story, or email us and we will clear its city, country and state or province, which also takes it off every map.

The Control Room shows only controls that do something today. Switches for notifications and messages will appear there when there is something behind them, and this page will say so.

Children

allnoos is not built for adolescents or children. You need to be at least 18 to hold an account, as the terms set out. If you believe a child has an account here, email support and we will remove it.

Security

Every table in our database has row-level security on it, so what an account can read is enforced by the database itself rather than by the app being polite. Traffic is HTTPS end to end. We never see your password. That said: allnoos is a young product in early access, it has not been through an external security audit, and the photo bucket described above is a known soft spot we are closing. If you find something wrong, please tell us at support@allnoos.com.

Changes

When this page changes, the date at the top changes with it. If a change materially affects what happens to your material, we will tell you directly rather than quietly editing the page.

Contact

support@allnoos.com is the address for anything on this page. The support page covers the common questions, and the terms cover the rules of using allnoos.