Privacy Policy

We collect only what we need to run alltop and make it better.

Account information

• Email address (required for account creation and sign-in).
• Display name, if you choose to set one.
• Password hash, when you sign up with email + password. We never see or store your plaintext password.
• OAuth identifier if you sign in with Google (we do not receive your Google password).

Usage information

• Topics and sources you follow, and articles you save, hide, or dislike.
• Custom RSS feeds you add.
• Pages you visit within alltop and interactions such as clicks, scrolls, and time on page.
• Device and browser information: user agent, approximate location (country/region from IP), screen size, referrer, and timestamps.

Information we do not collect

• Payment or financial data. alltop is currently free.
• Sensitive categories of personal data (health, precise location, biometrics, etc.).

• Provide core functionality: authenticate you, show your followed topics and sources, and keep your feed in sync.
• Send transactional email (magic links, password resets, and — if you opt in — daily or weekly digests). You can unsubscribe from digests at any time.
• Improve ranking quality and product usability by analyzing aggregate reading behavior.
• Detect abuse, fraud, and security incidents.
• Comply with legal obligations.

alltop uses the following third-party analytics tools. Each sets its own cookies and collects information governed by its own privacy policy.

• Google Tag Manager — loads and configures the tools below. Google Tag Manager itself does not collect personal data, but the tags it loads do. Google Privacy Policy.
• Google Analytics (GA4) — helps us understand aggregate page views, retention, and traffic sources. IP addresses are truncated before storage. We do not enable Google Signals or ad-personalization features. How Google Analytics uses data.
• Microsoft Clarity — records anonymized session replays and heatmaps so we can see where the interface is confusing. Input fields (including email and passwords) are masked by default. Clarity cookie list.
• Essential cookies — we set our own first-party cookies to keep you signed in, remember your theme preference, and verify your CSRF token. These cannot be turned off without breaking the site.

Your choices. You can block analytics cookies in your browser or use an extension such as uBlock Origin or the Google Analytics Opt-out add-on. alltop honors the Global Privacy Control (GPC) signal and “Do Not Track”: when either is present we disable Clarity and switch Google Analytics to no-personalization, no-ads mode.

We do not sell your personal information. We share it only with:

• Supabase — database, authentication, and storage provider. Hosted in the United States.
• Cloudflare — CDN, edge compute, and DDoS protection. Sees request metadata (IP, user agent) necessary to route and secure traffic.
• Google (Analytics, Tag Manager, OAuth) — as described above.
• Microsoft (Clarity) — as described above.
• Email providers (Supabase / Postmark) — to deliver account and digest emails.
• AI model providers (e.g., Google Gemini) — we send article headlines and short summaries to generate editorial headlines and story clusters. We do not send your personal data to these providers.
• Law enforcement — if compelled by a valid legal process. We will try to notify you first unless prohibited by law.
• Successors — if alltop or Ocean View Marketing is acquired, your data may transfer to the new owner, subject to this policy.

Depending on where you live (EU/EEA, UK, California, Colorado, Virginia, Connecticut, etc.) you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Opt out of “sale” or “sharing” of personal information (we do not sell or share for cross-context behavioral advertising, so there is nothing to opt out of, but you may submit a request anyway).

To exercise any right, email privacy@alltop.com from the address associated with your account.

You can delete your alltop account at any time, for any reason, at no cost. Go to Settings and use the “Delete account” option, or email privacy@alltop.com from the address associated with your account. We honor deletion requests within 30 days.

Deletion permanently removes your email, display name, password hash, follows, saved items, custom RSS feeds, and any other data that can identify you. It is irreversible.

• Account data is kept while your account is active, then deleted within 30 days of account deletion.
• Aggregate analytics are retained for up to 14 months in Google Analytics and up to 13 months in Microsoft Clarity, after which they are deleted or anonymized by those providers.
• Backups may persist for up to 30 additional days before being overwritten.
• Security and abuse logs are retained for up to 12 months.

Our providers are primarily located in the United States. If you access alltop from outside the U.S., your information will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses and equivalent safeguards where required.

alltop is not directed to children under 13 (or under 16 in the EU/EEA), and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

We encrypt data in transit (HTTPS) and at rest, use managed authentication (Supabase Auth), and apply row-level security to user data. No system is perfectly secure, however, and we cannot guarantee absolute security.

We may update this policy from time to time. If we make material changes we will notify you by email or a prominent notice on the site before the changes take effect. The “Last updated” date above indicates the most recent revision.

Questions? Email privacy@alltop.com or write to Ocean View Marketing, Attn: Privacy, San Diego, CA, USA.