Webnerd.ai Privacy & Security Policy

Effective Date: October 2026 · Return to Webnerd.ai

1. What We Collect & Store

• Google Sign-In Identity: When you sign in with Google, we verify your ID token and store your immutable Google subject identifier (sub), verified email address, display name, and avatar URL to maintain your reader account.
• Reader Subscriptions & Activity: We store the RSS/Atom feeds, folders, read/unread states, stars, and shared items you create so your reading stream stays synchronized across devices.
• Bluesky Integration: If you connect Bluesky to cross-post shared stories, your Bluesky handle and App Password session stay strictly in your own browser storage and talk directly to https://bsky.social. Your Bluesky credentials are never transmitted to or stored on Webnerd.ai servers.

2. How We Protect Your Data

• All traffic is encrypted over HTTPS with HSTS, a strict Content Security Policy (CSP), and allowlist HTML sanitization on all ingested feeds and newsletters.
• Session tokens are stored exclusively in HttpOnly; Secure; SameSite=Lax cookies and are immediately revoked server-side when you sign out.

3. Data Deletion & Security Contact

To request account deletion, export your OPML subscriptions, or report a security vulnerability, contact Louis Gray at louisgray@gmail.com (see also /.well-known/security.txt).