Topiks — Privacy Policy
Last updated: 13 June 2026
Topiks is built on a simple premise: you pay for the product, so you — not your data — are not the product. There is no advertising, no third-party tracking, and no selling of personal data anywhere in Topiks. This policy explains, plainly, what data we do process, why, and what your rights are.
1. Who is responsible
The data controller is MBI Tech SRL, registered in Belgium under company number BE1005578709.
For anything related to your personal data, contact us at [email protected].
This policy covers the Topiks application (topiks.news) and the Topiks account and sign-in site (identity.topiks.news).
2. What we collect, and why
Account data
- Email address — your identifier, used to sign you in (including magic links and verification codes) and to send you service emails.
- Password — only if you choose to set one. We store a cryptographic hash, never the password itself.
- Language preference, email verification status, last sign-in time, and failed sign-in counters — to run your account and protect it against break-in attempts.
Why we may process this data: performing our contract with you; security is our legitimate interest.
Third-party sign-in
If you sign in with Google, Facebook, or X, we receive from that provider your email address and a provider account identifier, which we store to link the sign-in method to your Topiks account. We do not receive your contacts, posts, or social graph, and we never post on your behalf. What the provider itself processes when you use their sign-in is governed by their own privacy policy.
Why we may process this data: performing our contract with you.
Your Topiks configuration
This is the heart of the Service, and it is data you deliberately give us:
- your feeds — names, icons, language and discovery settings;
- the topics you follow and your coverage configuration for them;
- your publisher preferences and mutes;
- your viewing progress for TV shows and movies, your spoiler settings, and your spoiler reveals;
- your feedback on articles and topics, your read state, and article links you submit;
- whether you have completed onboarding.
We are conscious that this data paints a picture of your entertainment tastes and viewing habits. It is used solely to build and refine your own feed. It is never used for advertising, never shared for marketing, and never sold — there is nobody on the other side of this data.
Why we may process this data: performing our contract with you — this configuration is the service.
Payment data
Payments are handled by Stripe. Your card details go directly to Stripe; we never see or store them. On our side we keep what we need to operate your subscription: your plan, its status and period, and the invoicing records that Belgian law requires us to retain.
Why we may process this data: performing our contract with you; retaining invoicing records is a legal obligation.
Technical data
- Server logs — like virtually every online service, our servers produce technical logs (which may include your IP address, user identifier, and email address in connection with specific requests). We use them only for debugging, security, and incident response. They are deleted after 30 days.
- Cookies — Topiks uses strictly necessary and sign-in cookies only: the session cookies that keep you signed in, security cookies that protect forms against forgery, a cookie remembering your language, and a cookie on the sign-in site remembering how you last signed in so we can take you straight there next time. There are no analytics cookies, no advertising cookies, and no third-party trackers — which is why Topiks has no cookie banner: there is nothing to consent to.
Why we may process this data: security and service operation are our legitimate interests.
What we do not collect
No advertising identifiers, no behavioral tracking across other sites or apps, no device fingerprinting, no analytics SDKs, no data purchased from or shared with data brokers. We do not collect your name — Topiks doesn't need it.
3. AI processing — and what it never touches
Topiks uses AI models (currently provided by OpenAI) to process news articles: matching articles to topics, categorizing coverage, and detecting spoilers. What is sent to the AI provider is publisher article text and our own catalog data (show names, episode lists, and similar).
No personal data about you is sent to AI providers. Your identity, your feeds, your viewing progress, and your reading behavior are not part of these requests — the AI pipeline processes the news, not the readers.
4. Who else receives data
We use a small number of service providers (processors), each bound by a data processing agreement:
| Provider | Role | Data involved | Location |
|---|---|---|---|
| Microsoft Azure | Hosting and infrastructure | All service data | EU (westeu) |
| Microsoft Azure Communication Services | Sending service emails | Email address, email content | EU |
| Stripe | Payment processing | Payment and billing data | EU/US — see below |
| BetterStack | Server log storage | Technical logs (see "Technical data" above), deleted after 30 days | EU |
| OpenAI | Article processing | Publisher article text and catalog data — no personal data | US |
Beyond these processors, we disclose personal data only if a law or a competent authority validly requires it, or as part of a merger or acquisition of the company (in which case this policy continues to apply and you will be informed).
International transfers. Your service data is stored in the European Union. Stripe may process payment data in the United States; this transfer is covered by the EU–US Data Privacy Framework and standard contractual clauses. The article text processed by OpenAI in the US contains no personal data about you.
5. How long we keep data
| Data | Retention |
|---|---|
| Account and configuration data | For as long as your account exists. Deleted when we complete your account deletion request. |
| Invoicing and billing records | The retention period required by Belgian accounting and tax law (currently up to 7 years) — this is the one thing an account deletion request cannot erase early. |
| Server logs | 30 days |
| Magic link and verification tokens | Minutes to hours — they expire by design |
| Trial-only accounts that never subscribed | Deleted after long inactivity, with prior notice to your email address |
When we delete your account after your request, deletion from our production systems is immediate. Residual copies in encrypted backups are not directly accessible and expire with the normal backup rotation.
6. Your rights
Under the GDPR you can, at any time and free of charge:
- access the personal data we hold about you, and get a copy;
- rectify inaccurate data (your email and settings are directly editable in the app);
- erase your data — contact us at [email protected] if you want your account or data removed;
- restrict or object to processing based on our legitimate interests;
- receive your data in a portable format (data portability);
- lodge a complaint with a supervisory authority — in Belgium, the Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), dataprotectionauthority.be, or the authority of your own country of residence.
To exercise any of these rights, email [email protected]. We will respond within one month, and we may need to verify that you are the account holder before acting.
Automated decisions. Your feed is assembled automatically (that is the Service), but Topiks makes no automated decisions about you that produce legal or similarly significant effects within the meaning of Article 22 GDPR.
7. Security
Personal data is protected by measures appropriate to its nature: encryption in transit, encrypted storage and backups, hashed passwords, temporary account lockout after repeated failed sign-ins, secrets management, and access limited to what operating the service requires. No system is perfectly secure, but if a breach ever affects your data in a way that puts you at risk, we will notify you and the supervisory authority as the GDPR requires.
8. Children
Topiks is not directed at children and requires users to be at least 16 years old. We do not knowingly process data of anyone younger; if you believe a minor has created an account, contact us at [email protected] and we will delete it.
9. Changes to this policy
If we change this policy in any material way — and in particular if any future change were ever to touch the no-advertising, no-tracking commitments above — we will notify you by email and/or in the app before the change takes effect, in line with the Terms of Service. The "Last updated" date at the top always reflects the current version.
Questions about your data? [email protected]