RUSH Newstream ("we," "us," or "RUSH") is a nonpartisan news aggregation
platform. This policy explains what information we collect, how we use
it, and the choices you have. We try to keep things plain-English. If
anything is unclear, contact us at the address at the bottom of this
page.
1. Information we collect
Information you give us
When you create a RUSH account, we collect:
- Email address. Required to create an account, verify your identity, and send password reset and account notifications.
- Display name. The name that appears next to your comments. You can change it.
- Password. Stored only as a one-way cryptographic hash. We never see or store your plaintext password.
- OAuth identifiers. If you sign in with Google or Facebook, we receive your email address, display name, and a stable provider-specific user ID. We do not receive your password or post anything to those accounts.
- Comments and content you post. Anything you submit as a comment is associated with your account and visible to other users.
Information we collect automatically
- Anonymous visitor ID. A random identifier stored in your browser's local storage. It lets us associate your anonymous activity (such as upvotes on news events) with you before you sign in, and lets us migrate that activity onto your account when you do sign in.
- Session information. Once signed in, we store a session token in a secure, HTTP-only cookie along with your IP address, the time you logged in, and your browser's user agent string. This is used for authentication and basic security monitoring.
- Usage activity. The events you upvote, comments you post, and the publication time of those actions.
- Email engagement. Basic delivery information for transactional emails we send (verification and password reset). We do not currently send marketing emails.
What we do not collect
- We do not collect or store payment card data. Future subscription payments will be handled by a third-party payment processor (such as Stripe), which receives that data directly.
- We do not run advertising trackers or third-party advertising cookies.
- We do not sell your information to data brokers.
2. How we use information
We use the information described above to:
- Create and maintain your account, including signing you in and out
- Display the comments and votes you have made
- Send transactional emails (account verification, password reset, important account notifications)
- Prevent abuse, spam, fraud, and other harmful activity
- Diagnose technical problems and improve the reliability of the service
- Comply with legal obligations
3. Cookies and similar technologies
We use a small number of cookies and similar storage mechanisms:
- Session cookie. Set after you sign in. Required for the service to recognize you as logged in. HTTP-only and Secure.
- OAuth state cookie. A short-lived cookie set during the Google or Facebook sign-in flow to prevent cross-site request forgery. Expires within 10 minutes.
- Browser local storage. Stores your anonymous visitor ID and (if you choose) your dark-mode preference. This is not a cookie and is not transmitted to us automatically.
We do not currently use analytics cookies or advertising cookies. If that changes, we will update this policy and (where required) ask for your consent.
4. Third-party services
RUSH integrates with several outside services in order to deliver the news aggregation product. These services receive or process limited information as described below.
News and content sources
RUSH aggregates publicly available news articles, social media posts, and reference content from sources including but not limited to: NewsData.io, GNews, AllSides, ESPN, Wikipedia, Grokipedia, Bluesky, and Truth Social. These services do not receive any information about RUSH users; we only consume their public data feeds.
OAuth identity providers
If you choose to sign in with Google or Facebook, you will be redirected to that provider's authorization screen. The provider will tell us your email address, your name, and a stable provider-specific user ID. Their use of your data is governed by their own privacy policies:
Email delivery
We send account verification and password reset emails through an email service provider. That provider processes the destination email address and the contents of those emails on our behalf, but does not use them for its own marketing purposes.
AI providers
RUSH uses third-party large language models (including providers such as SambaNova, Cerebras, and Groq) to generate article grades, story summaries, and other editorial analysis. These providers process the text of news articles, not your personal information. We do not send your account information, comments, or browsing activity to AI providers.
Hosting
Our website and API are hosted on commercial hosting infrastructure. The hosting provider has access to server logs that include IP addresses and request metadata, used for operating the service and preventing abuse.
5. When we share information
We do not sell your personal information. We share it only in these limited circumstances:
- With service providers we hire to operate RUSH (hosting, email delivery, OAuth providers, AI providers as listed above). These providers are bound to use the information only as needed to deliver their service.
- When you choose to share publicly. Comments you post and your public display name are visible to other users.
- To comply with law. We may disclose information if required by a valid legal request (subpoena, court order) or if we reasonably believe it is necessary to prevent fraud, abuse, or imminent harm.
- In a business transfer. If RUSH is involved in a merger, acquisition, or sale of assets, your information may be transferred. You will be notified in advance.
6. How long we keep information
- Account information is kept for as long as your account is active. If you delete your account, we will delete or anonymize associated information within 30 days, except where retention is required by law (for example, transaction records).
- Comments remain visible after account deletion only in anonymized form (without your display name). You can request that specific comments be removed by contacting us.
- Session records are retained for up to 90 days for security and abuse-prevention purposes, then deleted.
- OAuth state tokens are deleted automatically within an hour of creation.
- Email delivery logs are retained by our email provider for a limited time per their policy.
7. Security
We use industry-standard security practices, including: HTTPS for all data in transit, one-way hashing of passwords (we never store plaintext), HTTP-only and Secure cookies for session tokens, separate database credentials for read versus write operations where practical, and prompt patching of known vulnerabilities. No system is perfectly secure; if we discover a breach that affects your account, we will notify you as required by applicable law.
8. Your rights and choices
Depending on where you live, you may have the following rights:
- Access. Ask for a copy of the personal information we hold about you.
- Correction. Ask us to fix inaccurate information.
- Deletion. Ask us to delete your account and associated information.
- Portability. Ask for a copy of your information in a portable format.
- Withdrawal of consent. Withdraw any consent you previously gave us.
- Objection. Object to certain uses of your information.
To exercise any of these rights, email us at the address in section 12. We will respond within a reasonable time and may need to verify your identity before acting on a request.
California residents: The California Consumer Privacy Act (CCPA) gives you additional rights regarding the personal information businesses collect about you. RUSH does not sell personal information.
European users: Where the EU General Data Protection Regulation (GDPR) applies, our legal basis for processing your information is one or more of: (a) the contract we have with you, (b) our legitimate interest in operating the service, (c) compliance with legal obligations, or (d) your consent (which you can withdraw).
9. Children's privacy
RUSH is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, please contact us and we will delete it. Users between 13 and 18 should review this policy with a parent or guardian.
10. International users
RUSH is operated from the United States. If you are accessing it from elsewhere, your information will be transferred to, processed in, and stored in the United States. By using RUSH, you consent to this transfer.
11. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Effective" date at the top of this page and (for significant changes) notify you by email or with a notice on the site. Continued use of RUSH after a change means you accept the updated policy.
Questions, requests, or concerns about this policy can be sent to:
RUSH Newstream
Email: support@rushnewstream.com