Privacy Policy

What we collect when you read InvestIn.News, why we collect it, who else sees it, and how to make us stop.

Who Is Responsible for Your Data

InvestIn.News comes under the brand umbrella of BitWorld Media INC, 5900 Balcones Drive, STE 100, Austin, TX 78731, United States, registration number 806442908. BitWorld Media INC is the controller of the personal data described here. Write to contact@investin.news about anything on this page.

Privacy contact. For privacy questions and requests, including requests from the European Union and the United Kingdom under the GDPR and the UK GDPR, write to contact@investin.news, with “Privacy” in the subject line.

What We Collect

What we collect, why, and how long we keep it

Data	Why	Kept for
Server logs IP address, browser, page requested, referring page, time	Serving the site, diagnosing faults, blocking abuse and scraping. The logs are kept by Cloudflare, which runs our servers. We also use the country Cloudflare works out from your IP address to decide whether a story or banner limited to certain countries is shown to you; the country is not stored, and it is never linked to you.	As long as Cloudflare keeps them under its own retention policy. We keep no separate copy.
Story view counts The address of the story, the day, and whether you opened it or followed its link to the original article	Knowing which stories are read, so we can plan coverage and show sources what we send them. Only a running total per story per day is kept: no IP address, no cookie, no device or reader ID, nothing that could tell one reader from another. Each browser tab counts a story once; so that repeat counts from the same connection on the same day are ignored, the server keeps a one-way hash of the connection (its IP address and browser name, with the story) until the end of that day (UTC), then deletes it; the address itself is not stored, and the hash is never in our backups. Search engines and known automated visitors are not counted.	400 days as daily totals, then as monthly totals per story for up to two years
Reach counts Where a visit’s first page came from (a search engine, Telegram, X and so on, or an alert), and whether a reader used the alerts button, saved or shared a story, followed one of our accounts, opened or sent the booking form, or searched for some words	Knowing which channels bring readers and which features they use. Only a running total per item per day is kept, counted the same way as story views: no IP address, cookie, device or reader ID. Search words are kept as typed (shortened, lower case) and shown to our team only when searched at least twice. Because they are kept as typed, anything typed into search, such as a person’s name or a wallet address, can be among them; please don’t search for details you would not want our team to see.	400 days
Bullish / bearish votes (only if you vote) Which NewsFeeds flash you voted on, whether you voted bullish or bearish, and the day	Showing readers what other readers think of a flash, and showing our team which flashes readers care about. Only a running total per flash per day is kept, counted the same way as story views: no IP address, cookie, device, email address or reader ID. No sign-in is needed.	400 days
Breaking alerts (only if you turn them on) Your browser’s push address (a long web address at your browser maker’s push service: Google, Mozilla, Apple or Microsoft), the two encryption keys your browser made for it, which alerts you picked, when you subscribed, when an alert last reached you, and a count of failed deliveries. No name, email address, IP address or account	Sending the breaking-news alerts you asked for. Your browser only asks for permission when you press “Get breaking alerts”, never on its own. To limit abuse, the server counts how often one connection subscribes, by its IP address (an IPv6 address is cut to its first half), for ten minutes; that count is deleted within a day.	Until you turn alerts off (the same button, or your browser’s site settings), which deletes it at once. It is also deleted when the push service tells us the address no longer works, or after five failed deliveries in a row
Messages from our forms From the contact form on our About page and the booking form on our Advertise page: your name, email address, company, subject and message; on a booking, the format, preferred date and budget; the page you sent it from and the page that brought you there; and a salted one-way hash of your IP address	Replying to you, and stopping spam and abuse (the hash lets us limit how many messages one connection can send, without keeping the address). The message is stored in our database first and then emailed to our desk, so it is never lost if email fails. On a booking enquiry we also email you a short receipt; so that only one receipt a day goes to an address, a one-way hash of your email address is kept until the end of that day (UTC). An AI model (Jev, from TypeSafe AI) reads each message to screen out obvious spam; a message it flags from the contact form is still kept, filed as archived for our team to review, and not emailed; a booking enquiry it flags is emailed to our desk with “Possible spam” in the subject, and still gets its receipt. Nothing else is decided about you automatically.	365 days, then deleted with the hash. A message our team deletes earlier stays in the NewsRoom’s Trash for 30 days, and in our backups for up to 12 months (see Backups below). The copy emailed to our desk is kept like the emails you send us (below)
Emails you send us Your name, email address and what you write, when you write to contact@investin.news directly	Replying about advertising, corrections, tips or press.	Up to 24 months after our last contact, or longer where tax or contract records require it
NewsRoom sign-in and security log A session cookie for our staff and a cookie that recognises a staff device signed in before; for anyone who tries to sign in, a count of attempts by IP address; and a security log of every sign-in, failed sign-in and blocked sign-in, and of every change made in the NewsRoom: the time, the country, a shortened one-way hash of the IP address, a short code for the device, and the type of device and browser (such as “Android · Chrome”)	Keeping the NewsRoom, where we run the site, secure, limiting password guessing, and being able to see afterwards who changed what and whether anyone tried to break in	Session: 7 days, renewed while in use. Known-device cookie: 400 days. Sign-in attempt counters: deleted within a day. Security log: 12 months, and it is included in our backups (below)
Advertisers and writers For advertisers: name, business email, booking details and rates. For our writers: name, email, social handles, biography and disclosures	Running bookings and invoicing, and bylines and profile pages. Of a writer’s details, only the name, role, biography, beats, picture, public social profiles and disclosure are published	As long as the booking or working relationship lasts, then up to 24 months, or longer where tax or contract records require it

To stop abuse, when a story shows the picture of an X account, or the picture of an older story that our server has to look up, our server counts how many new pictures one connection asks for, by its IP address (an IPv6 address is cut to its first half), for ten minutes; that count is deleted within a day.

For banner advertisers, the site counts how often each banner was on screen (at least half of it for a second) and pressed, as running totals per banner per day. Nothing that names you is stored: to stop one connection running the numbers up, the server keeps a one-way hash of the connection (its IP address and browser name, with the banner) until the end of that day (UTC), then deletes it; it is never in our backups. Kept for up to about two years.

We keep nightly backups of our database in Cloudflare R2 (storage run by Cloudflare), so the site can be restored after a fault. Each nightly backup is kept for 14 days, one a week (the Sunday one) for 8 weeks, and the one from the 1st of each month for a year, then deleted; the newest three are always kept, so if the nightly backups ever stop, those three stay until they start again. The sign-in attempt counters, the abuse counters above, the receipt notes for booking enquiries and the article text our AI reads are left out of them; the NewsRoom security log is included. Something deleted from the site, such as an alerts address or a form message, therefore leaves our nightly backups within about 12 months, because the monthly copies are kept the longest. Pictures we have uploaded, such as our writers’ photos, are copied to the same backup store; a picture we delete from the site is deleted from the backup store about 8 weeks later.

Our public status page (and /status.json) keeps a daily uptime tally for each part of the site for 90 days. It holds nothing about readers.

Apart from the anonymous view totals above, which we count ourselves, we measure visits two ways: Cloudflare Web Analytics, which counts visits in aggregate without cookies and does not follow you between sites, and Google Analytics, which counts visits, the pages read and where readers came from with cookies of its own - see Google under Who Else Sees It. We run no advertising trackers.

We do not ask you to create an account, we do not collect payment details on this site, and we do not collect wallet addresses, trading history or anything you hold.

Stored on Your Device

Small entries are kept in your browser’s local storage: your theme, if you choose one, your answer to our cookie notice, a note of how the site’s banner slots are set up, so the next page can lay them out before it loads, the last coin prices your browser saw, so the price ticker is filled in before new prices arrive, the stories you save with the Save button (their addresses, headlines and pictures), if you save any, and your bullish or bearish votes on NewsFeeds flashes (iv-votes), if you vote, so each flash shows the vote you gave; two more small notes say that you have been shown where saved stories go, and when your breaking-alerts subscription was last confirmed, if you turned alerts on. While a tab is open, its session storage also keeps short notes: which stories you opened, and that the visit was counted, so each is counted once; your place in lists and pages, so Back returns you to it; and whether you paused the price ticker (iv-tape), and a one-time note that you pressed Back (iv-sy-pop). These notes are deleted when you close the tab. None of these is sent to us. Unless you press No thanks on our cookie notice (in Europe, the UK, Switzerland and India, or wherever we cannot tell where you are, only if you press Accept), Google Analytics also sets its _ga cookies. The site also installs a small offline helper (a service worker) that keeps copies of our own style sheet, scripts, fonts, logos and the last 30 pages you read, so pages open faster and still open without a connection; it never stores the NewsRoom or anything you send through our forms, but a search results page you open is kept like the other pages, with your search words in its address. The Cookie Notice has the details.

Why We Are Allowed to Hold It

• Legitimate interests - server logs, sign-in attempt counters and the NewsRoom security log, so the site works and stays safe; anonymous story view totals, so we know what is read; and replying to messages you send us, through our forms or by email. You can object at any time.
• Consent - breaking alerts: your push address and keys are kept only after you press “Get breaking alerts” and allow notifications. You can withdraw consent at any time by turning alerts off, which deletes them at once.
• Google Analytics - in the European Economic Area, the United Kingdom, Switzerland and India (where the Digital Personal Data Protection Act asks for consent; told by your device’s time zone and the country your connection comes from), and wherever we cannot tell where you are, consent: it loads only after you press Accept on our cookie notice. Elsewhere, legitimate interests (knowing how many people read us, and how they find us): it runs until you press No thanks, which turns it off and removes its cookies, and never loads in a browser that sends Global Privacy Control. You can change your choice at any time with “Cookie choices” at the foot of every page.
• Contract - where you have bought advertising or a paid placement from us, and for the writers who work with us.
• Legal obligation - tax records, and responding to a lawful request.

We ourselves make no decisions about you by automated means, and we do not build profiles of readers. Google Analytics gives your browser a random ID so that return visits can be counted; we do not link it to anything else we hold.

Who Else Sees It

We do not sell or share personal data. These providers handle it for us, or receive it when a page loads something of theirs:

• Cloudflare - hosting, content delivery, our database (including the NewsRoom’s records), server logs and the visit counts of Cloudflare Web Analytics. Every request to this site passes through Cloudflare. Our typeface is served from our own site too, so no font provider receives your IP address.
• Cloudflare Turnstile - on the contact and booking forms only, when we switch it on, to tell a person from a bot. Your browser loads a small script from challenges.cloudflare.com, so Cloudflare receives your IP address and browser signals, and may set a security cookie for the check; our server then sends Cloudflare the check’s result and your IP address to confirm it. It is not used for advertising or to follow you between sites.
• Public data and service providers - our server, not your browser, also asks outside services for public information: X (and, as fall-backs, FxTwitter and unavatar.io) for the pictures of X accounts quoted in stories, which we then serve from our own site; Serper (Google News search), GDELT and the Federal Reserve Bank of St. Louis (FRED) for news and economic data; CoinGecko, CoinPaprika, Binance, CoinLore, CoinMarketCap and alternative.me for prices; Deribit for the public options data on our crypto options page; Kalshi for Fed rate odds; the public RSS feeds of the news outlets we credit, public posts on X and the public pages of Telegram channels for the NewsDesk and NewsFeeds; for the AI Hub, the public status pages of the AI companies and tools it lists (such as OpenAI, Anthropic, Mistral AI, Perplexity, Cohere, Groq and Google Cloud), OpenRouter, Hugging Face and GitHub for model prices, models and repositories, and, for AI Updates, the news and changelog feeds of OpenAI, Google, Google DeepMind, GitHub, Cursor, Hugging Face and Ollama and the releases of AI coding tools on GitHub; IndexNow to tell search engines about new pages; and Healthchecks.io to check that our scheduled jobs run. We send none of them anything about our readers.
• Google (Google Analytics, Google LLC, United States) - counts visits for us: the pages you read (including the words you search for on our site), how you reached us, your browser, device and rough location (Google receives your IP address with each count and uses it to estimate your location; Google Analytics 4 does not log or store it), using its own cookies (_ga and _ga_<id>). Its advertising features (Google signals and ad personalisation) are off, so it is not used for ads. Google keeps the detailed (event-level) data for 14 months; the totals in its reports are kept until we delete them. It loads only as set out under Why We Are Allowed to Hold It, and we keep it off in browsers signed in to our NewsRoom. See how Google uses information from sites that use its services.
• Zoho Mail - our email provider. It holds the messages you send to contact@investin.news.
• Our email delivery service (currently Resend; MailChannels or Cloudflare Email if we switch provider) - carries the messages from our forms to our desk and, for booking enquiries, a receipt back to you.
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence, China), and any backup AI provider we switch on (such as Anthropic) - write the AI summaries on the NewsDesk and the AI rewrites on NewsFeeds, link flashes into story timelines, choose which waiting NewsDesk story goes up each hour, and help our writers draft and edit Originals. We send them public news text, public posts and documents our writers give them, which can name people in the news and the people whose public posts are quoted, and nothing about our readers.
• TypeSafe AI (United States), whose model Jev makes yes/no and multiple-choice decisions for us and writes nothing: which flashes and stories are adverts, promotions, repeats or off-topic, each flash’s topic and market tone, whether an AI summary is supported by its article, which story goes up each hour, which stories are posted to Telegram first, and which become automatic breaking alerts. We send it public news text for those, and, for checks our writers ask for, their drafts and headlines and the address of a news source we are vetting. It also reads the messages sent through our contact and booking forms (your name, email address, company, subject and message) to screen out obvious spam; nothing else about our readers is sent to it.
• xAI (United States), whose model Grok searches posts on X for our writers when they start a story in our NewsRoom’s “Draft from source” assistant. We send it the story’s topic and the source text the writer is working from, and it returns public posts on X about that story; nothing about our readers is sent to it.
• DeepSeek’s search (the same company), and Serper (Serper.dev, United States, Google results) as its backup, and Bing News, which return web results for our writers’ searches in the “Draft from source” assistant and the fact-check, and the headlines of our hacks tracker. We send them only search words (a story’s key words and headline, or a claim being checked); nothing about our readers is sent to them.
• News outlets and advertisers - outlet pictures shown with a story are always fetched and resized by our own server and served from investin.news, so the outlet does not see you. A booked banner’s picture, and a logo or press-coverage picture an editor has linked from another site, may load straight from that site’s server, which then receives your IP address and browser details, as with any image on the web.
• Your browser’s push service (Google, Mozilla, Apple or Microsoft, depending on your browser) - only if you turn on breaking alerts. It carries each alert to your device. The alert is end-to-end encrypted with your browser’s keys, so the push service cannot read it; it sees only that our site sent your browser a message.
• YouTube (Google), Instagram (Meta) and LinkedIn - a story with a video or post from one of them shows a play button. Only when you press it does that service’s player load from its servers (for YouTube, through youtube-nocookie.com); the service then receives your IP address and browser details, and may set its own cookies or similar storage, under its own privacy policy. Before that, nothing loads from the service: a YouTube video’s preview picture is fetched by our own server and served from investin.news.
• Interactive charts and tables - a story may show an interactive chart, table or widget we made or uploaded (an HTML embed). It loads with the story, without a click. It runs walled off from our site, so it cannot read our cookies or your browser’s storage or act as a page of ours, but it may load code or data from other sites (for example a charting library), which then receive your IP address and browser details, as with any content on the web.
• Telegram, X and LinkedIn - we post links to our own stories (never paid ones), automatically and up to a daily limit, to our public Telegram channel, t.me/investinnews; our NewsFeeds flashes (the headline and text, the outlet’s name and, when AI rewrote the flash, a note that it did; a flash our desk wrote or edited carries no AI note; no link) automatically and up to a daily limit to our X account and, when we switch it on, our LinkedIn page, and, when we switch it on, to the Telegram channel too, labelled as rewritten by AI from the outlet and linking to the flash on our site; and, when we switch it on, links to new Originals to our LinkedIn account. Our team also posts by hand to our Instagram account, @investinnewsmedia; our pages only link to it, and nothing from Instagram loads on them. We send them nothing about our readers; if you follow or open one of these accounts, that service handles it under its own privacy policy.
• CoinGecko (and the back-up price sources named on our market pages) and Kalshi - our server asks them for public coin prices and for market-implied odds on Federal Reserve decisions. Your browser never contacts them, and we send them nothing about our readers.
• Professional advisers, and any authority making a lawful request.

Where Your Data Goes

Our team works from India, and the site is served by Cloudflare from data centres around the world, including the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data therefore leaves your region. Drafts and documents our writers send to our AI provider, DeepSeek, are processed in China; they can name people in the news and quote their public posts, but we send it no data about our readers. Google Analytics data is processed by Google LLC in the United States under the EU-US Data Privacy Framework (with its UK and Swiss extensions) and Google’s standard contractual clauses. Where the law requires it we rely on the standard contractual clauses our providers offer, or on an adequacy decision where one exists. Ask us and we will tell you which applies.

Your Rights

Wherever you are, you can ask us to show you what we hold, correct it, delete it, or stop using it. Depending on where you live you may also have the right to a portable copy, to object to processing, and to complain to a regulator.

• EEA and UK - access, rectification, erasure, restriction, portability, objection, and the right to complain to your supervisory authority.
• India - access, correction, erasure, grievance redressal and nomination under the Digital Personal Data Protection Act. Our grievance officer is reachable at contact@investin.news.
• California - the right to know, delete and correct. We do not sell or share personal information, and we will not treat you differently for exercising any right.

India: Digital Personal Data Protection Act, 2023

If you are in India, BitWorld Media INC is the Data Fiduciary for the personal data described here. Under the DPDP Act you have the right to a summary of the personal data we process and of whom we share it with, to correct, complete, update and erase it, to withdraw any consent you gave (as easily as you gave it), to nominate another person to exercise your rights if you die or become incapacitated, and to grievance redressal. Write to our grievance officer at contact@investin.news with “DPDP grievance” in the subject line, or by post to BitWorld Media INC, 5900 Balcones Drive, STE 100, Austin, TX 78731, USA. We acknowledge within 24 hours and resolve grievances within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Write to contact@investin.news and we will reply within 24 hours, and complete your request within 30 days. We may ask one question to confirm you are who you say you are, and nothing more.

Security

The site runs over HTTPS. The NewsRoom, where we run the site, is open only to our staff; it is protected by a password and a limit on sign-in attempts. We do not hold card details. If there is ever a breach of personal data we hold, we will tell the people affected and the regulators as the law requires (in India, each person affected and the Data Protection Board).

Children

This site is for adults and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has sent us personal data, write to us and we will delete it.

Changes

We will change this page as the site changes. The date at the top always shows the current version. On 7 November 2026 we named Cloudflare Turnstile, which checks the contact and booking forms, and the other outside sources our server reads that this page had left out (Deribit, the AI companies’ news and changelog feeds, outlets’ RSS feeds, public posts on X and Telegram channel pages); we said that a booking enquiry Jev flags as spam is emailed with “Possible spam” in its subject instead of being archived; and we said that our flashes posted to X, LinkedIn and Telegram carry a note that AI wrote them. On 3 November 2026 we named the public sources our server reads for the new AI Hub (AI providers’ status pages, OpenRouter, Hugging Face and GitHub); none of them is sent anything about our readers. On 29 October 2026 we named our Instagram account, which our pages only link to, and Binance, whose public market data our server asks for prices when our other price sources do not answer. On 28 October 2026 we took out the Binance Square account we had named here on 27 October: we do not post there. On 24 October 2026 we said that the abuse counter also covers the pictures of older stories, and took out a line about a weekly copy of our backups kept outside Cloudflare, which had come back on 20 October without a note here; we also said that the offline helper keeps a search results page you open, with your search words, like the other pages it keeps. On 22 October 2026 we named India, where Google Analytics already waited for Accept, in our cookie notice and among the places where Google’s advertising cookies would need your agreement first. On 19 October 2026 we said that our writers’ searches, the fact-check and the hacks tracker now use DeepSeek’s search, with Serper as its backup; we also added Google Analytics, which counts visits with its own cookies alongside Cloudflare Web Analytics, and made our cookie notice a choice (No thanks turns it off and removes its cookies; in Europe, the UK and Switzerland, or wherever we cannot tell where you are, it waits for Accept). Unlike our earlier promise for new analytics partners, Google Analytics runs outside those places until you press No thanks. On 15 October 2026 we said that an interactive chart or table in a story (an HTML embed) loads with the story and may load code from other sites, and that our NewsFeeds flashes are now posted to X, and to LinkedIn when we switch it on, automatically. On 12 October 2026 we corrected how long deleted items stay in our backups (up to about 12 months, because the monthly copies are kept for a year), said that a deleted picture leaves the backup store about 8 weeks later, and removed the line about copies kept off Cloudflare. On 8 October 2026 we added Serper, which our writers’ news searches go through. On 7 October 2026 we said that the NewsRoom keeps a security log of sign-ins and changes for 12 months, and that it is in our backups, said that outlet pictures are always served by our own server, said what stays in our backups and for how long, described the receipt we email for a booking enquiry, said that the one-way hash that stops repeat view and banner counts is kept until the end of the day, named X and LinkedIn, where links to new Originals may be posted automatically, said that a video’s player now loads only when you press play, and corrected the heading of our privacy contact. On 6 October 2026 we described our nightly backups and how long they are kept, the abuse counter for X profile pictures, the outside services our server asks for public data, YouTube preview pictures, and the anonymous banner impression and click totals. On 5 October 2026 we wrote the wording that applies if we switch on advertising (a real Accept/Reject choice before any of Google’s ads load, and Google Funding Choices), named iv-tape and iv-sy-pop, CoinGecko and Kalshi, and added a section on India’s Digital Personal Data Protection Act, 2023. On 3 October 2026 we listed the last prices the ticker keeps in your browser, gave consent as the basis for breaking alerts, said that drafts and documents our writers send to DeepSeek are processed in China, said that we would honour Global Privacy Control if ads are switched on, and changed how to reach us about privacy. On 2 October 2026 we added the optional breaking alerts (web push) and the offline helper (service worker), named our privacy contact, and said how you could opt out of ad personalisation if ads are switched on. The changes on 29 and 30 September 2026 named Cloudflare Web Analytics, the video players some stories include and every note kept in your browser; the limit on messages from our forms now keeps only a hash of your IP address.