Privacy Policy
At Headline Recorder, your privacy is paramount. We're transparent about how we collect, use, and protect your data. This policy explains our practices in clear, human language.
Introduction
We believe in transparency. This Privacy Policy explains how Headline Recorder collects, uses, discloses, and safeguards your information when you read our website, subscribe to our newsletter, create an account, or send us a submission.
Headline Recorder is responsible for the personal data described here. Our registered address is First Floor, Feroze Heights, Saadi Town, Karachi, Sindh 75280, Pakistan, and you can reach us about privacy at contact@headlinerecorder.com.
Data We Collect Automatically
Like every website, our servers receive some technical information with each request. We use it to deliver pages, keep the site secure (for example, to stop password-guessing and spam) and fix problems.
Collected Data
- IP address, browser type and version, operating system and device type
- Referring site and the page requested
- Date and time of each request
Server logs are kept by our hosting provider for a limited period for security and troubleshooting. Our own security records store your IP address only in a pseudonymised (keyed-hash) form.
Third-Party Analytics
We use Google Analytics (via Google Site Kit) to understand which articles readers find useful and how people move around the site, only if you allow analytics in our cookie banner. We do not use it for advertising.
We use Google Consent Mode. Until you choose, analytics and advertising storage are set to “denied”. Google’s analytics tag is not loaded at all until you accept analytics. If your browser sends a Global Privacy Control signal, we treat it as “reject” and analytics stay off.
You Have Control
You can change your choice at any time with the “Cookie settings” link at the bottom of every page. You can also install the Google Analytics Opt-Out Browser Add-on, which stops your browser sending data to Google Analytics on any website.
Information You Provide
You can read Headline Recorder without an account. When you choose to contact us, subscribe or sign up, we collect information such as:
- Contact and media-kit forms: your name, email address, subject and message. They are emailed to our team and kept in our inbox only as long as we need them to reply and keep a record of the conversation.
- Newsletter: your email address, sent to Mailchimp (Intuit), which delivers the Intelligence Briefing. You confirm your subscription by email, and every newsletter has an unsubscribe link.
- Comments on our articles, if you post them (see Public Interactions).
- Story pitches and inquiries you send us by email.
- Account and submission details, described in the next sections.
We use this information only to: respond to your inquiries, send newsletters you've subscribed to, run your account, review your submissions, and improve our services. We never sell your data to third parties.
Accounts & Sign-in
An account is optional. You need one to keep a reading streak and to submit articles or op-eds. When you have an account we store:
- Your name and email address: to identify you, sign you in and send account messages (verification, password reset, security alerts).
- A password hash: your password is never stored. We keep only a one-way Argon2id hash of it.
- Passkey public keys, if you add a passkey. The private key never leaves your device.
- Your two-step verification secret, if you turn it on (stored encrypted), plus one-way hashes of your recovery codes.
- Session records: for each signed-in session, when it started and expires, how you signed in, the browser and device type, and the IP address it started from. You can see and end your sessions in your account settings.
- Known devices: a random device ID in a cookie, of which we store only keyed hashes of your last 10 devices, so we can email you a new-device alert when your account is used from a device we have not seen before.
We keep this information until you delete your account. Sessions end when you sign out or when they expire.
Reading Activity & Streaks
When you are signed in, we record which articles you finish reading and on which dates, and work out your streak statistics (current and longest streak, articles read). We do this only to show you your own reading streak and history. Nothing is recorded while you are signed out, and your reading activity is never shared or used for advertising.
We keep your reading activity until you delete your account. You can download it with the rest of your data, or delete your account and everything with it, from your account settings.
Submissions
Signed-in writers can submit articles and op-eds. A submission includes your headshot, a short intro, your title or designation, your email address, the headline, the type (article or op-ed), a category and the text.
End-to-end encrypted
Your piece and the details you add to it are encrypted in your browser before they are sent, using post-quantum ML-KEM-1024 (combined with P-384) and AES-256-GCM. Only our editors can decrypt them, in their own browsers, with a key that is kept off our web server. The headline, type, category, word count, whether a file is attached and the contact email you give stay unencrypted, together with your account and the date, so editors can manage the queue and reply to you. If you tick “Remember my name, title and intro”, those three details are kept unencrypted with your account until you untick it or delete the account.
Editors receive an email notice when a new piece arrives (without its contents). We keep submissions for as long as we need them to review your piece and keep an editorial record. If we do not publish a piece, you can ask us to delete it at any time; deleting your account deletes all of your unpublished submissions. If we publish it, it becomes a public article with your byline, headshot and intro.
Public Interactions
If you post comments on our articles, the name and comment you post become public. We cannot control how others use that information, so please be cautious about sharing personal details publicly.
Example: If you leave a comment with your name, that comment and your name will be visible to all site visitors. Your email address is never shown. Avoid sharing sensitive information in public sections.
AI Transparency
To ensure timely news coverage, Headline Recorder may utilize AI-assisted technologies for content summarization or optimization. All AI-assisted content is reviewed by human editors to maintain our standards of accuracy and integrity. We do not put your personal data, your submissions or your reading activity into AI tools.
🤖 How We Use AI
- Content summarization and headline optimization
- Drafting Podcast briefings from our published articles
- All AI output reviewed by human editors before publication
Error Monitoring
We use Sentry to find and fix errors and slow pages. When something breaks, Sentry receives technical details: the error message, the page address (with sensitive values such as sign-in tokens removed), the browser and operating system, and timing information. We configure it not to collect names, email addresses, cookies or form contents, and not to store your IP address.
Content Signing
Every article and feed we publish is digitally signed (ML-DSA-87 + Ed448) so anyone can check it is genuine on our verify page. Signatures cover only published content and contain no personal data. Verification runs in your browser; we do not record what you verify.
Security Measures
- The whole site uses HTTPS, with security headers that limit what scripts can run.
- Passwords are stored only as Argon2id hashes, and new passwords are checked against known data breaches.
- You can sign in with a passkey and turn on two-step verification; staff accounts must use two-step verification.
- Sign-in, registration and password-reset attempts are rate-limited, and we email you when your account is used from a new device.
- Submissions are encrypted end to end, and our articles are signed so they cannot be altered unnoticed.
No system is perfectly secure. If we ever learn of a breach that affects your personal data, we will tell you without undue delay.
Service Providers & Legal Disclosure
We share personal data only with service providers that help us run the site, and only what they need: our web host, Mailchimp (newsletter), Google (Analytics, if you allow it, and reCAPTCHA), Sentry (error monitoring) and our email provider. Some of them process data outside Pakistan.
We will only share your personal data otherwise if required to do so by a competent court of law or an enforceable governmental request. We will notify you of any such disclosure unless legally prohibited from doing so.
Your Rights
You have the right to:
- Access and export the data we hold about you. Account holders can download it from account settings (Privacy & data → Download your data).
- Correct inaccurate data. You can change your name and email address in account settings.
- Delete your data. You can delete your account, with your reading history, from account settings (Privacy & data → Delete your account).
- Object to or withdraw consent for processing. For example, switch analytics off in “Cookie settings”, or unsubscribe from the newsletter at any time.
- Port your data to another service, using the export.
For anything you cannot do yourself, email us at contact@headlinerecorder.com. We may need to confirm your identity first, and we reply within 30 days.
Contact & Changes
Questions about this policy or your data: contact@headlinerecorder.com, or write to Headline Recorder, First Floor, Feroze Heights, Saadi Town, Karachi, Sindh 75280, Pakistan.
When we change this policy we update the date at the top. If a change affects how we use account holders’ data, we will tell you by email or on the site before it takes effect.