Newmi
Security
What we do to protect your account and data, and what is still being finished. We only list things that are in the code.
Signing in
- Sign in with Apple is verified on our servers before a Newmi session is created.
- Sign in with ChatGPT follows OpenAI’s sign-in rules: PKCE, a one-time state, a nonce, and checks of the token’s signature, issuer, audience and expiry. It stays switched off until OpenAI approves Newmi.
- Two sign-in methods are never joined because their email addresses match. You must confirm that you own both accounts before they are merged, and both must have signed in recently.
- Sign in with ChatGPT is identity only. It does not give Newmi access to your ChatGPT plan or conversations.
Your sessions
- On iPhone and iPad, session tokens are kept in the system Keychain, not in preferences.
- Access tokens and refresh tokens both expire. Merging accounts signs out the old sessions of both accounts.
- You can sign out at any time.
Your data
- Reading does not need an account. Without one, your saved stories and reading history are not stored on our servers.
- Summaries are written on your device. The article text is not sent to an AI service.
- Our server logs do not contain request bodies, headers, cookies, query strings, email addresses or credentials. Fields that look like secrets are redacted.
- In production the database connection is configured to verify its certificate.
- The reader blocks a curated list of ad and tracker hosts. It is not a guarantee that every one is blocked.
This website
- It is served over HTTPS only, with a strict Content-Security-Policy that allows no third-party scripts, and has no analytics or advertising trackers. Story images and videos load directly from the publishers’ servers (with no referrer sent), so those publishers can see that your browser asked for them; nothing else on a page contacts a third party. It sets no cookies unless you sign in or choose interests: then it sets a strictly necessary, encrypted, HttpOnly sign-in cookie, or a small preference cookie for your interests. Your sign-in tokens stay on our server and are never given to your browser.
Still being finished
- Deleting your account is available in the app and on this website once sign-in is switched on. Until then, email us and we will delete your account and its data.
- Sign in with Apple and ChatGPT on this website. The account page is built; Apple sign-in is switched on when its configuration is complete, and ChatGPT sign-in when OpenAI approves Newmi.
Report a vulnerability
If you find a security problem, email support@newmi.app with the details. Please give us a reasonable time to fix it before you share it, and do not access other people’s data. We will answer and tell you what we decide. Our details are also in security.txt.