Last Updated: August 2026
This Privacy Policy describes how Mera Labs B.V. ("Mera," "Mera News," "we," "us," or "our") processes personal data in connection with the Mera News mobile application and related services.
Mera News is owned and operated by Mera Labs B.V. a company registered in the Netherlands. Mera Labs B.V. is the legal entity responsible for the service and acts as the data controller for personal data processed under this policy.
This policy is intended to explain the service's data-processing model in precise terms. Technical mechanisms such as on-device processing, confidential computing, encryption, and data minimization are described because they determine what data is processed, where processing occurs, and which parties can access it.
The data controller for personal data processed under this policy is:
Mera Labs B.V.
Location: Netherlands
Website: mera.news
Privacy contact: privacy@mera.news
Data Protection Officer: dpo@mera.news
Security contact: security@mera.news
General support: support@mera.news
This policy is prepared with reference to the General Data Protection Regulation (EU GDPR), the Dutch Implementation Act (Uitvoeringswet AVG), and applicable EU privacy rules.
Mera News separates user data into two principal categories:
The service is designed so that user facts remain on the user's device at rest. User topics are transmitted to Mera-controlled infrastructure each time the user requests news and are used to retrieve candidate news items. Topic strings are retained on Mera infrastructure in a shared, anonymous cache keyed by the topic text itself: a single entry per distinct topic string, drawn on by all users, carrying no user identifier, and deleted after 14 days without any request for that topic. No record associates a user with a topic. Topic retrieval is stateless and idempotent: the server does not retain a record of which topics a user requested.
Mera therefore stores a deliberately small set of data attributable to an individual user: account data (the email address used to sign in, and sign-in session records), billing data (subscription status, entitlement, and the identifiers required by the app stores and the subscription-management provider), and plan-enforcement data (a per-day count of articles analysed for the account). A conversation transcript is stored only in the single circumstance described in Section 7, and only when the user chooses to submit it. This limitation is a deliberate design decision. Data that is never collected cannot be disclosed in a breach, produced under legal compulsion, or fall out of compliance with data-protection law as that law develops. Where the user opens the in-app support conversation, the messages they choose to send are held by Mera's in-app support provider rather than on Mera's servers.
AI processing is performed in one of two ways, chosen by the user (subject to device support):
User facts, user topics, reading history, and generated suggestions are all stored on the user's device, and Mera has no access to them. Mera's servers do not store user facts, generated suggestions, reading history, notification decisions, or the inputs and outputs of AI processing carried out on a user's own data. AI processing that Mera performs on news articles themselves — translating them, describing them, and, where a reader asks for it, fact-checking one — does produce results that are stored on Mera's servers; those results describe the article, are identical for every user, and carry no user identifier. Topic strings are held only in the shared, anonymous topic cache described above, which carries no user identifier.
Mera News may collect and store:
Purpose: account authentication, service access, billing, fraud prevention, and service-related communication.
Retention: until account deletion, except where legal retention obligations apply.
Mera News may collect and store:
Purpose: delivery of notifications, selection of the appropriate processing path, technical support, security, and service reliability.
Mera News does not collect device location, contacts, photos, files, or a list of installed applications.
User facts may include:
User facts are stored on the user's device at rest. They are not stored on Mera servers. Where Confidential Cloud Inference is used, relevant payloads are encrypted on the device before transmission and decrypted and processed only inside the secured isolated environment described in this policy.
User topics are generic topic strings derived from user facts. Examples include:
User topics are stored on the user's device, together with user facts, reading history, and generated suggestions, and Mera has no access to this stored data. User topics are transmitted to Mera-controlled infrastructure each time the user requests news.
Topic strings are retained server-side in a shared, anonymous topic cache. That cache holds one entry per distinct topic string, keyed by the text of the topic itself. It contains no user identifier and no owner field; the same entry serves every user who requests that topic, and it is deleted after 14 days in which no user has requested it. The server is stateless and idempotent with respect to user topics and does not retain a record of which topics a user requested. Requests are transmitted over an authenticated connection, so the correctness of this separation presently rests on Mera's server-side implementation, which is not published; the client, which determines what is transmitted in the first place, is source-available and can be independently inspected. Mera is presently restructuring its services so that every component handling user data is published as source-available, and so that the closed news-retrieval service receives topic text with no user identifier, session, device identifier, or client network address attached. Mera expects to complete this before September 2026. Publication of source code does not, by itself, prove which code a server executes; this limitation applies to any service and is stated here rather than omitted.
Purpose: retrieval of candidate news items that may be relevant to the user.
Design objective: user topics are intended to be broad search strings rather than detailed personal profiles. They are not intended to identify a specific individual.
Mera News may collect:
Mera News does not collect:
Retention: request timestamps are deleted after 90 days. Crash logs are deleted after 30 days unless a shorter retention period is technically required or a longer period is necessary for security investigation.
Application state is the set of configuration and connectivity values that describe how the application was running at a given moment. It is collected for one purpose: so that a fault can be reproduced. Mera News may collect and store:
These values describe the configuration the application was running under. They are not derived from user facts, user topics, interests, locations, or reading history, and they do not record what the user read. Application state is transmitted to the providers named in Sections 8.1 and 8.7 alongside the identifiers described there.
Purpose: reproducing and diagnosing a reported or observed fault, distinguishing a device-side failure from a service-side one, and technical support.
Retention: where these values accompany a crash or error report, they are deleted with it after 30 days. Where they are held as attributes of the subscription record described in Section 8.1, each value is overwritten as it changes and the record is deleted with the account.
The user can ask Mera to fact-check what they are reading. There are two ways to do it, and they differ in what leaves the device and in what is kept afterwards. Both are set out here in detail, because both involve sending Mera something taken from one specific article that the user singled out.
The quick answer in chat. In the Mera AI chat on an article, the user can ask for a quick fact check. Mera proposes two to four checkable claims drawn from the article, and the user selects one. The text of the selected claim is sent to Mera's servers, which build up to three short search queries from the claim's content words — the claim is never pasted verbatim — and forward those queries to Brave (Section 8.9). The results are turned into an answer in the conversation. The article's identifier, its address, and its publication are not sent. Nothing is written to Mera's servers: the answer is not stored, it does not appear on the Dashboard, and it creates no fact-check record.
Stated plainly, because it is easy to state less plainly: the claim is a sentence taken from the article the user was reading, so it can be searched back to that article by anyone holding it. It is sent to Mera's servers in the clear — protected in transit, but not encrypted to the isolated environment the way the inference payloads in Section 4.4 are — and it travels with the user's session token. Mera's servers are therefore able to see both the claim and the account it came from at the moment of the request. Brave receives only the short queries, sent from Mera's own infrastructure under Mera's own credentials; it does not receive the user's account, session, device identifier, or network address.
The server-side check. The user can instead ask for the whole article to be checked properly. The app sends Mera's servers the identifier of that one article over an authenticated connection, and Mera runs a longer check that looks for established fact-checking organisations that have already published on the claims. At the moment of the request, Mera's servers are able to see that this account asked about this article. While the check is running, the app repeats that request approximately every six seconds, for at most three minutes or until the user leaves the article, whichever comes first.
That association is not written down. The fact-check record Mera stores is keyed to the article and not to the person who asked. It holds the article's identity, the claims assessed, the verdict, the summary, the sources, and any established fact-checking organisation found to have published on the claim, together with that organisation's own rating. It has no requester field and no user identifier of any kind, and a single record serves everyone who asks about that article. Mera's request logs record the time, method, and endpoint of a request, not its contents, so the article identifier does not enter them; the 90-day retention stated in Section 3.5 is unaffected by this feature.
Stated plainly, because this part is less flattering than a reader may expect: asking for a fact check is a deliberate action taken on a specific article, and Mera's servers necessarily see it as it happens. Mera does not claim that the request is anonymous at the moment it is made. What Mera does claim, and what the storage design enforces, is that no record is kept from which the articles an account asked about could later be listed, and that Mera still holds no history of what the user reads, opens, dismisses, or is notified about.
Purpose: answering the user's request, and, for the server-side check, serving the same answer to anyone who later asks about the same article without repeating the work.
Retention: the quick answer in chat is not retained by Mera at all. A server-side fact-check record that names at least one fact-checking organisation is deleted after 90 days. One that names none is deleted after 7 days, because an answer of "nobody has published on this" can be overtaken by a fact-checker publishing later. Neither record is associated with a user, and neither is affected by account deletion, because neither contains anything attributable to an account.
The following processing occurs on the user's device:
Mera News converts user facts into user topics either on-device or through Confidential Cloud Inference running on NEAR AI infrastructure.
The purpose of this step is to convert detailed local context into broader search terms. User topics are transmitted to Mera servers over encrypted connections each time the user requests news and are used for candidate retrieval. They are retained in the shared, anonymous topic cache described in section 3.4, which carries no user identifier and is deleted 14 days after a topic was last requested by anyone. This processing is stateless and idempotent: the server does not retain a record of which topics a user requested.
Mera infrastructure uses user topics to retrieve candidate news items. Google Cloud Platform may be used for news sourcing, indexing, candidate generation, and delivery infrastructure.
GCP is used for the news-processing pipeline. User facts are not processed on GCP.
Mera News uses AI for topic generation, relevance scoring, and suggestion generation. The user can choose between two inference paths:
Mera does not use user data to train, fine-tune, or improve AI models. Mera does not send personal data to general-purpose AI platforms such as OpenAI, Google, or Anthropic for inference.
For users on the Confidential Cloud Inference path, silent push notifications may trigger periodic background processing. The device prepares an encrypted payload and sends it to the Confidential Cloud Inference environment, where it is decrypted and processed inside a secured isolated environment. The device then determines which news, if any, should be surfaced.
For users on the local LLM path, processing occurs when the user opens the app or otherwise initiates relevant app activity. No server-side background inference is performed for user facts.
Suggestions and notification decisions are generated and stored on the device. Mera servers do not retain generated suggestions, notification decisions, or reasoning about why a particular article was relevant to a user.
Mera News processes data for the following purposes:
Where paid services are introduced or used, account and payment-related information may be processed for billing, subscription management, tax compliance, and financial recordkeeping.
Mera News may use aggregated or anonymized analytics to assess system performance, crash rates, source quality, and broad product reliability.
Mera News does not use analytics to identify individual users or build behavioral advertising profiles.
Under GDPR Article 6, Mera News processes personal data on the following legal bases:
Where processing is based on consent, the user may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.
The list below states what is not retained. Section 3.7 describes the two requests in which a user directs Mera at one specific article: the quick fact check in chat, which Mera does not store at all, and the server-side check, whose record is keyed to the article and carries no user identifier. Neither of them creates anything in the list below.
Mera servers do not store:
One exception, stated explicitly. If the in-app assistant's safety guardrail blocks a user and the user chooses to submit a request to be unblocked, the conversation transcript the user elects to attach to that request is transmitted to Mera servers and stored against the account so that a person can review the appeal. This is the only circumstance in which assistant conversation content reaches Mera servers, it occurs only on the user's own action, and it does not occur during ordinary use. A bounded retention period for these transcripts, and a clearer preview of exactly what is attached before submission, are in development.
Mera News uses third-party service providers only for specific functions described below.
Providers: Apple (App Store), Google (Google Play), and RevenueCat
Data shared: Apple and Google act as the merchant of record and process the payment itself; Mera does not receive or store payment-card details. RevenueCat receives the store transaction identifiers, subscription status, product identifier, and an account identifier used to associate the subscription with the Mera account. RevenueCat additionally receives, as attributes of that subscriber record, the app version and build number, the platform and operating-system version, a bucketed device-capability tier, the over-the-air update identifier and release channel, the app's interface language, the account's onboarding stage, the selected processing path, and the subscription tier recorded on Mera's servers, so that a billing state can be reconciled with the release and configuration the account is running. No email address, name, telephone number, push-notification token, advertising identifier, user fact, user topic, or reading history is sent to RevenueCat
Purpose: subscription entitlement management, purchase validation, renewal and cancellation handling, and financial recordkeeping
Policies: Apple Privacy Policy | Google Privacy Policy | RevenueCat Privacy Policy
Provider: NEAR AI
Function: Confidential Cloud Inference for users who do not run the local LLM
Data shared: encrypted inference payloads and limited network metadata required to deliver the service
Purpose: decrypting and processing encrypted requests only inside a secured isolated environment that publishes an attestation report, and returning encrypted results to the user's device, so that user input and LLM output are not accessible to anyone except the user
Policy: NEAR AI Privacy Policy
Mera does not intentionally provide plaintext user facts, reading history, notification decisions, or generated suggestions to NEAR AI.
Provider: Google Cloud Platform
Function: hosting for news sourcing, indexing, candidate generation, and delivery infrastructure
Data processed: news data, service infrastructure data, and the anonymous user topics described in Section 3.4 as they transit the hosted services
Data not processed: user facts, reading history, or plaintext inference payloads
Providers: Jina AI (text embeddings) and Google (Gemini API), used in our content-processing stack
Data shared: with Jina AI, the topic text described in Section 3.4, and news article text, in order to compute the vector representations used for meaning-based matching; with Google, news article text
Data not shared: no user identifier, session, device identifier, account data, user facts, or reading history accompanies a topic sent for embedding
Purpose: semantic matching of topics to news articles, and cross-language article matching
Policies: Jina AI Privacy Policy | Google Privacy Policy
Providers: Apple Push Notification Service and Firebase Cloud Messaging
Data shared: device token and notification-delivery metadata
Purpose: delivery of silent push notifications or service notifications
Data not shared: article content, user facts, user interests, notification reasoning, or generated suggestions
Provider: MailerSend
Data shared: email address and the one-time sign-in code
Purpose: delivery of one-time passcodes for sign-in and of service-related email
Policy: MailerSend Privacy Policy
Provider: Sentry
Data shared: crash reports, error traces, device model, operating-system version, app version, app build number, over-the-air update identifier, release channel, runtime version, and whether the running code is the bundle embedded in the installed build; a bucketed device-capability tier; an account identifier, which is an opaque internal user identifier and is not an email address, a name, or a network address; the app's interface language; the subscription tier reported by the subscription-management provider together with the tier recorded on Mera's servers; and the application-state values described in Section 3.6, namely the selected processing path, the relevance-engine flag, the free-tier flag, the local model's state, whether the device had network connectivity and could reach Mera's servers, and the account's onboarding stage
Data not shared: user facts, user topics, reading history, or inference payloads. No email address, name, telephone number, push-notification token, or advertising identifier is attached to an event, and the application is configured so that no IP address or operating-system-level identifier is attached to a report
Purpose: diagnosing crashes and defects in the application and backend services
Policy: Sentry Privacy Policy
When the user opens an article, Mera News may direct the user to the publisher's website in an in-app web view or external browser.
The publisher controls the article page and surrounding website experience. The publisher's own terms, privacy policy, cookie practices, advertising systems, subscriptions, paywalls, and account requirements apply. Mera News does not control or receive data about the user's activity on the publisher's website.
Providers: Google (Fact Check Tools API) and Brave Search
Data shared: with Google, the text of a claim taken from a news article and, where it is known, a language code, in order to look up fact checks already published on that claim. Where the analysis produced no distinct claim, the article's headline is sent in place of a claim. The address of the article is never sent, and neither is its identifier or its publication. With Brave, short search queries built from the content words of such a claim. Both requests are made by Mera's own servers under Mera's own credentials
Data not shared: no user identifier, account, session, device identifier, or network address accompanies either request, and neither provider receives user facts, user topics, or reading history. Mera's own logs for these requests record the length of a query and the number of results returned, not the query itself
Purpose: establishing whether a recognised fact-checking organisation has already published on a claim, and gathering current web sources for the quick answer described in Section 3.7
Policies: Google Privacy Policy | Brave Privacy Policy
Provider: Intercom
Data shared: an account identifier, which is an opaque internal user identifier and is not a name or a network address; the email address on the account; the content of the messages the user chooses to send in the support conversation, together with Mera's replies; any photo the user chooses to attach; and technical information Intercom's SDK collects about the session, namely the SDK, app and operating-system version, the device model and type, the app's language and locale, the interface style and text direction, and the device's accessibility settings, such as reduced motion, inverted colours, screen-reader use, and text size. Performance and diagnostic data is also collected, and Intercom declares it as not linked to the user's identity. No advertising identifier is sent, and Intercom does not track the user across apps. Nothing reaches Intercom unless the user opens the support conversation. No user fact, no user topic, no reading history, and no article identifier is sent to Intercom
Purpose: answering the user's support requests, and keeping the conversation available to the user and to Mera's support staff so a request does not have to be repeated
Policy: Intercom Privacy Policy
Mera News uses AI to support:
Mera News does not use AI to make decisions that produce legal or similarly significant effects on users within the meaning of GDPR Article 22.
Users may contact privacy@mera.news to request information about AI-related processing or to object where applicable under GDPR.
Mera News applies technical and organizational measures intended to protect data against unauthorized access, loss, misuse, alteration, and disclosure.
These measures include:
Mera has not yet commissioned an independent third-party security assessment. One is planned, and the scope and date will be published when it has been carried out. Until then, the assurances in this section rest on Mera's own controls and on the published client source, which anyone may inspect.
No transmission or storage method can provide absolute security. If a security incident creates a notification obligation under GDPR Articles 33 or 34, Mera News will notify the competent supervisory authority and affected individuals where required.
| Data Type | Storage Location | Retention Period |
|---|---|---|
| Email address | Mera servers | Until account deletion |
| Session and sign-in records | Mera servers | Until expiry or account deletion; Mera does not store passwords, as sign-in uses one-time codes |
| Subscription status and entitlement | Mera servers | Until account deletion |
| Billing records | Mera servers / app stores / RevenueCat | 7 years where required by Dutch law |
| Daily analysis counts | Mera servers | Retained per account for plan enforcement; a bounded retention period is in development |
| Submitted unblock-request transcripts | Mera servers | Retained until reviewed; a bounded retention period is in development (see Section 7) |
| Anonymous user topics | Stored in a shared, anonymous cache keyed by the topic text, with no user identifier and no owner field | Deleted 14 days after the topic was last requested by anyone |
| Server-side fact-check records | Mera servers, keyed to the article with no user identifier | 90 days where at least one fact-checking organisation is named; 7 days where none is |
| Quick fact-check claims and answers | Not stored by Mera; the answer exists only in the conversation on the user's device | Discarded once the answer is returned |
| Request timestamps | Mera servers | 90 days |
| Crash logs | Mera servers / Sentry | 30 days |
| User facts | User device | Until app uninstall, local data deletion, or account-related deletion flow where supported |
| User topics (device copy) | User device | Until app uninstall, local data deletion, or account-related deletion flow where supported |
| Suggestions | User device | Until app uninstall, local data deletion, or account-related deletion flow where supported |
| Reading history | User device | Until app uninstall, local data deletion, or account-related deletion flow where supported |
| Confidential Cloud Inference inference data | Not retained by Mera; decrypted and processed only in a secured isolated environment | Discarded after processing |
| Support conversations | Intercom | Retained while the account exists; a bounded retention period is in development |
Mera News is operated from the Netherlands and is subject to EU data-protection law.
Primary storage for account data is intended to occur in EU data centers. User topics are held in the shared, anonymous topic cache on the same infrastructure and carry no user identifier. The app stores, the subscription-management provider, and other service providers named in Section 8 may process data outside the European Economic Area where necessary. Where a transfer requires a Chapter V safeguard, Mera relies on the mechanism offered by that provider, typically its standard contractual clauses or an adequacy decision covering the destination. Mera is in the process of reviewing and documenting the transfer basis for each provider in Section 8 individually; users who need to know the position for a specific provider may ask at the address in Section 19.
Intercom hosts support conversations in the United States.
For Confidential Cloud Inference, encrypted payloads may be transmitted to NEAR AI infrastructure. Because payloads are encrypted on the device before transmission and are decrypted and processed only inside a secured isolated environment, Mera servers do not receive plaintext user facts through this processing path.
Mera News is primarily a mobile application.
The mobile application does not use browser cookies for ordinary app functionality. Local storage is used to store user facts, user topics, preferences, reading history, generated suggestions, session information, and local article state on the user's device.
The website at mera.news may use:
Mera News does not use advertising cookies, social media tracking pixels, or third-party marketing cookies.
Users can manage cookies through browser settings. Disabling essential cookies may affect website functionality.
If legally required by valid legal process, Mera News may provide data that it controls, such as:
Mera News cannot provide data it does not possess, including:
Where legally permitted, Mera News will notify affected users of legal requests. Mera News may challenge requests that appear overbroad, unlawful, or inconsistent with applicable legal standards.
Users have the following rights under GDPR and applicable Dutch law, subject to statutory conditions and limitations.
Users may request a copy of personal data processed by Mera News. This may include account information, subscription status, and request timestamps.
Mera News cannot provide user facts, reading history, generated suggestions, or a record of requested user topics, as these either exist only on the user's device or are not stored by Mera.
Users may request correction of inaccurate personal data. Certain data may be corrected directly in app settings.
Users may request deletion of their account and associated personal data. Upon valid request, Mera News will delete:
Deletion of the account does not require deletion of the anonymous topic cache described in Section 3.4, because no entry in that cache is associated with the user; entries expire on their own schedule.
Stated plainly, because it affects what a deletion request currently achieves: the in-app account-deletion function does not yet remove every category above in a single pass, and the automation that will do so is still being built. A request made under Article 17 to the address in Section 19 will be acted on and completed within the statutory period of one month; the in-app function alone should not presently be relied upon to remove everything.
Billing records may be retained for the legally required period.
Users may request export of their personal data in a structured, commonly used, machine-readable format, where applicable.
Users may request that Mera News restrict processing in circumstances provided by GDPR.
Users may object to processing based on legitimate interests. Mera News will assess the objection in accordance with GDPR.
Users have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Mera News does not perform such decision-making.
Where processing is based on consent, users may withdraw consent at any time.
Users may lodge a complaint with a supervisory authority. In the Netherlands, the competent authority is the Dutch Data Protection Authority:
Authority: Autoriteit Persoonsgegevens
Website: https://autoriteitpersoonsgegevens.nl
Telephone: +31 (0)70 888 8500
Address: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, Netherlands
To exercise rights, contact privacy@mera.news.
Mera News will respond within 30 days where required by GDPR. In complex cases or where multiple requests are received, this period may be extended by up to two additional months. If an extension is required, Mera News will inform the user within the initial 30-day period.
Mera News may request identity verification before processing a rights request. A fee may be charged only where permitted by GDPR, such as for manifestly unfounded or excessive requests.
Mera News is not directed to individuals under 16 years of age. Mera News does not knowingly collect personal data from children under 16.
If Mera News becomes aware that a child under 16 has provided personal data, reasonable steps will be taken to delete that data. Concerns may be sent to privacy@mera.news.
If Mera Labs B.V. is involved in a merger, acquisition, reorganization, sale of assets, or other business transfer, account data and operational records may be transferred as part of that transaction. Because the topic cache contains no user identifier, it holds nothing attributable to an individual user in any such transfer.
Mera News will provide notice where required by law. User facts stored only on user devices are not part of server-side business-transfer records unless separately provided by the user or otherwise processed in a manner described in an updated policy.
Mera News may update this Privacy Policy to reflect changes in the service, data-processing practices, legal requirements, or technical implementation.
Material changes will be communicated through one or more appropriate channels, such as email, in-app notice, or notice on the website. The updated policy will apply from the date stated in the updated version.
Users who do not agree with an updated policy may stop using the service and request account deletion.
For privacy questions or data-rights requests:
Email: privacy@mera.news
For data-protection matters:
Data Protection Officer: dpo@mera.news
For security reports:
Email: security@mera.news
For general support:
Email: support@mera.news
Operator: Mera Labs B.V.
Location: Netherlands