Privacy Policy

1. Who we are

Murmur is an audio-first news briefing app operated by Tenet Oyun Yazılım ve Pazarlama Ltd. Şti., a limited liability company organised under the laws of the Republic of Türkiye ("Murmur", "we", "us"). We are the controller of the personal data described in this policy. You can reach us at support@murmur.news.

This policy covers the Murmur iOS app, the backend that serves it at app.murmur.news, and this website at murmur.news. It does not cover the publishers whose articles Murmur links to — once you tap through to a news site, that publisher's own privacy policy applies.

2. Your identity in Murmur

Murmur has no sign-up. The first time you open the app it creates an anonymous identifier through Firebase Authentication — a random string, not derived from you, your device or your hardware. It is not linked to a name, an email address, a phone number or a social account, because we never ask for any of those.

That identifier is what lets your interests and your subscription follow you if you reinstall the app in the same session. We treat it as personal data and describe it that way throughout this policy, even though on its own it does not identify you to a person.

Full accounts, with sign-in and cross-device sync, are planned for a later version. When they arrive, this policy will be updated before they ship.

3. What the app collects

Almost everything Murmur remembers about how you listen stays on your phone. This is what is held where.

Stored on our servers, against your anonymous identifier

What	Why
Your interest settings	The categories you switched on, any keywords you typed, and your chosen brief length in minutes. These are what your brief is built from. They are never included in analytics, never written to our application logs, and never sent to any third party.
Your subscription status	Whether the anonymous identifier currently holds an active entitlement, and until when. This is what tells the app whether to play today's brief or show the subscribe screen.
Playback events	A structural record of listening — described in full in section 4.

Stored only on your phone

• Where you were in a brief, so it resumes in the right place.
• How many briefs you have finished, and which editions you tend to finish.
• Your caption setting, your default playback speed, and your morning reminder time.
• The answers you gave during first-run setup, before they are saved as interests.

None of this leaves the device except where an event in section 4 says so. Deleting the app deletes all of it.

Technical data

When the app requests a brief, our server necessarily receives your IP address and a standard user-agent string, as any web request does. We use them to serve the response and to protect the service from abuse; we do not build profiles from them, and we do not join them to your interest settings.

4. Analytics, precisely

Murmur measures whether people actually listen — start, finish, skip, tap through to a source. That is the difference between knowing whether the product works and guessing. It is done with a short, fixed list of events and properties, and anything not on that list is discarded in the app before it reaches any analytics service.

The events cover, in structural form only:

• Which brief you opened, started, resumed, progressed through or completed, and its type (morning, midday or evening).
• Which story started, finished, was skipped, replayed or opened for detail, how far into it you got, and how many publishers it drew on.
• Settings changes: captions on or off, playback speed, whether the morning reminder is on and the hour it is set for — never the minute.
• First-run setup: which step you were on, and how many things you chose. Never which ones you typed.
• Subscription structure: a subscribe screen was shown, a subscription started or ended. No amounts, no payment details.
• Whether a story was handed to the iOS share sheet, and whether the sheet was used or dismissed. Where you sent it is not something iOS tells us, and we would not record it if it did.
• A segment that failed to load and was skipped past, so we can see when audio is failing quietly.

To compare groups of listeners we also set a handful of coarse properties: a bucketed count of briefs finished ("2–4", not "3"), which edition you finish most often, whether captions are on, your playback speed, whether your brief is interest-shaped, and whether the app is a debug or release build.

Analytics is reported to Google Firebase Analytics, which assigns its own app-instance identifier and may record coarse device and region information under Google's terms. A smaller subset of the same events also goes to our own server, so we can see the newsroom's own numbers without depending on a third party. Firebase Analytics does not power advertising for us — we run none — and we have not enabled Google Signals or advertising features.

5. Location and weather

Murmur can open your morning brief with a line about the weather where you are. This is optional and off until you switch it on.

When you do, exactly this happens:

• iOS asks your permission, and the app takes one low-accuracy position fix while you are using it. There is no background location and no continuous tracking.
• That fix is matched, on your phone, against a built-in list of about sixty broad public forecast areas. If none is within roughly 150 km, you get no weather rather than a wrong one.
• The coordinates are then discarded. They are never stored and never transmitted. What our server learns is the name of a forecast area — the same thing you could have chosen from a list.

You can revoke location access at any time in iOS Settings, or turn the weather line off in the app; neither affects anything else. The forecast itself comes from the Norwegian Meteorological Institute (MET Norway), which receives the area, never you.

6. Notifications

Murmur has no push notification infrastructure. We cannot send you a message, because there is no channel through which to send one. There is no device token, and no server-side notification list exists.

The only notification in the product is an optional morning reminder that your brief is ready. It is off by default, you choose the time, and iOS schedules it locally on your phone. There are no breaking-news alerts, no streaks and no re-engagement messages, and the reminder never mentions your topics or which stories matched them.

7. Subscriptions and payment

Murmur is sold as an auto-renewing subscription through the Apple App Store. We never see your payment details. Apple takes the payment and holds the card; we receive no card number, no billing address and no name.

Purchases are managed for us by RevenueCat, which receives your anonymous identifier and the App Store receipt so it can tell our server whether the subscription is active. RevenueCat also receives standard technical data about the device making the purchase. Our server stores only the fact that the identifier is entitled, and until when.

8. This website

murmur.news is a static site. It sets no cookies, runs no analytics or advertising scripts, embeds no third-party trackers, and loads its fonts from its own server rather than from a font provider. Nothing here follows you anywhere.

If you join the waitlist:

• We store your email address, the date you joined, and the two-letter country code our host reports for the request — the last so we can judge where to open first.
• We use it to send you one message, when there is a place for you in the app. It is not a newsletter, we do not sell or share the list, and you can ask us to remove you at any time by writing to support@murmur.news.
• To stop automated abuse we briefly keep a salted, truncated hash of the submitting IP address, which expires after an hour. The address itself is never written down.

The site is served by Cloudflare, which processes requests as our infrastructure provider and keeps operational logs for security purposes.

9. What we never collect

This list is as much a part of the product as the features are. Murmur does not collect, and does not have:

• Your name, email address or phone number, to use the app.
• Your precise location, ever, in any form, on any server.
• Your contacts, calendar, photos, microphone, health data or files.
• Advertising identifiers, cross-site identifiers, or any third-party advertising or tracking SDK. We do not use the App Tracking Transparency framework because we do not track.
• Your interest keywords in analytics or logs — not raw, not hashed, not truncated, not shortened. They exist to build your brief and nothing else.
• The text of what you listened to, tied to you. Story identifiers are structural; transcripts are not sent anywhere.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California and comparable US state privacy laws.

10. Who else touches data

Who	What they receive
Google (Firebase)	Anonymous authentication, and the allowlisted analytics events and properties in section 4.
RevenueCat	Your anonymous identifier and App Store receipt, to determine subscription status.
Apple	The transaction itself, under Apple's own privacy policy. We receive no payment details from it.
Cloudflare	Serves this website and the app's audio files, and processes the requests that reach them.
OVHcloud	Hosts our backend server, in the United States. They hold the machine, not a separate copy of your data.
MET Norway	The name of a broad forecast area, if you turned weather on. Never a coordinate, never an identifier.

11. Retention and deletion

• Interest settings are kept while you use Murmur, and deleted when the anonymous identity is deleted.
• Analytics events are kept in aggregate. Firebase Analytics applies its own retention window, currently set to the shortest period Google offers.
• Subscription records are kept as long as required for tax and accounting purposes.
• Waitlist addresses are deleted once the app is open and the launch message has been sent, or sooner on request.
• On-device data disappears when you delete the app.

To have your anonymous identity and everything stored against it deleted, write to support@murmur.news from the device, or ask us and we will tell you how to find the identifier in the app. We will action it within 30 days. Because there is no account, we cannot look you up by name or email — the identifier is the only handle that exists, which is a consequence of collecting so little.

12. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to our use of your personal data, to data portability, and to withdraw consent. Where the GDPR or UK GDPR applies, our legal bases are: legitimate interests for running and securing the service and measuring whether it works; contract for delivering the subscription you bought; and consent for location and for the waitlist email, each of which you can withdraw at any time.

Exercise any of these by writing to support@murmur.news. We do not charge for it and we will not make the product worse for you because you asked. If you are in the EEA or UK you also have the right to complain to your local data protection authority.

Our servers are in the United States. If you use Murmur from outside the US, your data is transferred there; where required, transfers rely on the European Commission's Standard Contractual Clauses.

13. Children

Murmur is a general news product intended for adults. It is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with data, write to support@murmur.news and we will delete it.

14. Publishers and news content

This section is about other people's data rather than yours, but it belongs in the same document.

Murmur reads publicly available news pages and feeds. It identifies itself honestly, respects robots rules — failing closed when they cannot be read — keeps conservative per-domain rate limits, and never works around a paywall, a login or a CAPTCHA. Extracted article text is transient: it is blanked after a short retention window, leaving only the URL, the title and the structured facts with their provenance. Publishers can have their material removed or downgraded to metadata-only at any time by writing to support@murmur.news, and we act on it the same day.

15. Changes

If we change this policy we will update the date at the top, and for anything material we will say so in the app before the change takes effect. We will not quietly start collecting something this document says we do not.

16. Contact

Tenet Oyun Yazılım ve Pazarlama Ltd. Şti.
support@murmur.news

Privacy questions, deletion requests, publisher takedowns and everything else all reach the same place, and a person reads them.