Legal

In short: Drift keeps your feeds, articles, and reading state on your own device. It contacts the internet only to fetch the feeds and articles you add, and — only if you turn it on — to sync with a server address you provide. LFJ Softworks does not run that server, does not receive your data, and doesn't use analytics, ads, or trackers of any kind.

1. What Drift is

Drift is a local-first, open-source RSS reader for Android and Linux (with Web and macOS in progress). Each install works fully offline: it fetches feeds directly from the sources you add and keeps its own local database. An optional sync feature lets a device exchange subscription and read-status changes with a server — but you must explicitly turn this on and supply the server's address; nothing is synced by default. Because Drift is open source, anyone can inspect exactly what the code does, including everything described below: the source is public.

2. Data stored on your device

Drift stores the following locally, in a SQLite database and your OS's app-private storage. None of it is sent anywhere unless you enable sync (see §4):

• The feeds you subscribe to (their URLs and titles)
• Articles fetched from those feeds, and their read/unread and starred status
• Tags you create and assign to feeds
• Full article text, only for feeds where you enable "full-text fetch"
• App settings, including a sync server address and device credentials if you set up sync (see §4)

Uninstalling the app, or clearing its data, deletes all of this. Drift also provides OPML export/import so you can back up or move your subscriptions yourself.

3. Network requests Drift makes on your behalf

Drift has no server of its own that it talks to by default. Every network request it makes is one you caused, and goes to a destination you chose or that a feed you chose points to:

• Feed URLs — when Drift refreshes a subscription, it requests that feed's URL directly. That feed's operator will see a request from your device (IP address, timestamp, and similar metadata any web server logs), the same as if you'd visited it in a browser.
• Article pages — if you enable "full-text fetch" for a feed, Drift additionally requests the full article's own page directly from the site that published it, to extract the full text.
• Article images — images embedded in articles are loaded directly from wherever the article's HTML points them to.

These requests go directly from your device to those third-party sites — Drift's developer (LFJ Softworks) is not an intermediary and does not see, log, or receive any of this traffic. Each site's own privacy practices govern what they do with a request they receive; Drift has no control over that.

4. Optional sync — and who actually receives that data

Drift's sync server (also open source) is self-hosted: to use it, you deploy your own instance, or point Drift at one someone else runs. LFJ Softworks does not operate any sync server, official or otherwise, and never receives, stores, or has access to any data you sync — whoever controls the server address you enter is the one who receives that data, and they are responsible for it, not LFJ Softworks. If that's not you, ask them about their own data handling before enabling sync.

If you do turn sync on, here's exactly what's exchanged with that server:

• On first setup, your device registers once using a token you enter (chosen by whoever runs the server), receiving back a random device ID and a random device secret.
• Every sync afterward sends: feed URLs and titles, article identifiers (not full article content), read/unread and starred status, and tags — timestamped, so the server can relay them to your other devices.
• Requests are authenticated with a signature computed from the device secret; the secret itself never travels over the network after the initial setup, and is stored in your OS's secure credential storage (Android Keystore, or libsecret on Linux) rather than in a plain settings file.
• Only HTTPS server addresses are accepted.

By default, the reference server software deletes synced events older than about 270 days at startup. A server operator can change or disable this — since they control the server, they control its retention period, not LFJ Softworks.

5. What Drift does not do

• No account or sign-up of any kind
• No analytics, telemetry, or crash-reporting SDKs
• No advertising or ad-tracking SDKs
• No sale or sharing of data — there is no data collected by LFJ Softworks to sell or share in the first place
• No access to your contacts, location, camera, microphone, or files, beyond what you explicitly use (e.g. picking a file for OPML import)

6. Permissions

Drift's Android build requests exactly one runtime permission: notifications, used to alert you about new articles from background feed refreshes. You can deny or later revoke this in your device settings; Drift will keep working without it, just without notification alerts.

7. Children's privacy

Drift is not directed at children and is not intended for use by anyone under 13 years old (or a higher minimum age where required by local law, e.g. 16 in some EEA member states). It doesn't knowingly collect personal data from children, and — since it collects no personal data on its own servers at all — there is no such data to have collected.

8. Your control over your data

Because everything Drift stores lives on your own device, you control it directly: export your subscriptions via OPML at any time, or uninstall the app to remove everything. If you've enabled sync, the server operator you synced with controls what's stored there — contact them to request access to, correct, or delete it. Since Drift is self-hosted software, LFJ Softworks has no account system and no way to look up, access, or delete data on your behalf for any server it doesn't operate — which is every server, since it operates none.

9. GDPR / EEA users

Controller. LFJ Softworks, a company registered in Estonia, is the developer of Drift and, for the purposes of this section, the data controller for the limited processing described below.

Controller or not, depending on the flow. For most of what Drift does — fetching your feeds, fetching full-text articles, loading article images, and any optional sync — LFJ Softworks never receives, sees, or stores your data at all (see §3 and §4). Where LFJ Softworks doesn't receive data, it isn't acting as a controller or processor for that data under the GDPR; the recipient you or your feeds send requests to (a feed's operator, or a sync server's operator) is responsible for that data instead.

Legal basis. Data stored only on your own device (§2) is processed on the basis of your direct control and instruction — you install the app and choose what to subscribe to; there's no separate legal basis to state because LFJ Softworks isn't processing it. To the limited extent LFJ Softworks processes any personal data at all (for example, if you email or file a GitLab issue with us), the basis is legitimate interest in responding to your inquiry, or your consent in providing that information.

Your rights. Under the GDPR, where LFJ Softworks does act as a controller, you have the right to: access the personal data we hold about you; request its rectification or erasure; restrict or object to its processing; and request its portability. Since Drift's normal operation involves no personal data reaching LFJ Softworks in the first place, most of these rights are self-serving in practice — export or delete your local data directly (§8) — but you can still exercise them regarding any direct correspondence you've had with us (e.g. a support request).

Supervisory authority. You have the right to lodge a complaint with a data protection supervisory authority. As LFJ Softworks is established in Estonia, that's the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — or you may instead contact the supervisory authority in your own EU/EEA member state.

10. Changes to this policy

If this policy changes, the update will be published at this same address with a new "Last updated" date above. Since Drift is open source, any change in what the app actually does is also visible in its public source history.

11. Contact

Questions about this policy or how Drift handles data are best asked in the open, where the answer benefits everyone: open an issue on the GitLab repository.