Privacy.

When you create an account or browse logged in, Lantern stores:

• Your email — provided by you (magic link) or fetched once via OAuth (GitHub, Google). It's the key identifier for your account.
• Your public name and avatar — only if you sign in via GitHub or Google and these are exposed by those platforms. Lantern reads nothing else.
• Your article favorites, personal notes and filter preferences — created by you from the interface.
• A few functional cookies — a language cookie (NEXT_LOCALE) and, if you sign in, two to three Auth.js cookies (CSRF, callback, session). Full breakdown in the Cookies section below. All are strictly necessary or functional — no third-party cookie, no advertising cookie, no analytics cookie.

That's it. No IP logged for analytics, no browser fingerprint, no third-party pixel, zero third-party script loaded.

Each piece of data collected serves one specific purpose, and one only:

• Email → authentication (magic link + OAuth) and weekly digest delivery if you subscribe.
• Name/avatar → personalized display in the UI (e.g. account badge).
• Favorites/notes → saving your reading, personalizing the weekly digest.
• Session cookie → keeping you logged in between pages without re-login on each click.

No data is used for advertising, commercial profiling, resale, or behavioral analysis. Lantern does not sell your data. Lantern has no business model based on your data.

Under article 6 of the GDPR, Lantern processes your data on two legal bases:

• Consent — when you create an account, you voluntarily agree to share your email for authentication. If you subscribe to the weekly digest, you give explicit consent for receipt. You can withdraw this consent at any time by deleting your account or unsubscribing from the digest.
• Legitimate interest — for the minimal functioning of the service (saving your favorites, session cookie). Without these, the service cannot work.

No processing is based on a legal obligation, a commercial contract, or the protection of vital interests. Lantern has no obligation to disclose to authorities except a duly issued judicial requisition.

To work, Lantern relies on a few third-party services. Each sees a limited portion of your data, for a specific use. All are established providers with a proper GDPR framework in place.

• Vercel (US, EU edge) — hosting of the site and Server Actions. Sees incoming HTTP requests (URL, headers, IP at infra level). DPA in place.
• Neon (EU — Frankfurt) — Postgres database. Stores your email, favorites, notes, sessions. EU hosting to minimize transfer outside the EU.
• Resend (US) — sends magic links (auth emails) and the weekly digest if you subscribe. Sees your email and the content of the email sent. DPA signed.
• OpenAI (US) — scoring and summarizing of public articles ingested. No personal data sent: only titles and excerpts of public articles (RSS, Hacker News, Reddit) are transmitted for scoring. Your favorites or notes are never sent.
• GitHub & Google (US) — only if you choose OAuth sign-in. Lantern reads your email, public name, and avatar once at account creation, and nothing else. No access to your repos, contacts, calendar, or anything else.

You can export all your data from /favorites (JSON) at any time.

Lantern sets between 2 and 4 cookies on your browser depending on what you do. All are first-party, all are functional or strictly necessary, none is used for tracking or advertising.

Always set (public browsing)

• NEXT_LOCALE — language preference cookie set by next-intl. Remembers your locale (fr or en) to serve the right version. Non-sensitive, non-third-party.

Set as soon as you visit /sign-in

• authjs.csrf-token — Auth.js CSRF token, protects the sign-in form against cross-site attacks. httpOnly, sameSite=lax.
• authjs.callback-url — return URL after successful authentication. httpOnly, sameSite=lax.

Set once signed in

• authjs.session-token (in prod: __Secure-authjs.session-token) — Auth.js session cookie. httpOnly, secure in prod, sameSite=lax. Lifetime: 30 days. Keeps you logged in between pages. Destroyed on sign-out or account deletion.

No other cookie. No third-party cookie, no ad pixel, no analytics tracker, no fingerprint, no local storage for tracking purposes. The CNIL (and the e-Privacy directive) exempts language and authentication cookies from consent banners (they are "strictly necessary for a service explicitly requested by the user").

Retention period

Your data is kept as long as your account exists. You can delete it at any time.

• Account deletion → send an email to the contact address below. All your data (email, favorites, notes, sessions) is erased within 7 days, including technical backups.
• Prior export → you can export your favorites in JSON from /favorites before requesting deletion.

Your rights (GDPR articles 15 to 22)

You have the following rights over your data:

• Access — JSON export from /favorites, or by email request for other data (sessions, account).
• Rectification — change your preferences and notes directly from the interface. For your email, request by email.
• Deletion — by email request (procedure above).
• Portability — the JSON export is in an open, reusable format.
• Objection / withdrawal of consent — delete your account, or unsubscribe from the digest via the email received (Unsubscribe link).

Any request is processed within 30 days maximum, per GDPR article 12. If you believe your rights are not respected, you can file a complaint with the CNIL (cnil.fr).

• HTTPS everywhere — encrypted TLS 1.3 connection, HSTS enabled (the browser refuses an unencrypted connection).
• DB hosted in EU — Neon Frankfurt, no transfer outside the EU for storage.
• No password stored — authentication goes through magic link (single-use email) or OAuth (GitHub/Google). Lantern handles no password hash, no recovery question.
• Session cookie — httpOnly (inaccessible to JS), secure (HTTPS only), sameSite=lax (basic CSRF protection).
• Vetted subprocessors — each provider (Vercel, Neon, Resend, OpenAI) has a DPA in place and a documented security track record.

No system is invulnerable. In case of a detected data breach, Lantern notifies affected users and the CNIL within 72h, per GDPR article 33.

For any question about this policy, to exercise a GDPR right, or to report an incident:

quentinlecocq.dev@gmail.com

Lantern is a solo project operated by Quentin Lecocq, based in Lille (France). No formal DPO required (size of processing), but I respond in person within 30 days maximum to any legitimate request.

This policy may evolve; any material change will be announced by email to logged-in users and reflected in the update date at the top of this page.