A small data footprint, explained plainly.

What you can do without an account

You can read current and archived editions without creating an account. Public contributors also do not have accounts. When you submit a Hiighlight, the application stores the passage or moment, media type, timestamp if supplied, author or speaker, source title and URL, optional author link, optional submitter name and link, whether you created the source, preferred edition date, and moderation state. The form marks which details are required to evaluate and publish a submission. Optional details do not have to be provided, although Hiighlights may be unable to publish, reply or send an update without the information needed for that purpose.

Published author, source and submitter links are ordinary followed links. Source links include Hiighlights referral parameters and, for supported media, the supplied timestamp. The destination site receives the usual information associated with following an external link and applies its own privacy practices.

Voting and the essential cookie

Voting uses one essential cookie named hiighlights_voter. It contains a random voter identifier, issue and expiry times, and a signature that prevents alteration. It is HttpOnly, SameSite=Lax, Secure on hosted environments, available across the site, and expires after 30 days. JavaScript cannot read it. Hiighlights does not use this cookie for advertising.

Cloudflare Turnstile verifies a visitor before the server issues a voting session. The single-use Turnstile token is sent to Cloudflare for verification and is not stored in the application database. For voting-abuse protection, the server creates a keyed hash from the request network address and the current UTC date. That hash changes daily and cannot be used by the application to recover the original address.

The application database stores the random voter identifier with each vote, the rotating network hash, risk score, vote state, and session issue time. It does not store raw IP addresses, full user agents, cookies, or Turnstile tokens. Cloudflare may process network and browser signals as part of hosting, security, rate limiting and Turnstile.

Optional email

A submitter may provide an email address and request updates for that submission. If selected, the address is used only for approval, going-live and winner notifications. Hiighlights does not add submitters to a marketing list, create a newsletter contact, or use a tracking pixel.

Resend is the transactional delivery provider. The application sends Resend the recipient address and the contents needed to deliver the requested message. Signed delivery webhooks return limited delivery status. Every message offers a way to stop future submission notifications. Opting out disables notifications for matching submissions, cancels queued messages and keeps a keyed suppression hash so the address is not added to a second plain-text list.

Messages sent to the contact mailbox

When you email hello@hiighlights.com, the mailbox receives your email address, message, headers and any information or attachments you choose to include. Hiighlights uses that information to answer questions, handle corrections, privacy and rights requests, investigate safety or illegal-content reports, consider sponsorship enquiries, and keep proportionate records of decisions and correspondence.

The intended legal bases depend on the request. Steps you ask Hiighlights to take before a possible sponsorship agreement may be necessary to respond to that request. Processing a valid rights or legal notice may be necessary to comply with a legal obligation. Answering ordinary correspondence, maintaining accurate attribution, protecting the service and its users, and establishing or defending legal claims may rely on legitimate interests where those interests are not overridden by your rights.

Mailbox messages remain with the configured email provider and authorised operator for only as long as reasonably needed to respond, document the outcome, meet a legal obligation, resolve a dispute or protect legal claims. They are not written to the Hiighlights application database. Avoid sending passwords, recovery codes, identity documents, health details or other sensitive information unless Hiighlights specifically explains why it is necessary and offers a proportionate way to provide it.

Moderation

Valid submissions pass local source, duplication, safety and promotion checks. Unless a local hard rule rejects the submission first, Hiighlights sends the submitted passage, author or speaker, source title and limited source evidence to OpenAI. It uses the Moderations API for harmful-content classification and the Responses API for a structured editorial review. The Responses request is sent with storage disabled.

Hiighlights stores compact moderation outcomes, reasons, confidence, controlled flags, model and prompt version, source evidence, timing and token counts. It does not store the full OpenAI prompt or provider response. OpenAI states that API data is not used to train its models by default unless the customer opts in, and that default API abuse-monitoring logs may be retained for up to 30 days unless law requires longer retention.

Why this processing is permitted

Hiighlights intends to rely on legitimate interests for the limited processing needed to receive and review submissions, publish and preserve editions, maintain accurate attribution, operate account-light voting, prevent fraud and abuse, secure the service, and understand aggregate product use. Those interests are balanced through data minimisation, short retention for voting and analytics events, daily rotation of the network hash, human review routes, and the absence of advertising profiles.

Optional submission notifications rely on the submitter’s consent and can be stopped at any time. Requested sponsorship discussions may require steps before an agreement. Valid legal and rights requests may require processing to comply with a legal obligation. Hiighlights does not use personal data for solely automated decisions that produce legal or similarly significant effects. Automated checks can affect publication, but held or disputed decisions have a human review path.

Anonymous product analytics

Product analytics is disabled by default and can be activated only through both hosted configuration and a protected runtime switch. When active, server-side Cloudflare Analytics Engine receives allowlisted event names and limited public dimensions such as edition date, public Hiighlight ID, media type, route category, broad campaign or referrer category, and controlled outcome. D1 stores bounded daily aggregate counts.

The model has a 5,000 accepted-event daily budget, with a source-enforced maximum of 15,000. It has no analytics cookies, fingerprinting, session replay, heatmaps, advertising identifiers, cross-site tracking, marketing profiles, exact private referrer paths, passages, email addresses, raw IP addresses, full user agents or voter identifiers. Counts are directional and are not represented as unique people.

Service providers and storage

Cloudflare provides Workers hosting, security and rate limiting, Turnstile, D1 database storage and, when explicitly enabled, Analytics Engine. The current D1 databases use a Western Europe location hint. A location hint is not the same as an EU jurisdiction restriction, and Cloudflare may process requests across its network.

OpenAI processes submitted material for the moderation described above. Resend processes requested transactional email. Their own terms and privacy documents govern their provider-side processing. Hiighlights does not sell personal information or share it for third-party targeted advertising.

How long data remains

Completed editions and their frozen rankings are intended to remain as the permanent public archive. Submission, source, attribution, vote-ledger and moderation records currently remain in D1 so the edition, duplicate protection, moderation decisions and voting integrity can be maintained. Notification and delivery records also currently remain unless reviewed or removed. Suppression hashes remain so an opt-out, hard bounce or complaint continues to be respected.

Privacy-safe voting audit events expire after 90 days. D1 daily analytics aggregates and budget rows are deleted after 45 days. The 30-day voter cookie expires in the browser. Cloudflare operational logs and provider records follow the applicable provider configuration and retention. Verified private backups may temporarily preserve older records until their backup cycle expires.

This is the actual launch implementation, not a promise that every category has an automatic deletion schedule. Retention will be reviewed before launch and as the service changes.

Your choices and requests

Depending on where you live and the circumstances, you may have rights to ask whether personal data about you is processed, request access or a copy, correct inaccurate data, ask for deletion or restriction, object to processing based on legitimate interests, and receive certain data in a portable format. Where processing relies on consent, you may withdraw it without affecting earlier processing. You may also complain to the data-protection authority where you live, work or believe an infringement occurred. These rights can have legal limits, and Hiighlights may need enough information to locate the relevant record and verify that a request concerns you.

Use the contact hub for privacy requests, attribution corrections, or removal requests. Include the public Hiighlight ID or edition date when available. Do not send passwords, identity documents or other sensitive information in an ordinary email unless specifically and safely requested.

External links and changes

Hiighlights links to independent source, author and submitter sites. It does not control their content, availability, cookies or privacy practices. This policy may change when the product or its providers change. The date at the top will be updated when it does.