What we collect
- Account and enquiry information you give us — name, email, authentication credentials handled by Supabase, access-request messages, and optional profile fields such as organisation, role, WhatsApp, preferred sectors, and directory opt-in.
- Activity data — articles you view, bookmark, follow, or search for (tied to your account so the product works).
- Anonymous browsing — page views and source via Plausible Analytics, which does not use cookies and does not collect personal data. Aggregated only.
- Server logs — IP, user-agent, request path, status code. Kept for ~14 days for security and debugging.
What we don't collect
- Third-party advertising trackers — none.
- Social media pixels — none.
- Government ID, card details, or online-banking credentials. For paid organisations we keep only the billing contacts, invoice details, and payment records needed to administer the subscription.
How we use it
- To run the service: deliver articles, briefings, digests, and account notices.
- To personalize your feed and topic recommendations.
- To send transactional emails (digests, account, billing, and security notices).
- To improve the product and respond to trial, sales, and support requests.
Who we share with
- Supabase — hosts our database and authentication. Subject to Supabase's privacy policy.
- Anthropic — Claude is used for article translation, summarization, and entity extraction in our ingestion pipeline. We don't train models on your content.
- Resend — email delivery.
- Hetzner / Cloudflare — hosting and CDN. Standard server-log retention.
- Google, Facebook, or Microsoft — only when you choose one of these providers to sign in; that provider handles your authentication under its own privacy terms.
We don't sell your data. Ever.
Your rights
You can: download a copy of your data, correct it, or delete your account (and all associated data) at any time. Email [email protected] and we'll act within 30 days.
Cookies
We use first-party authentication cookies managed by Supabase and small browser-storage values for language and theme preferences. We do not use third-party advertising cookies or social-media pixels.
Where this applies
Timor Monitor is operated from Dili, Timor-Leste, by Asp Consulting, with technical services from OniT. Service providers may process data in other countries under their own security and privacy commitments.
How long we keep data
We keep account data while the account is active and as needed for legal, billing, security, and support records. We keep sales enquiry records as needed to respond, follow up, and maintain commercial records. Server logs are normally kept for about 14 days. Newsletter details remain until you unsubscribe. You can request deletion by email.
Security
We use access controls, encrypted connections, row-level database security, and restricted service credentials. No online service can guarantee absolute security; report a suspected issue to [email protected].
Changes
We'll update this page with material changes and email account-holders. Last updated August 10, 2026.