Privacy Policy

First Light is a GCC news-intelligence service that turns the sources you choose into a personalised, bilingual (Arabic/English) morning brief. This policy explains what personal data we collect, how we use it, and the rights you have. It is written to align with Kuwait's Personal Data Protection framework and comparable GCC data-protection principles.

First Light is currently an invite-only beta. If you have questions about this policy or your data, contact us at privacy@firstlight.news.

• Account data — your email address and an encrypted password (managed by our authentication provider), plus the invite code used to join.
• Your provider API keys — if you connect your own AI or voice provider (Anthropic, OpenAI, Google, ElevenLabs), your key is encrypted at rest with AES-256-GCM, is never shown back to you in full, and is never exposed to your browser after saving.
• Preferences — the country, categories and topics you follow, your outlets, digest schedule, language, and voice/format settings.
• Connected channels — if you link Telegram, we store the chat identifier needed to deliver your brief; any message you forward to our bot is stored as a source item for your brief.
• Service data — the briefs, audio, transcripts, and reports generated for you, and basic diagnostic logs needed to operate and debug the service.

• To generate and deliver your personalised brief, audio, and reports.
• To operate, secure, debug, and improve the service.
• To contact you about your account or important service changes.

We do not sell your personal data, and we do not use it for third-party advertising.

When you connect your own AI or voice provider, First Light uses your key to call that provider on your behalf — for example, sending story text to your AI provider to summarise, or a script to your voice provider to synthesise. That content is processed by those providers under their own terms and privacy policies. We recommend reviewing the policy of any provider you connect.

We rely on a small set of trusted infrastructure providers (sub-processors) to run the service:

• Supabase — database and file storage (your account, preferences, encrypted keys, and generated briefs), protected with row-level security.
• Vercel — application hosting and delivery.
• The AI/voice providers you connect — Anthropic, OpenAI, Google, and/or ElevenLabs, only when you choose them.
• Telegram — only if you connect it for delivery or forwarding.

Some of these providers operate infrastructure outside Kuwait, which means your data may be processed in other countries under appropriate safeguards.

Provider keys are encrypted at rest and never returned to the browser. Access to user data is row-level-security scoped so one account cannot read another's. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

We keep your data while your account is active. You can delete your account and all associated data at any time from Settings → Account → Delete account; deletion is immediate and removes your personal data — briefs, audio, keys, preferences, and connections — from our systems, subject only to any short-term backups and legal retention requirements. You can also email us to request deletion.

Subject to applicable law, you can:

• Access the personal data we hold about you.
• Correct inaccurate data (most of it is editable in Settings).
• Delete your account and associated data.
• Withdraw consent or object to certain processing.

To exercise any of these, email privacy@firstlight.news. We will respond within a reasonable period.

We use only the essential cookies needed to keep you signed in and secure. We do not use advertising or cross-site tracking cookies.

First Light is not intended for anyone under 18, and we do not knowingly collect data from children.

We may update this policy as the service evolves. We will change the "last updated" date above and, for material changes, notify you through the app or by email.

Questions or requests: privacy@firstlight.news.