Privacy policy

Who we are and what this covers

Newsjack is an open-source project (MIT licensed) maintained by Medialyst. In this policy, “we” means the Newsjack maintainers. The policy covers:

• the website at newsjack.sh, including the installer it serves;
• the newsjack command-line tool (CLI), whether installed from newsjack.sh, GitHub, or npm;
• the Newsjack agent skills and plugin, wherever you install them.

It does not cover third-party services you choose to connect, such as Medialyst, X, or Slack, or the AI agent and model provider you run Newsjack in. Each of those has its own privacy policy. The source code is public at github.com/elvisun/newsjack, so you can check every statement here against it.

Your data stays on your machine by default

Newsjack has no Newsjack account and no Newsjack server that your work is uploaded to. The CLI and skills keep their state in files on your computer. By default:

• ~/.newsjack/ is the main folder (change it with the NEWSJACK_HOME environment variable). It holds:
  • bin/ and newsjack/: the CLI and the bundled skills, plus the previous version for rollback, and install.json recording the installed version.
  • credentials.json: your Medialyst API key or sign-in tokens, if you connect Medialyst (readable only by your user account).
  • .env: optional keys you add, such as an X API token or a TypeSafe API key (readable only by your user account).
  • monitors/<name>/: each monitor profile (company, topics, competitors, proof points, spokespeople, feeds), its brief and schedule notes, and a runs/ folder with the news evidence and reports from each run.
  • monitors/<name>/delivery.json: your Slack webhook URL, if you set up Slack delivery (readable only by your user account), plus small delivery receipts so the same report is not posted twice.
  • coverage/<name>/: coverage tracker keywords and runs.
  • voice/: voice profiles (for example voice/active.yaml) describing how you write. The skill is told never to store your raw writing samples in them.
• ~/.local/share/newsjack/monitor.db is a local SQLite database (change it with NEWSJACK_STORE). It remembers which links a monitor or coverage tracker has already seen, along with run history and the news evidence collected. That evidence can include public article bylines and public X posts and handles.
• Agent skill folders: the installer copies Newsjack skills into the folders your agents read, such as ~/.claude/skills, ~/.agents/skills, ~/.openclaw/skills, or ~/.hermes/skills.
• Files you ask for: press clips, coverage reports, media lists, drafts, and other outputs are saved wherever you or your agent choose.

On macOS and Linux the installer does not edit your shell configuration. On Windows, the CLI adds %USERPROFILE%\.newsjack\bin to your user PATH unless you set NEWSJACK_NO_PATH_UPDATE=1.

The CLI contains no analytics, telemetry, or crash reporting, and it does not call any AI model itself. Your AI agent reads and writes these files when you run a skill, so whatever you share with your agent is also handled by the agent and the model provider it uses, under their terms.

What leaves your machine, and to whom

Newsjack only contacts outside services to do what you ask. Here is every service it can talk to and what it sends.

GitHub (installs and updates)

The installer and the CLI download release files from GitHub. Before most commands, an installed CLI also checks GitHub for a newer release. That check is a plain download of a public file and sends no account, version, or usage information beyond what any web request carries (such as your IP address). Turn it off with NEWSJACK_AUTO_UPDATE=0. GitHub’s own privacy policy applies to these requests.

newsjack.sh (the installer)

Running curl -fsSL https://newsjack.sh | sh downloads the installer from this site. On macOS and Linux, newsjack update and automatic updates fetch the installer the same way. These requests are logged like any other visit to the site (see below).

Medialyst (optional)

Medialyst is an optional service you can connect for news search, journalist research, media lists, and the PR calendar. Nothing is sent to Medialyst unless you sign in or add a Medialyst key. Once connected, requests go to medialyst.aiwith your key or sign-in token, and include what each feature needs: search terms (for a monitor, its topics, competitors, and search terms), the campaign brief you approve for a media list, article links to enrich, and calendar queries. The plugin can also connect your agent to Medialyst’s MCP server at medialyst.ai/api/mcp, which receives whatever your agent sends through those tools. Medialyst handles this data under its own privacy policy.

News sources

Monitors read RSS feeds (by default Techmeme’s, or the feeds in your profile) with plain downloads that send no search terms. If you turn on the Reddit or Hacker News sources, your search terms are sent to Reddit’s and Hacker News’s (Algolia’s) public search. The press-clip skill opens the article links you give it in a fresh headless browser, with no cookies or browser profile of yours.

X (optional)

If you add an X API token, monitors send your search terms to the X API to find recent posts, news, and trends, using your token.

Slack (optional)

If you set up Slack delivery, the CLI posts each report message to the Slack incoming webhook you provide, and nowhere else. The detector skill writes that message as a short summary with source links and the local path to the full report, and is told never to include credentials or private data. You can remove it any time with newsjack monitor delivery remove-slack <name>.

TypeSafe (optional)

If you add a TypeSafe API key, the relevance filter sends your monitor profile (company, description, website, topics, competitors, search terms, and exclusions) and short excerpts of the collected news to TypeSafe to score relevance. Without a key, nothing is sent.

The newsjack.sh website

The site sets no cookies and runs no third-party analytics or advertising scripts. When someone requests the home page (or the installer at newsjack.sh), we log one record so we can count visits and installs. Each record holds:

• whether it was a page visit or an installer download, and when;
• a one-way hash of your IP address, salted and changed every day, so the same visitor can be counted once per day. We do not store your raw IP address;
• approximate country and region;
• your browser or tool’s user agent, the referring page, and your language preference;
• the query string in the link you followed (such as UTM tags).

We use these records only to understand traffic and show the install count. We do not sell them or use them for advertising. The site is hosted on Vercel, which processes requests to serve it.

Some pages show posts from X and LinkedIn. Their images load directly from those companies’ servers, which can see your IP address. YouTube videos load from youtube-nocookie.com only when you press play.

Journalist contact data

Newsjack helps people find journalists who actually cover a story. Journalist names, outlets, email addresses, and social handles reach a Newsjack user in one of two ways.

(a) Through the optional Medialyst connection

If the user chooses to connect Medialyst, contact details come from Medialyst’s journalist research (the find-journalists skill, media lists, and journalist enrichment). Medialyst’s privacy policy (section 6) says it builds journalist records from:

• publicly available information: published articles, bylines and author bios, official author pages on publication websites, professional bios, press releases, and public speaking;
• professional social profiles, such as public LinkedIn profiles and X accounts used for professional purposes;
• a business contact enrichment provider (Hunter.io) and email validation services (DeBounce, Instantly);
• media lists uploaded by its users, and corrections.

Medialyst says it keeps professional information only (name, professional email and work phone if public, outlet, role, beat, published work, and professional profiles), and does not collect home addresses, personal email addresses, sensitive data, or details of private or family life.

Medialyst processes this data on the basis of legitimate interest under GDPR Article 6(1)(f), for professional media-relations communication. Its stated balancing points are that the data is limited to professional information journalists have made public, journalists expect professional communications as part of their role, the processing offers them relevant story opportunities, and safeguards include an easy opt-out.

Removal. A journalist can opt out or ask for deletion at medialyst.ai/journalist-optout or by emailing privacy@medialyst.ai with the subject “Journalist Opt-Out Request” (include your name, professional email addresses, and publications). Medialyst says it acknowledges requests within 5 business days, completes them within 30 days, and adds you to a permanent suppression list. Once you are removed from Medialyst, you stop appearing in Newsjack results that come through Medialyst. Newsjack keeps no separate copy of Medialyst results; anything a user already saved stays in that user’s own files.

(b) Without Medialyst: your own agent’s lookup

Without Medialyst, the user’s own AI agent does a best-effort lookup for an email address or handle that the journalist or their publication has listed publicly, such as an author or staff page, a masthead, or the journalist’s own website or public profile. The skill tells the agent to cite the page each contact came from, never to guess an address (for example from a name pattern), and never to use unofficial contact databases. If nothing is publicly listed, the contact is left blank.

This lookup runs on the user’s machine. Newsjack operates no server or database for it and keeps nothing. Results stay in the user’s local files. The user decides what to keep and is responsible for it as its controller, and must use it only for relevant, professional media-relations outreach (legitimate interest).

Removal. There is no Newsjack-held copy to delete. Removing or changing the public listing stops future lookups from finding it. Journalists can still contact us at newsjack@elvisun.com with any question.

Newsjack never sends outreach

The CLI has no email-sending code, and the skills only research and draft. Every pitch or reply is reviewed and sent by the user, from their own accounts, if they decide to send it. Newsjack’s ethics rules also tell the agent to respect opt-outs and to refuse mass, untargeted pitching.

Journalists who want to be removed can also email us at newsjack@elvisun.com. We will forward Medialyst-related requests to Medialyst and answer any other questions.

Your choices and deleting your data

Because your Newsjack data lives on your computer, you control it directly. To remove it:

• Delete ~/.newsjack (or your NEWSJACK_HOME). This removes the CLI, credentials, keys, monitor profiles, run folders, Slack settings, coverage trackers, and voice profiles.
• Delete ~/.local/share/newsjack (or your NEWSJACK_STORE file) to remove the local database.
• Delete the Newsjack skill folders from your agents’ skill directories (listed above). Each one Newsjack installed contains a .newsjack-installed file.
• If you installed with npm, run npm uninstall -g newsjack. On Windows, also remove %USERPROFILE%\.newsjack\bin from your user PATH.

For narrower changes, newsjack auth logout removes your stored Medialyst credentials, and newsjack monitor delivery remove-slack <name> removes a Slack webhook. To stop using a connected service, also revoke the key or webhook in that service. For data held by Medialyst, X, Slack, GitHub, or TypeSafe, use their privacy controls. For the website’s visit records, email us.

Children

Newsjack is a professional tool and is not directed at children. We do not knowingly collect personal information from children.

Changes to this policy

We will update this page when Newsjack’s data handling changes, and change the “Last updated” date above. The full history of this page is public in the GitHub repository.

Contact

Questions, requests, or concerns about privacy: newsjack@elvisun.com.