Miniflux is a minimalist, open-source web feed reader written in Go by Frédéric Guillot and distributed under the Apache 2.0 license; it can be self-hosted, and its developer also runs a paid hosted instance ("Miniflux Hosting", $15/year, operating since 2013) at miniflux.app. The hosted service's combined Terms of Service and Privacy page states that Miniflux does not collect or share personal information, does not track usage, does not use any analytics software, and removes all data after account cancellation, while the hosting page discloses that credit-card payments are processed by Stripe (PayPal is also accepted), that the main server and user data have been hosted in Finland since 2023, and that feeds may be retrieved through proxies in the United States and Germany. The software itself is built to strip pixel trackers and URL tracking parameters, proxy media, and send no referrer, and the homepage states there is no telemetry or advertising. Caveats are that the hosted service is a one-developer independent business, optional integrations can push saved articles to third-party services, and a self-hosted instance's privacy depends entirely on its operator. No breach or regulatory action was found; the project publishes a vulnerability-disclosure policy and self-published GitHub security advisories, but no third-party audit or funded bug bounty.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
13 ON FILE
COLLECTION
Privacy Guides lists Miniflux on its News Aggregators recommendations page as a self-hostable, web-based aggregator, under criteria that require the software to be open source and to operate locally rather than as a cloud service.
The Miniflux Hosting FAQ publishes a concrete data-retention schedule for the paid instance — unread articles removed 60 days after being added, read articles after 30 days, starred articles never — and states that accounts and all associated data are automatically deleted 30 days after a lapsed subscription; it also discloses that the main server and user data have been hosted in Finland since 2023 (Canada before that).
The hosted service's combined Terms of Service and Privacy page states that Miniflux does not collect or share personal information, does not track usage, does not send marketing email, does not use any analytics software, and removes all user data after account cancellation; the same page notes payment is by credit card or PayPal and that no card data is stored on Miniflux servers.
The repository publishes the complete source code under the Apache License, Version 2.0, so the code running the hosted instance — which the hosting page says is the same codebase — can be inspected, audited, or forked by anyone.
The Miniflux 2 repository README names Frédéric Guillot as the author, links a public contributors list, and states the software is distributed under the Apache 2.0 License; it also describes the software's privacy and security design and that it uses a limited number of third-party Go dependencies.
The Miniflux Hosting page states the paid service is maintained by the creator of Miniflux, describes the operator as a small, independent business that is not a corporation or venture-backed startup, says Miniflux Hosting has been operating since 2013, that support is a single developer reachable by email, and that the hosted version runs the exact same code as the open-source version; no registered legal entity or jurisdiction of incorporation is named on the page.
The Terms of Service and Privacy page states that users' feed data is kept confidential and is not given or sold to third parties, and that Miniflux does not collect or share personal information.
The project FAQ explains that the 'Save this article' action sends a feed entry to third-party services such as Pinboard or Instapaper if the user has configured them — an opt-in, user-initiated data flow to outside services rather than a default one.
The Miniflux Hosting page repeats the no-share commitment but discloses the third parties actually involved in running the paid service: credit-card payments are processed by Stripe, PayPal is accepted, and feeds may be retrieved through proxies located in the United States and Germany in addition to the main server in Finland — so the hosted plan is not architecturally unable to share, it relies on a small set of infrastructure and payment processors.
The repository publishes a SECURITY.md vulnerability-disclosure policy: only the latest stable version is supported, and vulnerabilities should be reported privately via GitHub security advisories or by email to a security address — a working disclosure channel, but not a funded bug bounty or third-party audit.
The project's GitHub security advisories page shows the maintainer publishing severity-rated advisories for fixed vulnerabilities — including a Low-severity media-proxy SSRF (published June 18, 2026), a Moderate open redirect (January 7, 2026), and stored-XSS issues in 2025 — evidence of a functioning disclose-and-fix process; no data breach or regulatory action involving Miniflux or its hosted service was found in this research.
The Features page details the anti-tracking mechanisms built into the software — stripping utm_*/fbclid parameters, sending Referrer-Policy: no-referrer, a media proxy, youtube-nocookie.com embeds, blocking external JavaScript, and a Content Security Policy limited to application scripts — while also listing optional components that contact third parties when enabled by the user: Google OAuth2 sign-in, YouTube playback, and 'Saves articles to third-party services' integrations.
The Miniflux homepage states the software automatically removes pixel trackers, strips tracking parameters from URLs, uses a media proxy to prevent third-party tracking, forwards no referrer, and contains no telemetry or advertising at all.