RSS Feeds: The Privacy-Conscious Way to Stay Informed

If you follow more than a handful of sites, you already know the routine. You open a tab, scroll past the newsletter popup, dismiss the cookie banner, read three paragraphs, and get pulled away by an algorithm that decides what you see next. RSS is the way out of that. It has been around since the late 1990s, it is still the least annoying way to read the web, and in 2026 it is more useful than it was when Google Reader died in 2013.

This guide covers what RSS is, why it protects your privacy, and how to run your own reader so nobody gets to see what you read. The self-hosting section is the long one, because that is where the real privacy win is.

What are RSS feeds, and how do they work?

RSS stands for Really Simple Syndication. It is a way for a website to publish its updates in a standard format that any feed reader can fetch. Instead of visiting each site, you subscribe to its feed and the reader pulls new posts into one list.

Here is the mechanics. A site exposes a feed URL, usually ending in /feed, /rss, or .xml. You paste that URL into your reader. On a schedule, the reader requests the file, parses the XML, and shows you anything new. You read inside the reader, or you click through to the site when you want to comment or dig deeper. Most sites still offer feeds even when they hide the link.

Compared with visiting sites directly, a feed is more efficient (one list instead of twenty tabs) and far quieter. No autoplay video, no ad refresh loop, no recommended-for-you rail. The site sees a single request from your reader, not a tracked browsing session.

I use RSS to keep up with infosec news. A reader on my phone and one in the browser means I see everything from the sites I care about in one place, and nothing from the ones I do not.

How do RSS feeds help with privacy?

When you visit a site directly, the page runs scripts, sets cookies, fingerprints your browser, and often hands your visit to third-party ad and analytics networks. Your feed reader asks for a plain XML file and nothing else. There is no JavaScript in a feed, no cookie, no canvas fingerprint.

That cuts off a whole class of tracking. A site cannot follow you from article to article, cannot build a profile of what you read and when, and cannot sell that profile to a data broker. If you use a reader that fetches feeds on your behalf, the site does not even learn your IP address. It sees the reader's server instead.

There is a security angle too. Feeds are static content. You are not loading the site's ad iframes, third-party widgets, or whatever else it pulls in, so you are not exposed to a compromised ad network or a malicious script on a page you only wanted to skim.

One honest caveat: the feed still comes from the publisher, and a self-hosted reader on your own server means that server fetches from many sites. That is a tradeoff you control, which is the point. If you want the wider picture of how browsing gets tracked, I wrote about browser fingerprinting separately.

What changed since this post was first written

RSS did not die, but the tools around it moved. A few things are worth knowing before you pick a reader in 2026.

• Google Reader is still gone. It shut down in 2013, and nothing has fully replaced its social layer since.
• Nuzzel is gone too. The old version of this post suggested Nuzzel as a privacy-focused reader. It was a social news aggregator rather than an RSS reader, and Twitter shut it down in 2021 after acquiring its parent company, Scroll. Do not go looking for it.
• The hosted readers consolidated into paid tiers. Feedly and Inoreader are still the two big names and both keep a usable free plan, but the free tiers are capped and the good features sit behind a subscription.
• Self-hosting got easier. FreshRSS is actively maintained (1.30.0 landed in September 2026) and ships an official Docker image, so a working reader is a compose file and two commands away.
• Full-text extraction got messier. FiveFilters, the outfit behind the Full-Text RSS tool, moved its software to a new company called Mochi, and the free hosted endpoint now only works for a couple of demo domains. The self-hosted Docker image still works, and I cover it below.

How to use RSS feeds

Three steps: pick a reader, find the feeds you want, and add them. If you want the privacy version, insert a step and host the reader yourself.

1. Choose an RSS reader

You have two families to pick from: hosted services that run on someone else's server, and self-hosted software that runs on yours.

Hosted services are the easy start. They work from any device with no setup. The catch is that your subscriptions, your reading history, and your IP address live on their infrastructure.

Prices move, so check the vendor pages before you commit. For a privacy-conscious reader, the hosted options are a compromise at best. You are trusting a third party with a list of everything you read.

Host your own RSS reader

This is where RSS gets interesting for privacy. A reader on your own server means the subscription list, the read history, and the fetch requests are all yours. No third party sees what you follow, and you can expose it only to yourself.

I recommend FreshRSS. It is free software under the AGPL, it is actively developed, and it handles a large number of feeds without complaint. It runs on PHP with SQLite by default, so there is no database to administer unless you want one.

You need a small VPS. Providers like DigitalOcean start at $6/month for a droplet that is more than enough for a personal reader. If this is your first server, start with the first 24 hours on a new VPS to lock down SSH and the firewall before you install anything.

Install FreshRSS with Docker Compose

Docker Compose is still the recommended way to deploy FreshRSS, and the official freshrss/freshrss image is the one to use. Create a directory and a compose file:

mkdir -p ~/freshrss && cd ~/freshrss
nano compose.yml

Paste this into compose.yml:

services:
  freshrss:
    image: freshrss/freshrss:latest
    container_name: freshrss
    restart: unless-stopped
    environment:
      TZ: Europe/London
      CRON_MIN: "13,43"
    volumes:
      - freshrss_data:/var/www/FreshRSS/data
      - freshrss_extensions:/var/www/FreshRSS/extensions
    ports:
      - "127.0.0.1:8080:80"
    logging:
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  freshrss_data:
  freshrss_extensions:

Two things to note. The port binding is 127.0.0.1:8080:80, which keeps FreshRSS reachable only from the server itself until you put a reverse proxy or a tunnel in front of it. And CRON_MIN turns on the built-in job that refreshes your feeds twice an hour.

Start it and create your account:

docker compose up -d

docker exec --user www-data freshrss cli/do-install.php --default-user freshrss
docker exec --user www-data freshrss cli/create-user.php --user freshrss --password 'change-me'

If you use the Alpine variant (freshrss/freshrss:latest-alpine), swap --user www-data for --user apache, or the CLI commands will fail with permission errors. You can also finish setup in the web UI at http://127.0.0.1:8080 instead of using the CLI.

To reach it from your laptop or phone, put a reverse proxy or a tunnel in front of it rather than opening the port to the internet. I set up a Cloudflare Tunnel with Docker for exactly this, and it avoids exposing any inbound ports on the VPS. If you would rather terminate TLS yourself, the nginx hardening guide covers the server side.

FreshRSS speaks the Google Reader API, so you are not locked into its web interface. Reeder, NetNewsWire, and other native clients can connect to it, and it keeps working even if a hosted service you liked shuts down. That is the whole point of owning the stack, and it is the same reason I recommend free and open source software in general. You can inspect it, move it, and keep it running after the company behind it walks away.

If FreshRSS feels heavier than you want, Miniflux is a lighter self-hosted reader written in Go. It is worth a look, but FreshRSS has the wider client support and the larger community.

2. Add full-text extraction with Full-Text RSS

Many feeds only publish a summary or a teaser, then push you back to the site for the rest. That is where full-text extraction comes in. It fetches the article behind each feed item, strips the ads and clutter, and serves you the whole thing inside your reader.

The tool most people reach for is Full-Text RSS by FiveFilters. This is the part that changed the most since this post was written, so read carefully. The project moved its software to a new company called Mochi, and the free hosted endpoint at ftr.fivefilters.net now only accepts a couple of demo domains (Media Lens and Declassified UK) for testing. The old advice to point your reader at the free hosted service no longer works for arbitrary feeds, and the official self-hosted version is listed as coming soon rather than for sale.

The route that still works is the community Docker image, heussd/fivefilters-full-text-rss-docker. It is unofficial, and the maintainer says so plainly, but it packages the same Full-Text RSS code and it is still updated. Add it to your compose stack:

services:
  fullfeedrss:
    image: heussd/fivefilters-full-text-rss:latest
    container_name: fullfeedrss
    restart: unless-stopped
    environment:
      FTR_ADMIN_PASSWORD: "choose-a-password"
    volumes:
      - rss-cache:/var/www/html/cache/rss
    ports:
      - "127.0.0.1:50000:80"

volumes:
  rss-cache:

Start it the same way:

docker compose up -d fullfeedrss

Once it is running, you use it by wrapping a feed URL. The endpoint is makefulltextfeed.php, and the original feed goes in the url parameter:

http://127.0.0.1:50000/makefulltextfeed.php?url=https%3A%2F%2Fexample.com%2Ffeed

Take that wrapped URL and subscribe to it in FreshRSS instead of the original feed. Full-Text RSS fetches the summary feed, pulls the full article for each item, and hands your reader a feed with the complete text. There is also an extract.php endpoint if you just want the content of a single article URL.

The container caches extracted articles on disk so it does not refetch the same page constantly, which is why the compose file gives it a volume. Keep the admin password set if you expose the service at all, and bind it to localhost as shown so only your reader can reach it.

One caveat: full-text extraction is best-effort. It depends on heuristics and per-site rules, and a site redesign can break extraction until the rules catch up. For most feeds it works well; for a few, you will still want to click through.

3. Find the RSS feed for the website you want to follow

Most sites put the feed link in the footer, in the page header, or behind an RSS icon. The URL usually contains rss, feed, or .xml. For example, the New York Times lists its feeds at https://www.nytimes.com/rss.

Some sites hide the feed or stopped advertising it. Try appending /feed or /rss to the domain, or view the page source and search for application/rss+xml. If a site offers no feed at all, you can often build one by scraping it. FreshRSS has a web scraping feature for that, and self-hosted tools like RSS-Bridge do the same.

Be aware that plenty of sites now use feeds badly. They publish a one-line teaser, stuff tracking pixels into the item, or route every link through a redirect back to their site. Full-text extraction, set up above, is the fix. The idea, as Chris Titus put it in Why We Don't Browse the Internet Anymore, is to read everything without leaving your reader.

4. Add the RSS feed to your reader

In FreshRSS, click the add-subscription button, paste the feed URL, and pick a category. If you set up Full-Text RSS, paste the wrapped makefulltextfeed.php URL instead so you get full articles. FreshRSS fetches new items on the schedule you set and marks them unread until you get to them.

5. Enjoy staying up to date without sacrificing your privacy

With your own reader running, you have cut the tracking out of your daily reading. A few settings are worth checking to keep it that way.

• Serve it over HTTPS. Use a reverse proxy or tunnel so the connection to your reader is encrypted, even if it is only for you.
• Keep it off the public internet where you can. A VPN or a tunnel beats an open port. If you want that layer, see the WireGuard setup guide.
• Turn off remote images if you want. FreshRSS can block images that load from the publisher's servers, which stops feeds from reporting your reads back to them.
• Back up the data volume. Your subscriptions and read history are the valuable part, and the FreshRSS CLI can back the database up in a couple of commands.

If you want to go further with the network side, DNS is the next layer. NextDNS blocks trackers before they load, and a hardened browser closes the gap when you do click through.

Conclusion

RSS is the rare piece of old web technology that got better with age. It is faster than the sites it reads, it does not care about engagement metrics, and with a self-hosted reader it tells nobody what you are reading. Set up FreshRSS once, add full-text extraction, and you have a private reading list that survives whatever happens to the next big hosted service.

Do you run your own RSS reader, or are you still on a hosted one? Share your setup in the comments below.