Privacy Policy

1. What Information We Collect

Account information

When you create an account or sign in, we collect your email address. We use a magic-link authentication system — no password is stored. Your email is used to send authentication links and service notifications.

Publish history

We store metadata about the files and pages you publish: file names, sizes, upload timestamps, assigned URLs, plan type, and expiry dates. We store the published files themselves in order to serve them to your end users.

IP addresses

We log IP addresses associated with publish actions and API requests for the purpose of rate limiting, abuse prevention, and service security. IP addresses are stored for a limited period and are not used for commercial tracking or advertising.

Payment information

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your card number, CVV, or full payment details. We receive from Stripe only a tokenised reference, the last four digits of your card, card brand, and billing status. Stripe’s privacy practices are described at stripe.com/privacy.

Analytics (paid plans)

On Pro plans and above, we record page view counts and basic referrer data for pages you publish. This data is associated with your account and used to provide analytics functionality. We do not track your end users for advertising purposes.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Pubby service;
• Authenticate your identity when you sign in;
• Deliver published pages and files to your end users;
• Send transactional emails (magic links, publish confirmations, expiry reminders) via our email provider;
• Process payments and manage your subscription;
• Enforce our Terms of Service, including detecting and preventing abuse, spam, and illegal activity;
• Comply with legal obligations, including responses to valid court orders or government requests.

We do not use your personal information for advertising, profiling, or any purpose unrelated to providing the service.

3. Cookies and Session Data

We use a minimal number of cookies necessary to operate the service:

• Authentication cookie: When you sign in, we set a secure, httpOnly session cookie that identifies your authenticated session. This cookie is not accessible to JavaScript and is transmitted over HTTPS only. It expires when you log out or after a period of inactivity.

We do not use third-party advertising cookies, tracking pixels, or persistent behavioural tracking cookies. We do not use Google Analytics or similar analytics scripts on your published pages.

4. Third-Party Service Providers

We use the following third-party services to operate Pubby. Each provider is bound by their own privacy policies and data processing agreements with us:

We do not sell or rent your personal information to any third party.

5. Data Retention

We retain your data as follows:

• Account data (email, publish history, settings): retained until you delete your account. After account deletion, we permanently remove your personal data within 30 days, except where we are required to retain it by law.
• Free plan pages: automatically deleted 7 days after publication. The published files and associated metadata are permanently removed at expiry.
• Paid plan pages: retained as long as your subscription is active and the content has not been manually deleted. If your subscription lapses and is not renewed, content may be deleted after a grace period (typically 30 days with notification).
• IP logs: retained for a rolling 90-day period for abuse prevention and security purposes, then deleted.
• Payment records: Stripe retains transaction history as required for financial and legal compliance. Tokenised billing references are retained in our system for as long as your account is active.

6. Your Rights

Under Australian privacy law and general principles of data protection, you have the right to:

• Access the personal information we hold about you;
• Correct inaccurate personal information;
• Delete your account and associated personal data;
• Object to or restrict processing of your personal information where we have a choice.

To exercise any of these rights, or to request a copy of your data, please contact us at [email protected]. We will respond within a reasonable timeframe and no later than 30 days.

7. Security

We implement industry-standard security measures to protect your personal information, including HTTPS for all data in transit, httpOnly secure session cookies, and access controls on our storage and database systems. We use magic-link authentication to eliminate password-related vulnerabilities.

No system is perfectly secure. In the event of a data breach that is likely to result in serious harm, we will notify affected users and, where required, the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

8. Children’s Privacy

Pubby is not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you believe we have inadvertently collected such information, please contact us at [email protected].

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the site. Continued use of the service after the effective date of any changes constitutes your acceptance of the updated policy.

10. Governing Law

This Privacy Policy is governed by the laws of New South Wales, Australia, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Any disputes relating to this policy are subject to the jurisdiction of the courts of New South Wales.

11. Contact Us

For privacy-related questions, requests, or complaints, please contact us: