Privacy policy
Last updated 29 October 2026. This policy explains what personal information PubArx handles, why, who receives it, how long we keep it and what you can do about it.
1. Who is responsible
PubArx (pubarx.com) is run by the PubArx Community, a volunteer-run, not-for-profit scholarly initiative that is not currently a registered company. The PubArx Community decides how personal information on PubArx is used and is responsible for it. For any privacy question or request, write to privacy@pubarx.com.
2. What we collect and why
| Information | Why we use it |
|---|---|
| Account details: name, email address, password (stored only as a salted hash, never in readable form) | To create and secure your account, sign you in, and send the emails the service needs. |
| Profile details you choose to add: affiliation, position, website, research interests, short biography | To show your public profile, to credit your work, and to check conflicts of interest in open review. |
| ORCID: your ORCID iD and the name ORCID returns when you sign in with ORCID | To confirm that you control that ORCID record, to let you sign in with it, to stop one ORCID iD being used by several accounts, and to show it next to your contributions. |
| Submissions: the PDF, title, abstract, keywords, the names and affiliations of all authors, your declarations and the time you made them, and messages exchanged during screening | To screen and publish your work, keep a record of the scholarly process, and resolve questions about authorship or rights. |
| Community activity: reviews, endorsements, comments, “helpful” votes, reports you file, followed subjects and notification settings | To run open review and moderation, prevent abuse, and send the notifications you asked for. |
| Technical data: IP address, browser type and session records | To keep you signed in, protect forms, limit abuse such as password guessing, and investigate security problems. |
| Reading statistics: daily counts of abstract views and PDF downloads per paper | To show authors how often their work is read. To avoid counting the same visitor twice, we keep a one-way scrambled code made from the IP address and browser type for 26 hours; the counts themselves contain no personal information. |
| Messages you send us | To answer you and deal with your request. |
We use this information because it is needed to provide the service you signed up for, because we have a legitimate interest in keeping PubArx secure and its scholarly record reliable, because the law requires it, or, for optional emails such as the weekly digest, because you chose it. We do not sell personal information, show advertising, or use third-party analytics or tracking.
3. What is public
- Published papers, including the author names and affiliations entered with them, the full text of the PDF and anything the PDF contains, such as a corresponding author’s email address.
- Your public profile: name, affiliation, position, website, research interests, biography, ORCID iD, papers, contributions and reputation. You can make your profile private in your account settings; it then disappears from the researcher directory and rankings.
- Reviews, endorsements and comments, which are always signed with your name and ORCID iD, even if your profile is private.
The email address you register with is never shown publicly. Contact details that you choose to include in a manuscript are public, because the manuscript is.
Public pages and their metadata are read by search engines, Google Scholar and other indexing and harvesting services, which then handle that public information under their own policies.
4. Who else receives information
- Hostinger hosts the website and database, delivers pages through its content delivery network and sends our emails. Our servers are located in the United States, and pages may be delivered from Hostinger servers in other countries.
- ORCID: when you sign in with ORCID, you deal directly with ORCID under its own privacy policy, and ORCID tells us your iD and name.
- Have I Been Pwned: when you choose a password, we check it against known data breaches by sending only the first five characters of a one-way scrambled form of the password. Your password itself is never sent.
- Moderators and administrators of PubArx can see the information they need to screen submissions, handle reports and support users.
- Authorities, if the law requires us to disclose information, or if it is necessary to protect the rights, safety or security of users or of PubArx.
5. International transfers
Because our servers are in the United States and PubArx is used worldwide, your information is transferred to and processed in the United States and, through content delivery, possibly in other countries. Data protection law there may differ from the law where you live. We use established providers and limit the information we collect to what the service needs.
6. How long we keep information
| Information | Kept for |
|---|---|
| Account and profile | As long as your account exists. |
| Deleted accounts | Removed from the live database immediately; copies in backups are overwritten within 90 days. |
| Drafts you never submitted | Until you delete them or your account. |
| Submissions that were not published, and screening records | Kept privately as part of the screening record. On request we delete the PDF of a submission that was never published and keep only its title, dates and decision. |
| Published papers and public contributions | Indefinitely, as part of the scholarly record, subject to the withdrawal and removal rules in the Terms of use. |
| Session records (including IP address and browser type) | Deleted after 12 hours without activity. |
| Security and rate-limiting records (including IP address) | Expire automatically within 24 hours. |
| Scrambled visitor code for reading statistics | 26 hours. |
| Application error logs | 30 days. |
| Server access logs kept by our hosting provider | A short period set by the provider. |
| Notifications in your account | Read notifications are deleted after 90 days. |
| Emails waiting to be sent | Deleted once sent; failed attempts after 30 days. |
| Record of administrator actions (including the administrator’s IP address) | Kept for accountability while the service runs. |
| Backups | Overwritten within 90 days. |
| Messages you send us | As long as needed to deal with your request and any follow-up. |
7. Your choices and rights
- See and download your data: Privacy & data in your account gives you a copy of your data in a machine-readable format.
- Correct it: edit your profile at any time, or ask us to correct anything you cannot edit yourself.
- Make your profile private, and choose which notification emails you receive.
- Delete your account: if you have never submitted a paper or posted a public contribution, you can delete your account yourself. Otherwise we can anonymise it on request: your profile is removed and your name on reviews, endorsements and comments is replaced with “Former member”. Author lists of published papers stay as published, because they are part of the scholarly record; authors can correct their own entries by posting a new version.
- Object, restrict or withdraw consent: you can object to how we use your information, ask us to limit it, or withdraw consent you gave (for example to the weekly digest) at any time.
Write to privacy@pubarx.com from the address registered to your account. We reply within 30 days and may ask you to confirm your identity. Some information may be kept where the law requires it or where it is needed to protect the scholarly record or the rights of others. If you are not satisfied with our answer, you can complain to the data protection authority where you live.
8. Emails
We send the emails needed to run your account and your submissions: address confirmation, password resets, security notices, screening decisions and notifications about activity on your papers. You can turn off activity notifications in your settings. If you follow subjects, we send a weekly digest of new papers, which you can stop with one click from any digest. We do not send marketing emails; if that ever changes, we will ask for your consent first.
9. Cookies
We use only essential cookies: a session cookie that keeps you signed in and a security token that protects forms. There are no advertising, analytics or third-party cookies, and our pages load no third-party scripts or fonts.
10. Security and data breaches
All traffic is encrypted with HTTPS. Passwords are stored only as salted hashes. Uploaded files are checked automatically and stored outside the public web directory, and staff access is limited to what each role needs. No system is perfectly secure. If a security incident affects personal information, we will contain and investigate it, notify the people affected without undue delay where there is a real risk of significant harm, and notify the authorities where the law requires. Please report security issues to security@pubarx.com.
11. Children
PubArx is not intended for people under 18, and we do not knowingly create accounts for them. If we learn that an account belongs to someone under 18, we will close it.
12. Changes to this policy
We will announce significant changes on the site, and where practical by email to registered users, before they take effect. The date at the top shows when this policy last changed.