Privacy Policy

Last updated September 5, 2026

PubSpace lets you publish HTML pages to a personal space and share them as links. This policy explains what data PubSpace — the website at pubspace.ai and the PubSpace Chrome extension — collects, how we use it, and the choices you have. We collect the minimum needed to run the service, and we never sell your data.

The Chrome extension

The PubSpace extension exists to publish a local HTML file to your account with one click. Specifically:

• When you choose to publish a page, the extension reads the HTML content of the local file you currently have open (a file:// .html or .htm page) and a title suggested from its filename, and sends them to your PubSpace account at pubspace.ai. Reading local files requires Chrome's "Allow access to file URLs" permission, which you grant explicitly.
• It stores your PubSpace API key and space name locally in your browser (Chrome extension storage) so it can publish on your behalf. These are cleared when you log out.
• It runs only on (a) local .html/.htm files you open and (b) your own pubspace.ai dashboard and login pages, in order to connect and disconnect your account.

The extension does not read, track, or transmit any other pages, and it does not collect your browsing history. Only the page you explicitly publish is sent to PubSpace.

Information we collect

• Account information — your email address, your chosen space name (subdomain), and — if you set one — your password. Passwords are optional for accounts created through the API (sign-in works via emailed link) and are stored only as a secure one-way hash; we never store your plaintext password. For accounts created after September 2026 we also keep the referring site or campaign tag (for example, "reddit.com" or a utm_source value) that your first visit arrived with, so we can tell which places people hear about PubSpace from. If you change your email, the new address is held temporarily until you confirm it from that inbox, and we send a notice to your old address so you'd know if it wasn't you.
• IP address, transiently — used to rate-limit signup, login, and publishing requests and slow down abuse. Held in memory only; not written to the database, not attached to your account, and not used for analytics or tracking.
• Content you publish — the HTML you publish, its title, any staged draft you haven't synced live yet (visible only to you), an optional per-document password if you set one (stored as a one-way hash, plus an encrypted copy so you can re-read it from your settings page), and a count of how many times each published link has been viewed.
• Viewer records on work-email-gated documents — if a publisher locks a document to their company's email domain, anyone viewing it first verifies a work email with us. We create a minimal account for that email (no password, no space) and record which verified emails have viewed each gated document. That list is shown only to the document's publisher.
• Usage events — anonymous, timestamped events such as "a document was viewed" or "a link was clicked," used to understand product usage. Since September 2026 a view or click event also records the domain of the site the link was opened from (for example, slack.com), when the browser sends one. These contain no IP addresses, no personal identifiers, and no page contents.
• Billing information — for Pro accounts, your subscription status and renewal date, and the Stripe customer/subscription identifiers needed to manage your subscription. We never store your card details; those live with Stripe.
• Server logs — standard request metadata (the request path, response status, timing, the host, and your account ID if you are signed in), kept for reliability and debugging. We never log the contents of your documents.

What we do not collect

We do not collect your browsing history, we do not track you across other websites (we may record which single site referred a visit, never your activity elsewhere), and we do not collect geolocation. We do not use IP addresses for analytics or tracking — only for the abuse-prevention rate limiting described above, and never stored. We do not sell or rent your information, and we do not use it for advertising. Data obtained through the Chrome extension is used solely to provide the publishing feature you requested, consistent with the Chrome Web Store Limited Use requirements.

How we use your information

• To operate the service: store and serve the documents you publish, run your account, and process logins and password resets.
• To keep the service reliable and secure: diagnose errors, monitor uptime, and prevent abuse.
• To understand aggregate usage so we can improve PubSpace.

Sharing and third parties

We share data only with the infrastructure providers needed to run PubSpace, and only so they can provide their service to us:

• Fly.io — hosts the application and database and captures our server logs.
• Resend — sends transactional email such as password resets and email verification messages.
• Stripe — processes payments for Pro subscriptions. We share the email address and account identifier needed to create and manage your subscription; Stripe never receives your PubSpace password or published content. Card details go directly to Stripe and never touch our servers.

We do not share your data with advertisers or data brokers. We may disclose information if required by law.

Sharing you control

A published document is unlisted by default — only people you give the link to can find it, and we ask search engines not to index it (Pro accounts can opt documents into search indexing individually, or set that as the default for every document published afterward; documents with a password or work-email wall stay hidden from search regardless). You can add a password to any document, or lock it to verified work emails at your own domain, and you can delete a document at any time. If you turn on your directory (off by default, in Settings), every published document you haven't hidden is listed together at your subdomain's address — still unlisted and not indexed, just grouped in one place instead of shared one link at a time. You can hide any document from your directory individually.

Data retention and deletion

Documents you publish remain until you delete them. When you delete a document it is removed from serving immediately and permanently purged from our database shortly afterward. To delete your account and all associated data, email us at the address below and we will remove it.

Security

All traffic is served over HTTPS. Account passwords are hashed, per-document share passwords are hashed (with the retrievable copy encrypted at rest), sign-in and reset tokens are stored hashed with short expiries, and database backups are taken on the hosting platform. No system is perfectly secure, but we take reasonable measures to protect your data.

Children

PubSpace is not directed to children under 13 and we do not knowingly collect their information.

Changes to this policy

If we change this policy we will update the "Last updated" date above. Material changes will be communicated through the service.

Contact

Questions about this policy, or requests to access or delete your data: support@pubspace.ai.