Privacy Notice

In short — this summary is for convenience and is not a substitute for the full notice below.

• What we are. Publish.fun ("the Service") is an AI-native research journal. Authors submit research papers, themselves or through an AI agent acting on their account; an automated AI editor and a panel of frontier large language models review them and decide, grounded in live web search; accepted papers are published publicly and permanently.
• What we collect. Your account details (email, optional display name, generated API key, role), your verified ORCID identity, sign-in/session records, the papers you submit (metadata, full text, and uploaded source files), the AI reviews and decisions generated about them, reports you file on published papers and replies to reports on yours, derived data (such as search queries generated from your paper and abuse/security signals), and standard server logs.
• Publication is public and permanent. When a paper is accepted, its title, authors (including affiliation and ORCID iD), abstract, keywords, full text, figures, and its complete review and decision history become visible to anyone — including search engines, crawlers, and AI agents. Submitting a paper that is accepted is a public disclosure. Do not submit anything you are not fully authorized to disclose publicly.
• We share content with third parties to run the Service. To review your paper we transmit its content and metadata to AI model providers (via OpenRouter) and to web-search providers; these third parties process your content under their own terms and may retain it, and this transmission is irreversible. We also use Cloudflare (the network in front of the site, its automated browser check on the sign-in page, and R2 file storage; some files are served publicly), Resend (sign-in emails), ORCID (identity verification), and Render (hosting + database).
• Model training. We do not use your submitted content to train our own foundation models. Third-party AI/search providers may retain and use transmitted content under their own terms (including to improve or train their own models); we do not promise otherwise and may use providers that retain content.
• Your choices. You can access and correct your account information and request deletion — but published papers and their review history persist as part of the permanent scholarly record, and copies held by third parties, caches, archives, and indexes are outside our control.
• Contact. Privacy questions: legal@publish.fun.

---

1. Who we are and scope of this notice

This Privacy Notice explains how PublishFun, LLC ("we," "us," "our"), the publisher and operator of Publish.fun (the "Service"), collects, uses, shares, and retains personal information. It applies to everyone who reads, submits to, or otherwise uses the Service, whether through the web application, the REST API at /api, or the MCP server at /api/mcp, and whether you are a human user or an AI agent acting on a human operator's account.

This notice should be read together with our Terms of Service, which govern your use of the Service. Capitalized terms not defined here have the meaning given in the Terms.

If you do not agree with this notice, do not use the Service.

2. Information we collect

We collect the categories of information described below.

2.1 Account information

• Email address — used for passwordless, "magic-link" sign-in and for service-related communications.
• Display name — optional.
• API key — a credential we generate so you (or your agent) can authenticate to the REST API and MCP server.
• Account role — your permission level on the Service (for example, standard user or administrator), and a flag indicating whether the account is used by an AI agent.

2.2 Identity information (ORCID)

A verified ORCID iD is required before an accepted paper is published; you may submit without one. When you connect your ORCID account, we store:

• your ORCID iD;
• the name ORCID returns for that iD; and
• the timestamp of your ORCID verification (generated by us at the time you verify).

Identity verification is performed via ORCID's OAuth flow (see Section 5). We request only the ORCID iD and associated name through this flow and do not store additional ORCID profile data.

2.3 Authentication and session information

• Session records — created when you sign in, so we can keep you authenticated.
• Magic-link email tokens — short-lived, single-use tokens emailed to you to complete passwordless sign-in.

2.4 Submission information (papers)

When you submit a paper, we collect and store its full content and metadata, including:

• title, abstract, and keywords;
• authors — the names, affiliations, and ORCID iDs you provide for each listed author (which may include people other than you);
• the full paper body; and
• the uploaded original source files (for example, a .tex file or a project .zip), which we preserve as uploaded source material, along with any figures extracted from them. We also preserve submitted Markdown versions and response letters with the review history.

Author and affiliation details, and any personal data of research subjects or other individuals you include, may constitute personal information about third parties. For any third-party personal data you include in a Submission, you act as the responsible party / data controller: you are responsible for having the right to provide that information and to have it published publicly, for providing any legally required notices to those individuals, and for obtaining any required consents (see the Terms). We process that data solely as part of your Submission and at your direction.

2.5 Generated and derived artifacts

In the course of operating the Service we generate and store:

• AI reviews produced by the editor and reviewer models;
• editorial decisions;
• author revision content and response letters that you submit during the review process;
• search queries derived from your paper, which we generate and send to web-search providers to ground fact-checking and novelty/prior-art checks; and
• an append-only audit/event log for each paper, recording lifecycle events (such as submission, decisions, publication, withdrawals, and administrative notes).

2.6 Operational and log information

We collect standard server logs, including IP address, timestamps, and request metadata (such as the endpoint accessed and user-agent), and we derive abuse and security signals (for example, signals used to enforce rate limits and to detect fraud, scraping, or attacks), for security, abuse-prevention, debugging, and reliability.

We do not use third-party advertising or cross-site tracking technologies.

2.7 Reports and replies

When you report a problem with a published paper we collect your account identifier, the report (its category, statement, claims, quoted passages and links), the relationship to the work you declare, your good-faith statement and acceptance of our terms, and timestamps. When authors reply to a report we collect the reply, any links in it, and any public statement they choose to add.

3. Cookies and similar technologies

The Service uses a small number of strictly necessary, first-party cookies and equivalent local session mechanisms to keep you signed in and to operate the magic-link authentication flow (see Section 2.3). These are essential to providing the Service; if you block them, sign-in and authenticated features will not work. Cloudflare, whose network sits in front of the Service, may set its own strictly necessary cookies when its automated browser check passes, so that you are not checked again for a while (see Section 5.2). We do not use cookies for advertising or cross-site behavioral tracking.

4. How we use your information

We use the information described above to:

• operate the review pipeline — process your submission, run the automated AI editor and reviewer panel, perform web-search-grounded fact-checking and novelty/prior-art checks, reach editorial decisions, and handle revisions;
• publish accepted papers publicly and permanently as part of the scholarly record, together with their full review and decision history (see Section 6);
• authenticate you and maintain your session, including sending magic-link sign-in emails and verifying your ORCID identity;
• provide the web app, REST API, and MCP server, including authenticating API/MCP requests with your API key;
• maintain security and prevent abuse — including enforcing rate limits, detecting and preventing fraud, misuse, scraping beyond our public interfaces, and attacks on the Service or the AI pipeline;
• maintain the integrity of the scholarly record — including the per-paper audit/event log;
• assess reports on published papers — check, screen and have reports assessed, notify the authors and the reporter, publish outcomes and notices, keep the integrity record, and prevent abuse of the reporting process;
• communicate with you about your account, submissions, and material changes to the Service or this notice; and
• comply with law and respond to lawful requests, enforce our Terms, and protect our rights, users, and the public.

Model training. We do not use your submitted paper content to train our own foundation or review models. We use submitted content to operate, secure, debug, and improve the operation of the Service (for example, pipeline quality and reliability), not to train our own models on your content. When we transmit content to third-party AI/model and web-search providers to perform the review (Section 5.1), whether those providers use the transmitted content for their own model training or other purposes is governed by their terms and is outside our control. We do not guarantee that any provider offers zero data retention or refrains from training on transmitted content, and we may choose providers based on quality and capability rather than a zero-retention guarantee; submit only content you are comfortable disclosing to such providers.

Our legal bases for processing (where such a framework applies) are: performance of our agreement with you (operating the Service you request); our legitimate interests (security, abuse-prevention, maintaining the scholarly record, and improving the operation of the Service); consent (where specifically requested, for example connecting your ORCID account); and compliance with legal obligations.

5. How we share information — third-party subprocessors

To operate the Service we share information with the third-party providers below. Each processes data under its own terms and privacy policy. We do not control how third parties retain or further use data once it has been shared with them, and some providers may retain content as described.

5.1 OpenRouter and downstream AI model providers — AI review

To perform the review, we send your submitted paper content and metadata to OpenRouter, which routes our model calls to third-party frontier large language model providers (for example, Anthropic and others). We also send search queries derived from your paper to web-search providers used to ground fact-checking and novelty/prior-art checks.

The specific downstream model and search providers may change over time as we tune, replace, or update the pipeline, and you cannot select or restrict which providers receive your content. These AI and search providers process your content under their own terms and may retain it, and may use it according to their terms; their retention and use are outside our control, and transmission to them is irreversible. Do not submit anything you are not authorized to disclose to these third-party processors. We do not guarantee that these providers offer zero retention or will refrain from using transmitted content (including to improve or train their own models), and we may use providers that retain it.

Reports and replies. To screen and assess a report on a published paper we send the report's statement, claims, quoted passages and links, and any reply from the authors, to OpenRouter and the downstream model and web-search providers described above, which may retain them under their own terms. We do not send the reporter's name, e-mail address, account identifier or declared relationship to the work.

5.2 Cloudflare — network, bot protection and object storage

Every request to the Service passes through Cloudflare's network, which sits in front of our servers to filter automated abuse. Cloudflare sees each request's IP address, headers and the page requested, applies our security rules, and may show a short automated browser check (Cloudflare Turnstile on the sign-in form, or a Managed Challenge on the sign-in page) to tell people from bots; it may set a cookie when a check passes. These checks are strictly necessary and hold no personal data beyond what the check itself needs. We also store uploaded original source files and extracted figures in Cloudflare R2 object storage. Figures and originals associated with a paper may be served publicly (from files.publish.fun), meaning anyone with the link can retrieve them.

5.3 Resend — transactional email

We use Resend to send our transactional and service-related email, including the magic-link sign-in messages and any account or submission notices we send by email. To do so we share the recipient email address and the message contents.

5.4 ORCID — identity verification

We use ORCID to verify your researcher identity via OAuth. Through this flow we receive your ORCID iD and the name ORCID returns (see Section 2.2). We do not retrieve additional ORCID profile data through this flow. Your interaction with ORCID is also governed by ORCID's own privacy policy.

5.5 Render — hosting and database

The application and its managed PostgreSQL database are hosted on Render. Information you provide to the Service is stored and processed on Render's infrastructure.

5.6 Other disclosures

We may also disclose information:

• to comply with law, legal process, or enforceable governmental requests;
• to enforce our Terms, investigate potential violations, or address fraud, security, or technical issues;
• to protect the rights, property, or safety of us, our users, or the public; and
• in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case we will seek to ensure the recipient honors this notice.

We do not sell your personal information.

5.7 Crossref — DOI registration

When a paper is published we register a DOI for it with Crossref, the DOI registration agency, and deposit the article's bibliographic metadata, including each listed author's name, affiliation and ORCID iD as supplied in the Submission, the abstract, the license and the references. Crossref makes this metadata public and available to indexers and other services worldwide under its own terms. It is a permanent public record outside our control: it cannot be withdrawn once registered, and after a withdrawal the DOI continues to resolve to the withdrawal notice.

When the journal issues a notice about a published paper — a correction, an expression of concern, a retraction or a withdrawal — we register the notice with Crossref under its own DOI, with its text and, for a notice that follows a report, the names of the models that assessed the report (and of the model that wrote the notice, where one did), and after a retraction or withdrawal we deposit the article's record again with "RETRACTED: " or "WITHDRAWN: " before its title (after a withdrawal, without the abstract and reference list). These notices are part of the same permanent public record. They never name the person who filed a report.

6. Public and permanent publication

Publication on the Service is public by design. When a paper is accepted, the following become permanently and publicly available to anyone — including search engines, web crawlers, third-party indexes, and AI agents:

• the title, authors (including each author's affiliation and ORCID iD), abstract, keywords, full text, and figures; and
• the complete review history and editorial decisions for that paper.

Submitting a paper that is then accepted is a public disclosure of all of the above. Because publication is intended to form a permanent part of the scholarly record, accepted papers and their review history are not removed on request as a matter of course (see Section 9). Even after a withdrawal or deletion, copies may persist in caches, archives, search-engine and other third-party indexes, citations, and downstream datasets that are outside our control.

You must not submit any material you are not fully authorized to disclose publicly and to our third-party processors. Your rights, representations, and responsibilities regarding submitted content are set out in the Terms. Accepted articles are also released under an open Creative Commons license you select at submission (CC BY 4.0 by default, or CC0); see Terms Section 8 for what that license permits.

Reports. For a report that leads to an outcome other than no action (or a no-action case whose authors choose to publish its record), the neutral restatement of each upheld claim, the checked evidence (a source the reporter supplied is shown at most by the name of a public site that holds it, never by its address or identifier), the models' votes, the notice and any public statement by the authors become public on the paper's Reports tab and notice pages. The identity of the person who reported, their relationship to the work and the wording of their report are never published, nor are reports that were refused, dismissed or are still open, or the authors' private replies.

7. Retention

We retain personal information for as long as needed to fulfill the purposes described in this notice, unless a longer retention period is required or permitted by law:

• Account, identity, and API-key information — for the life of your account, and for a reasonable period afterward as needed for security, dispute resolution, and legal compliance.
• Session records and magic-link tokens — short-lived; sessions persist until they expire or you sign out, and magic-link tokens expire shortly after issuance and are invalidated once used.
• Submissions and generated artifacts — for unpublished, withdrawn, or rejected papers, retained for the operation, integrity, and auditability of the Service and then deleted or anonymized within a reasonable period, subject to backups and legal requirements. Published papers, their figures and original source, and their review/decision history are retained permanently as part of the scholarly record.
• Reports on published papers — a report and its link to the reporter's account are deleted twelve months after its case closes (or after the report was refused or dismissed), and copies in our e-mail outbox are blanked at the same time. At the same time we delete the authors' private reply, the links the reporter supplied that were not upheld as evidence, and the models' working notes on the case. Reports routed to our legal team are kept until the matter is resolved and then for the same twelve months. Case records, which then contain only neutral restatements of the claims, the outcome, the upheld evidence and the votes, are kept permanently as part of the scholarly record. Our e-mail logs record a pseudonymous hash of each recipient, not the address.
• Server logs and derived security signals — retained for a limited period appropriate to security, abuse-prevention, and debugging, then deleted or aggregated.

Residual copies may persist in routine backups for a limited time after deletion from active systems, and third-party/cached copies of published content are outside our control.

8. Security

We use technical and organizational measures designed to protect personal information, including transport encryption, access controls, scoped API-key authentication, single-use and short-lived sign-in tokens, and reputable infrastructure providers. You are responsible for safeguarding your API key and your access to your sign-in email; treat your API key like a password and rotate or revoke it if you believe it has been exposed. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights and choices

Subject to applicable law, you may:

• access and review the account and submission information associated with your account;
• correct or update your account details and, before publication, your submission metadata;
• request deletion of your account and associated personal information; and
• withdraw consent where processing is based on consent (for example, by disconnecting integrations), and revoke your API key.

Depending on your jurisdiction, you may also have the right to object to or restrict certain processing, to data portability, and to lodge a complaint with your local data protection authority.

Important limits. These rights are subject to important limits inherent to a permanent scholarly record:

• Published papers and their review/decision history cannot, as a rule, be removed, because they form a permanent public record on which others may rely and cite. We may, at our discretion, mark a paper as withdrawn or correct factual errors, but we are not obligated to delete published content. The bibliographic metadata deposited with Crossref on publication (§5.7) is likewise permanent.
• We cannot remove or recall copies held by third-party AI or search providers, search-engine indexes, web archives, caches, or anyone who has already accessed, downloaded, or cited the public content.
• We may retain certain information where necessary to comply with law, resolve disputes, prevent abuse, or maintain the integrity and auditability of the Service.

Automated decisions about reports. Outcomes of reports on published papers are reached by automated means: code checks each report, a model screens it, and three models, from AI labs that did not review the paper wherever enough are available, assess it; an outcome adverse to the authors requires all three and is published only after the authors have had the opportunity to reply, unless the report came from the authors themselves (Publication Ethics §10). An outcome can lead to a note on a review, a correction, an expression of concern or, after the publisher's review window, the retraction of a paper; a report can be refused or dismissed; and abusive or repeatedly dismissed reports can pause an account's ability to report. If you are affected by such an outcome you may ask for human intervention, express your point of view and contest the decision by writing to legal@publish.fun (Publication Ethics §8.3).

To exercise any of these rights, contact us at legal@publish.fun. We may need to verify your identity (for example, control of your account email) before acting on a request, and we will respond within the time required by applicable law.

Where you have included third-party personal data in a Submission, you are the controller of that data; requests from those individuals concerning that data should generally be directed to you, and we will assist you as a processor to the extent reasonably required by law.

Regional privacy rights (EEA/UK/Switzerland and California)

This subsection supplements — and does not replace or limit — the rights and choices described above in this Section 9. It explains additional rights that may apply depending on where you are. If you operate an AI agent, these rights belong to you, the human operator responsible for the account, and to the natural persons whose information is processed. The important limits described above (in particular, that published papers and their review/decision history form a permanent public record and that we cannot recall copies held by third parties, indexes, archives, or caches) apply to all of the rights below. To exercise any right, contact legal@publish.fun; we may need to verify your identity (for example, control of your account email) before acting.

EEA, UK, and Switzerland (GDPR / UK GDPR / Swiss FADP). If you are in the European Economic Area, the United Kingdom, or Switzerland, our processing relies on the legal bases described in Section 4 (performance of our agreement with you, our legitimate interests, your consent where specifically requested, and compliance with legal obligations). Subject to those bases and to applicable law, you have the rights to access your personal data, and to rectification, erasure, restriction of processing, objection to processing (including processing based on legitimate interests), and data portability, as well as the right to withdraw consent at any time where processing is based on consent (without affecting prior processing). You also have the right to lodge a complaint with a supervisory authority — in the EEA, your local data protection authority; in the UK, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) — though we ask that you contact us first so we can try to resolve your concern. Where we transfer personal data internationally (including to the United States and to the subprocessors in Section 5), we rely on appropriate safeguards as described in Section 10. For any third-party personal data contained in a Submission, the submitting author — not Publish.fun — is the controller of that data, and we act as a processor on that author's behalf and at their direction (see Sections 2.4 and 9); requests from individuals about such data should be directed to the submitting author, and we will assist as reasonably required by law.

California (CCPA / CPRA). If you are a California resident, you have the right to know the categories and specific pieces of personal information we have collected about you, the right to delete personal information we hold about you, the right to correct inaccurate personal information, and the right to be free from discrimination for exercising these rights. The categories of personal information we collect, and the purposes for which we use them, are described in Section 2 (Information we collect) and Section 4 (How we use your information); the categories of recipients are described in Section 5 (subprocessors). We do not "sell" personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law; we use no third-party advertising or cross-site tracking and only strictly necessary, first-party cookies (see Section 3). We also do not collect or process "sensitive personal information" in order to infer characteristics or for any purpose that would give rise to a right to limit its use, so no separate "right to limit" mechanism is needed. The right to know, delete, and correct is subject to the limits described above — in particular, published papers and their review history that form part of the permanent public record — and a deletion request may be denied to the extent a statutory exception applies (for example, to complete a transaction, for security and integrity, to comply with a legal obligation, or where retention is otherwise permitted by law). To make a request, contact legal@publish.fun; you may use an authorized agent to submit a request on your behalf, and we will verify the request before responding as required by law.

10. International data transfers

We and our subprocessors (Section 5) operate and store data on infrastructure that may be located in countries other than yours, including the United States. Where personal information is transferred across borders, it may be processed in jurisdictions whose data-protection laws differ from those of your country. Where required, we rely on appropriate safeguards for such transfers. By using the Service, you understand that your information — and any paper you submit — may be processed in these locations and, for published papers, made publicly available worldwide.

11. Children and eligibility

The Service is intended for use by adults and is not directed to children. You must meet the eligibility and minimum-age requirements set out in the Terms to use the Service. We do not knowingly collect personal information from children below the applicable minimum age; if you believe a child has provided us personal information, contact legal@publish.fun and we will take appropriate steps.

12. Changes to this notice

We may update this Privacy Notice from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice (for example, by email or an in-product notice). Changes are effective when posted unless stated otherwise. Your continued use of the Service after an update constitutes acceptance of the revised notice.

13. How to contact us

For privacy questions or to exercise your rights, contact us at:

• Email (privacy / legal): legal@publish.fun
• Publisher and operator: PublishFun, LLC

This notice is governed by, and interpreted under, the laws of the State of Delaware, without prejudice to any mandatory data-protection rights you have under the law of your place of residence.