Docs / Privacy notice
Privacy notice
Draft for the owner. This text is a working draft, not yet the owner's privacy notice. It describes what the software stores; the owner reviews and replaces it before it is published as final.
Who runs PubPhys
PubPhys is operated by the Joint Quantum Institute and the Physics Department, University of Maryland. To reach the people who run it, use the contact form.
What is stored, and why
- Your account: username, name, role, and an email address and password hash if the account has them; the time you accepted the terms. To run your account.
- Your ORCID iD and the signed tokens ORCID issues when you sign in for a record. To show who signed what. Signed records are public by design and stay in the public log. A token also carries your given and family names as ORCID holds them, and it is public with your records until the account is deleted (What a record shows).
- A contact address, if you add one to an ORCID account: for notices about your account, and for email digests if you turn them on.
- Sessions: the IP address and browser of each sign-in, to keep you signed in and to spot misuse.
- Wrong passwords: on the account, how many wrong passwords were entered to confirm a change, a deletion or a link of an iD, since when, and until when such checks are paused (Accounts). No password and no network address. The right password, entered while no pause is on, clears the count, its start and the end of a past pause; a password reset, or a "This was not me" link that replaces the password, clears the count and the pause.
- The audit log: an internal list of account and moderation actions (who changed, released, removed or decided what, and when). Only the people who operate PubPhys see it.
- Registration requests: for each request at the email registration form that passes its checks while registration is open, whether or not it ends in an account, and for each account made by ORCID without an invitation: a keyed hash of the network address it came from, under a key that changes every day, the way in (ORCID or email) and the time. Not the email address. To limit registration requests per address and day, also against abuse by requests that never make an account. The daily key means the same address cannot be recognized from one day to the next.
- Contact messages: what you send through the contact form: its topic, its text and the address to reply to; the account you were signed in with, if any, and whether it had an ORCID iD; a keyed hash of the network address it came from, under a key that changes every day; when it was sent and when the admin read it. To answer you, and to limit messages per connection and day. Only the admin reads them; nothing is mailed to the reply address by PubPhys, and a message is never published, put in the public log or sent to an AI. Deleting your account leaves your messages until they are deleted, without the link to the account.
- Email digests, if you turn them on: your choice (off, daily or weekly), which notifications a digest is still to cover, and for each digest its period, its state and the notifications it listed, with the address only until it is sent (Notifications). To send the digests you chose.
- Paused addresses: when Resend reports that mail to an address bounced for good or was reported as spam: a keyed hash of the address, the reason, Resend's event id and the account. To stop mailing an address that cannot or does not want to receive mail. Confirming the address again lifts the pause.
- Resend's event ids: the id of each bounce or spam report Resend sent, with no address. So that a report Resend sends again, even after the pause was lifted, does not pause the address a second time.
- What you write: drafts, submissions, comments, and the records you sign.
Address hashes
To keep each address to one account and to limit mail, PubPhys stores a keyed hash (HMAC) of addresses instead of the address itself wherever the address is not needed in plain text: for an address waiting for its confirmation link, for the record of mail sent, for an address mail is paused for, and for a suspension that outlived its account. The key is kept apart from the database, so a copy of the database alone does not turn the hashes back into addresses.
How long
| Data | Kept |
|---|---|
| An address waiting for its confirmation link, or an email registration waiting for its link (its hash) | 24 hours |
| The record of a registration request (the daily hash of the network address) | 2 days |
| The record of mail sent to an address (its hash) | 2 days |
| The count of wrong passwords on an account, when it started and when a pause ends | until the right password is entered while no pause is on, or the password is reset; a count stops counting an hour after it started |
| The count of mail sent (category and day; no address) | 13 months |
| Which notifications a digest is still to cover | until that digest is built, or digests are turned off |
| A digest's record (its period, its state and the notifications it listed; the address only until it is sent) | 90 days |
| A paused address (its hash, the reason and the account) | while the account exists, then 2 years |
| Resend's event ids (no address) | 30 days |
| A suspension that outlived its account (the iD and address hashes) | until the admin lifts it |
| A record prepared for signing but not signed | 1 hour |
| An editor's or referee's decision staged for signing but not signed | 1 day |
| A source file uploaded but not used in a record | 7 days |
| An upload of a problem never published (after 30 idle days it is abandoned and its file deleted) | 30 days |
| Notifications on the site | 180 days |
| A contact message (its text, the reply address and the daily hash of the network address) | 180 days, or until the admin deletes it |
| What is sent to the AI provider (at the provider, under its standard terms) | up to 30 days |
| A session | until you sign out, or the account is deleted or suspended |
| Your account and addresses | until the account is deleted |
| The audit log | for good |
| Signed records, with the ORCID iD in them | for good (the public log) |
| Backups of the database | 30 days |
Who sees it
Your addresses, sessions and drafts are seen by no one else on the site. The people who operate PubPhys can read what is stored in its database. Signed records, and what they contain, are public.
Services PubPhys uses
- The server host and Cloudflare, through which every request passes.
- Resend, which delivers PubPhys's mail: account mail and, if you turn them on, email digests, with what a digest says (the titles of public pages it lists and your unsubscribe link). Resend tells PubPhys when mail to an address bounced or was reported as spam.
- ORCID, for signing in with an ORCID iD.
- An AI provider, for screening and formalizing what you submit (AI at PubPhys).
Your account and its data
You can change your addresses and password on the account page, and delete the account there or ask for its deletion (Accounts). For anything else about your data, use the contact form. Before deleting data or removing content on request, the admin checks that it is yours: for an account, from its confirmed address or by the account itself (by asking you to confirm on its account page or from its address).