Privacy Policy
Who is responsible for your data
The data controller is Publifye AS, a company registered in Norway with organisation number 826 774 622, at Solbergliveien 91D, 0683 Oslo, Norway. Write to us about anything on this page:
This policy covers publifye.com and the services Publifye AS runs under its own name: Darash, Junifye, Lexifye, Tringine, our published books, Bibles and applications, and our newsletter. Publifye AS is a Norwegian company, so the General Data Protection Regulation applies to the personal data described here.
We have not appointed a data protection officer. Requests are handled by a person at Publifye AS, at the address above.
Visiting this website
This website sets no cookies. If you choose a language, that choice is remembered in your own browser’s local storage and is never sent to us.
We count visits with our own analytics, which we run ourselves rather than buying in. Each page view records the path, the response status, the request method, the domain of the page you came from, coarse device, browser and operating system labels, the country and, for aggregate maps only, the city name. We do not record street-level location, and we take no latitude, longitude or postal code even though our network equipment offers them.
Your IP address is never stored as an address. It is hashed with a secret we hold, and the hash changes every day, so a visitor cannot be followed from one day to the next by anyone without that secret. Because we hold the secret, we can still re-derive the hash from an address ourselves — which is what lets us investigate abuse. This is pseudonymised data, not anonymous data, and we would rather say so.
Daily totals are kept for 91 days and monthly totals for a year. The per-visitor record behind them expires 24 hours after your last request. An address flagged for abuse is kept for 30 days by default.
The legal basis is our legitimate interest in knowing how the site is used and keeping it working (Article 6(1)(f)). No cookie is involved and there is no advertising network, no third-party analytics and no profiling.
We do not currently act on "Do Not Track" or Global Privacy Control signals. That is a gap, not a policy, and it is stated here rather than left for you to discover.
Operational logs
Our systems keep operational logs so that a fault can be diagnosed and abuse investigated. An ordinary log line is discarded within a few days. A line recording a warning, an error or an auditable action is kept for a year, and it carries the IP address of the request that produced it. The legal basis is our legitimate interest in running a service that works and can be secured (Article 6(1)(f)).
Keeping automated abuse out
Our sites carry a hidden link no reader can see or reach by keyboard. A client that follows it has identified itself as automated, and its address is recorded so our other sites can recognise it. The newsletter form additionally uses Cloudflare Turnstile, which means Cloudflare processes that request in order to answer whether it looks automated.
The legal basis is our legitimate interest in protecting our services from automated abuse (Article 6(1)(f)).
If you send us an enquiry
The form on our "work with us" page asks for your name and email address, and optionally your telephone number, organisation, role, website, what you are looking for and a message. It is stored on our own server and read by a person. Nothing about it is automated and nothing is passed to an advertiser.
Nothing deletes an enquiry automatically today. We keep it while the conversation it started is live and delete it when you ask us to.
The legal basis is taking steps at your request before entering into a contract, and our legitimate interest in answering people who write to us (Article 6(1)(b) and (f)).
If you use the app support form
The support form asks for a category, a subject, a message, your name and your email address, and optionally a support code shown inside the app. Your browser sends it directly to a function we run in Amazon Web Services’ Stockholm region; this website never sees the submission. The legal basis is providing the support you asked for (Article 6(1)(b) and (f)).
The newsletter
Subscribing records your email address, the topics you chose, the language of the page and your browser’s time zone. The request itself is checked for automated abuse, which uses your IP address, browser identification and referring page at that moment; for an ordinary signup none of those three is stored afterwards. A signup our checks hold as suspected automation is kept for 30 days, with those details, so a person can look at it.
Nothing is added to a mailing list until you click the confirmation link we email you. An unconfirmed signup is a request, not a subscription, and it is discarded after 48 hours.
The legal basis is your consent (Article 6(1)(a)). Every newsletter carries an unsubscribe link and you may withdraw consent at any time. Unsubscribing marks you as unsubscribed and puts your address on a suppression list, which is how we make sure we do not email you again; ask us and we will delete the record itself.
Your Publifye account
Our services share one Publifye account. It holds your email address, your password as a hash and never as a password, whether the address has been verified, an optional recovery address and optional two-factor setting, when you accepted our terms, whether you asked for marketing email, and whether mail to you has bounced. We do not offer sign-in through Facebook, Google or Apple.
We also keep, as security evidence, the IP address, browser identification and referring page recorded when the account was created and when a password reset was requested. That record has no expiry, because it is what lets us tell a genuine account from an automated one long after the fact.
The legal basis for the account itself is our contract with you (Article 6(1)(b)); for the security evidence it is our legitimate interest in preventing fraud and abuse (Article 6(1)(f)).
Closing an account removes it from use immediately and keeps a restorable copy for 30 days, after which it is erased. That window exists so a deletion made in error can be undone.
If you buy something
Card details are entered on a page hosted by Stripe, our payment processor, and they never reach us. We do not receive, see or store your card number, and we do not store its last four digits either.
What we keep is the order: the amount, the currency, the tax, the items, Stripe’s own references, and your name and country. For a physical item we also keep the delivery address you gave. An invoice or receipt holds your name, any company name, your contact details, your address and any tax number.
Orders, invoices and receipts are accounting records and nothing deletes them automatically; we keep them for as long as Norwegian bookkeeping law requires. The legal basis is our contract with you (Article 6(1)(b)) and, for the accounting records, our legal obligation (Article 6(1)(c)).
A purchase made inside an application from the Apple App Store is a transaction with Apple. Apple does not give us your payment details, and what Apple holds is covered by Apple’s own privacy policy.
Email we send you
We keep a record of each message we send — sender, recipient address, subject and the message itself — for 180 days, so that we can tell what was sent and answer a question about it. We do not use tracking pixels and we do not measure whether an email was opened. Links in our own email carry an identifier of the message they came from, so we can tell which message a click came from; links to other people’s sites and the unsubscribe link never carry one.
An address that bounces, or that asks us to stop, goes on a suppression list which is kept indefinitely. Deleting that entry would mean losing the record of the request not to be contacted.
Who else handles your data
We use these companies to run our services. They act on our instructions and are not permitted to use your data for their own ends.
- Leaseweb Deutschland GmbH — the servers our services run on, in Frankfurt, Germany
- Amazon Web Services — file storage, outbound transactional email and the support form’s intake function in the Stockholm region; encrypted database backups in the Ireland region; and CloudFront and Route 53 for delivering files and answering DNS
- Cloudflare — the Turnstile check that protects our newsletter form from automated signups
- Stripe — payments and card handling
- Zoho — our support mailbox, in the European Union
- Google — the mailbox we send business correspondence from
Some of our services send the content you give them to a third-party AI provider in order to do the thing you asked for — a translation, a draft, a check. Those providers are outside the EEA. Your account details are not sent with it.
We do not sell personal data and we do not share it with advertisers.
Data leaving the EEA
Our services run on our own server in Frankfurt, Germany. The Amazon Web Services regions we use are Stockholm and Ireland. All of those are inside the EEA.
Some processing nevertheless happens outside the EEA, and we would rather name it than imply otherwise. Our content delivery network serves files from the edge location nearest the reader, anywhere in the world, and its request logs include the visitor’s IP address. Several of the companies above are established in the United States. The AI providers named above are outside the EEA. Where personal data is processed outside the EEA it is under the transfer safeguards those providers offer under Chapter V of the GDPR; write to us and we will tell you which one applies to a particular provider.
Your rights
Under the GDPR you have the right to:
- Access — a copy of the personal data we hold about you
- Correction of anything that is wrong or incomplete
- Deletion of your data, and of the account itself
- Restriction of how we process it while a question about it is open
- Portability — the data you gave us, in a machine-readable form
- Objection to processing we base on our legitimate interest
- Withdrawal of consent you gave us earlier, which does not affect what was lawful before you withdrew it
We act on a request when we can tell it comes from the person the data belongs to, so a request is made from a signed-in account wherever there is one. The route, in full, including what to do if you have no account or have lost access to it: Data Deletion Instructions
We answer within 30 days, in line with the one-month period the GDPR sets. If a request will take longer, we tell you why before the month is out.
If you are not satisfied
Tell us first, and we will try to put it right. You also have the right to complain to the Norwegian Data Protection Authority — Datatilsynet — whether or not you have spoken to us: see datatilsynet.no. If you live in another EEA country you may complain to the supervisory authority there instead. Our address is:
How we protect your data
Traffic to our sites is encrypted in transit. Passwords are stored only as hashes and are never recoverable, by us or by anyone else. Access to systems holding personal data is limited to the people who need it. Our databases are backed up on a schedule and encrypted before the backup leaves the machine. No system is perfectly secure, and we will not claim otherwise.
Children
Our services are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.
Changes to this policy
We update this policy when what we actually do changes. The date at the top is the date of the current version, and where a change materially affects you we will say so on the service itself or by email.