Privacy notice

This notice explains what PubUnlock collects when you ask for email updates, donate a sample file, convert .pub files, or pay for a batch. The product name, legal name, postal address, email, and domain on this page come from one config file.

Product: PubUnlock
Operator: PubUnlock is operated by Kenan Cackovic, a sole proprietor
Postal address: 5921 Landis Ave, Unit 1, Carmichael, CA 95608, US
Contact email: support@pubunlock.com
Domain: pubunlock.com

What we collect

Email address, if you ask for email updates, donate a file, contact us, or opt out.
Audience type, which is a required choice of church, nonprofit, or school.
The consent text you agreed to, and the time you agreed.
Whether you confirmed, unsubscribed, or asked us not to sell or share.
Sample .pub files and their file names, only if you donate them and check the box. Do not donate a file that contains personal information.
If you use the contact form: your name, email, and message. We use them only to reply. The message is sent through Resend and we do not store a copy.
If you pay for a batch: the tier (free, small, medium, or large), the amount in cents, the currency (usd), the status (free, pending, paid, or refunded), the Checkout session id, the payment intent id, the Checkout URL, the count of successful files, and the times the row was created and updated. We do not store your card number, expiry, or CVC. Stripe handles the card. We also store the id and type of each Stripe webhook we have already applied, and we delete those event ids after 30 days.
A necessary cookie that remembers analytics consent, a do-not-sell choice, or that you dismissed the Global Privacy Control notice.
The Global Privacy Control signal, if your browser sends it.
If you choose Accept, a cookieless count of the page path and the day. We do not store an identifier for this count. For rate limits on forms, we store an HMAC of the IP address using a secret salt, not the raw address, and we delete those records after 30 days. For the weekly free-file allowance, we store that same kind of salted HMAC, the number of successful files, and the time. We do not store the raw address. We delete those rows after 7 days.

How we use it

We use the email and audience type to send the updates you asked for, and only after you confirm. We use sample files only to test conversion quality. We use files you upload for conversion to make a watermarked preview and a converted copy, and we use the payment row to know whether that batch is paid. We use contact messages to reply. We do not use files or messages to train AI.

Sample files and converted files

Donated .pub files are used only to test conversion quality. They are never shared or published. Unconfirmed files are deleted within 24 hours. Confirmed files are kept for 90 days, then deleted. You can ask us to delete them at any time. Do not upload a file that contains personal information. The donation checkbox is separate from the email-updates checkbox and starts unchecked. We email you a link to confirm the donation and a link to delete the files sooner. PubUnlock also accepts .pub files you upload to convert them. We process those files to make a watermarked preview and a converted copy. A separate converter, hosted for us on Fly.io, processes the files. We delete the upload, the preview, and the converted copy within 24 hours, and you can delete them now from the batch page. The payment row for that batch is deleted with the batch. We keep a log of the product, the file name, and the file count for 30 days. We also keep each file name and the conversion details (size, Publisher version, result, error code, duration, and tier) for 90 days for support and quality. That detail log is separate from deleting the files within 24 hours. A deletion request removes it. The detail log does not include the file contents, an IP address, or an email address. To honor a deletion request after the batch row is gone, we keep a salted hash of the email with the batch id for those same 90 days. The converter deletes its own copy within about an hour after conversion finishes. Nothing in these files is used to train AI.

Cookies and optional scripts

Before you choose, we do not set an analytics cookie and we do not run optional analytics. A short necessary script reads Global Privacy Control from the browser so the page can honor it. It does not call a third party. A necessary HttpOnly cookie named pr_batch_ plus the batch id, sent only to pages for that batch, stores the batch link token for 3 hours so Checkout can return you to the batch without putting the token in the payment address. Cloudflare Turnstile, used only before a free batch, may store a cookie on the Cloudflare domain to tell a person from an automated request. Paid checkout does not load it.

Reject, or a do-not-sell choice, leaves optional analytics off. Accept allows a same-site request that counts the page. That request does not set a cookie. There is no advertising script and no third-party analytics.

Sale, sharing, and Global Privacy Control

We do not sell personal information. We do not share it for cross-context behavioral advertising. If your browser sends Sec-GPC: 1 or sets navigator.globalPrivacyControl, we treat that as an opt-out: optional analytics stay off, and we set a necessary preference cookie so the opt-out sticks.

Do Not Sell or Share My Personal Information

Email choices

Update email is double opt-in. The consent line is: “Email me about PubUnlock and related updates. Unsubscribe anytime.” Every email includes a one-click unsubscribe link and the postal address in this notice. Opening that link does not change anything until you press the button. Confirmation links expire after 7 days. Unsubscribe and delete links do not expire, including after you confirm and after we send another confirmation. Sending the form again does not change the consent already stored for that email until you confirm the new message. If you have unsubscribed or deleted your record, submitting the form again does not restore update email. We send at most one rejoin confirmation every 30 days, and only completing that confirmation creates a new consent record from that submission. The earlier consent is kept for our records until you delete your data, and it is not used to send email. Deleting your record deletes that consent history. A rejoin that is not confirmed is deleted after 7 days, and we keep only a hash of the address. You can also use the unsubscribe page. If you enter an email there, we send a link to confirm; that request does not unsubscribe you by itself.

Who processes it

Vercel hosts this site. Supabase stores email-update records, donated files, conversion files, payment rows, and Stripe event ids. Resend sends confirmation email and contact-form email. Stripe is the payment processor. Stripe Checkout collects the payer email and the card or billing details directly. Stripe receives those details and keeps the card data under its own retention. We store the payment row described above and we do not store the card number, expiry, or CVC. Cloudflare Turnstile checks that a free batch is requested by a person. We send Cloudflare the visitor IP address for that check, along with the browser interaction, and only when the batch can be free. Paid checkout does not send anything to Cloudflare. Fly.io hosts the converter. The converter for PubUnlock processes .pub files you upload for conversion. It receives the file bytes, the file names, and a callback address when that callback is configured. Those processors handle the information needed to host the site, store the records, convert the files, take payment, and deliver the email. Supabase, Resend, and Stripe keys stay on the server. Email-update records are kept until you unsubscribe or delete them. After deletion we keep only a hash of the email, keyed with a secret, not the address, until a new confirmation succeeds. An unconfirmed rejoin is deleted after 7 days. Unconfirmed sample files are deleted within 24 hours. Confirmed sample files are kept for 90 days. Conversion uploads, previews, converted copies, and the payment row for that batch are deleted within 24 hours. Confirmation links expire after 7 days. Unsubscribe and delete links do not expire. Stripe event ids are deleted after 30 days.

How long we keep it

Email-update records: until you unsubscribe or ask us to delete them. Deleting the record also deletes its consent history. A suppression hash stays until you submit the form again and confirm the new email. Submitting the form alone does not restore update email. We email a suppressed address at most once every 30 days. An unconfirmed rejoin is deleted after 7 days.
Sample files: unconfirmed files within 24 hours, confirmed files after 90 days. You can ask us to delete them at any time.
Conversion files and the payment row for that batch: within 24 hours. You can delete the batch sooner from the batch page.
Stripe event ids: 30 days.
Refund holds: if a refund or dispute arrives before the payment row, we store the Stripe payment-intent id so a later paid notice cannot unlock the downloads. We delete those ids after 30 days, with the Stripe event ids.
Contact messages: we do not store a copy. Resend delivers the message so we can reply.
Page counts: daily totals only.
Rate-limit records: an HMAC of the IP address, deleted after 30 days.
Free-file allowance: a salted HMAC of the IP address, the successful-file count, and the time, deleted after 7 days.
Conversion details: the file name, size, Publisher version, result, error code, duration, and tier, kept for 90 days for support and quality, separate from deleting the files within 24 hours. A deletion request removes them. The detail log does not include the file contents, an IP address, or an email address. A salted hash of the email is kept with the batch id for those 90 days so the deletion request can still find the rows.

GDPR

If the GDPR applies to you, we use these lawful bases: contract, to convert the files you upload and to take the one-time payment for that batch; consent, for email updates and for optional page counts; and legitimate interests, for security, rate limits, and keeping the site reliable. Payment rows exist so we can tell that a batch is paid, and they are deleted with the batch within 24 hours. You can ask for access, rectification, erasure, restriction, and a portable copy of the information we hold, and you can object to processing based on legitimate interests. Email support@pubunlock.com. You can also complain to a data-protection supervisory authority. Vercel, Supabase, Resend, Stripe, Cloudflare, and Fly.io process this information in the United States. Those transfers rely on the safeguards those processors provide.

CCPA

If the CCPA applies to you, the categories we collect are identifiers (your email), commercial information (the tier, amount, currency, status, Checkout session id, and payment intent id — not the card), internet activity (a daily page count only if you choose Accept), and the files you upload. You can ask to know, correct, or delete that information by emailing support@pubunlock.com. We do not sell personal information and we do not share it for cross-context behavioral advertising. The do-not-sell page records that choice. We do not discriminate against you for using these rights.

Deletion and access

If you still have the link from an update email, the unsubscribe page has a Delete my data button. That request is authorized by the link’s token. That request also removes conversion detail rows for batches tied to the address, including after those batches have been deleted. You can also email support@pubunlock.com to ask for a copy or deletion. There are no accounts. Deleting a batch deletes its payment row. Card data stays with Stripe.

Children

This service is not directed at children, and we do not knowingly collect their information.

Changes

If this notice changes in a material way, we will update this page.