PubWiki Privacy Policy

Version: 1.0

Effective date: September 27, 2026

1. Who we are

pubwiki, Inc., an entity organized in Delaware, United States, operates PubWiki ("we," "us"). For personal data whose purposes and means we determine, we act as the controller or corresponding responsible entity under applicable law.

This Policy applies to PubWiki websites and related services that expressly link to it, including community and content browsing services (Hub), work creation and editing tools (Studio), services for running and playing works (Player), application programming interfaces (APIs) and related support communications. Other brands and independent third-party services are not automatically covered merely because they use the same technology.

Privacy and support contact: [email protected].

This Policy explains how we collect, use, disclose and retain personal data, and the choices and rights available to you. Personal data is information that identifies you or can reasonably be linked to you. Reading this Policy or accepting the Terms of Service does not constitute consent to every processing activity; we will seek consent separately in the relevant context where required by law.

2. Data we process

These data come from you and your device, sign-in or payment providers you use, agents you authorize and interactions or content from other users concerning you. The data processed depend on the features you use.

Information needed for account authentication, payment or another service you request is necessary to provide that function; without it, the relevant function may be unavailable. Optional usage analytics is not such necessary information. Account credentials and some content you submit may qualify as sensitive data under applicable law, and we apply the corresponding protection requirements according to their nature and use.

3. How we use data

Depending on the feature, we process data to create and secure accounts, save and run works, complete AI requests, provide publishing and community functions, manage credits and payments, recover unfinished operations, provide support, address abuse or infringement reports, diagnose faults and misuse, and meet tax, accounting and other legal duties. Product analytics helps us understand page and feature use, click frequency and user journeys to improve the Services.

Section 4 explains data use for AI requests and model training. We process personal data only to the extent needed for the relevant purposes. Before using data for a new purpose not previously described, we will provide notice and obtain separate consent where required by law.

4. AI requests, providers and content handling

When you use AI features, your instructions and relevant content, history and context may be sent through routing providers to model providers. Outputs, request status and some input context may be retained for delivery, recovery, billing reconciliation and troubleshooting.

Without your consent, we will not use your data to train AI models or commission others to do so on our behalf. Enabling usage analytics does not constitute consent to model training. On the model selection page, we will disclose whether the corresponding upstream provider uses your request data for model training, so you can review this information and choose before use. Information about providers, data retention and processing locations is addressed in Sections 7, 9 and 13 of this Policy.

Authorized personnel or service providers may access relevant records to investigate a problem you report or handle support, security or legal matters. Access and retention practices are addressed in Sections 9 and 10.

5. Payments and vouchers

Card details are collected and processed by the payment provider identified at checkout. PubWiki handles orders, transaction status and payment records returned by that provider.

Voucher QR images are decoded in your browser, and the redemption information is sent to us to obtain a quote and complete a redemption you confirm. That decoding step does not upload the original image. Images or receipts separately submitted to support are handled as support material.

When you buy a voucher from an external merchant, that third party handles its payment, identity or facial verification under its own policies. PubWiki's QR redemption feature does not itself require you to upload facial templates or identity documents to PubWiki. Payment networks and external providers may independently retain records needed for payment, security and legal duties.

6. Cookies, usage analytics and error diagnostics

We use cookies and browser local storage to maintain sign-in, remember language and interface preferences, and recover unfinished operations.

Usage analytics. To understand service usage and improve our products, we use a product analytics service to collect page types visited, clicks on designated interface elements and feature usage events. These analytics do not include input-field text, full URL parameters or page content as event properties, and session replay is disabled. Analytics records may be linked through browser or session identifiers stored in cookies or local storage and, after sign-in, through an internal account identifier. Recipients may also receive connection information, such as an IP address, as part of network transmission.

Usage analytics is optional. The sign-in and registration pages offer a "Send usage information to help improve the product" option. It is unchecked when no choice has been saved, and analytics information is collected only after you actively enable it. You may change your choice at any time through the "Usage analytics" setting. Declining or disabling this feature does not affect access to other services. Where prior consent is legally required, we will obtain your valid consent before the relevant collection and processing.

Disabling usage analytics stops subsequent analytics event transmission. This preference is stored in the current browser, applies across relevant subdomains of the same site and does not automatically synchronize across devices. Disabling the feature does not automatically delete previously collected data; you may submit a request under Section 11.

Error diagnostics. To identify and resolve faults and maintain service stability and security, we collect errors and related technical diagnostic information by default, including error messages, stack traces, application versions and technical environment information. You can separately disable client error reporting through "Error Reporting" in the privacy settings; disabling usage analytics does not disable this feature. We apply filtering measures to reduce personal data in diagnostic records, but the records may still contain personal data. Their retention and protection are governed by Sections 9 and 10 of this Policy.

These two settings do not control server operational and security records needed to provide services, process payments or protect accounts. Those records are handled for the purposes, on the legal bases and under the retention rules described in this Policy.

7. Data recipients

We provide service providers acting on our behalf with data needed to perform their services, subject to applicable contractual and access arrangements governing use, protection and deletion or return. Independent merchants, sign-in or payment providers and external agents you choose may be independently responsible for processing activities they determine, which are subject to their own privacy policies. Section 13 addresses international processing arrangements.

We may disclose relevant data to competent authorities, professional advisers or other appropriate recipients where legally required or necessary to protect lawful rights or safety. In a merger, financing or business transfer, necessary data may be disclosed to relevant parties under appropriate confidentiality and protection measures. We will notify you of changes in the responsible entity or purposes when required.

8. Public content and external agents

Profile information, works, articles, posts and comments you make public may be accessible to anyone. Community managers or other authorized parties can access information permitted by their roles. An "anonymous" display does not mean the platform cannot associate content with an account.

External agents or other third parties you authorize can access data within the scope you grant and process it under their applicable data-handling arrangements. Revoking access restricts future access but does not automatically delete copies already retained by third parties.

9. Retention and deletion

We retain personal data only for as long as needed for the purposes described in this Policy or applicable legal obligations. Retention depends on the data category, account and content status, outstanding matters, statutory retention requirements and applicable limitation periods.

Content deletion, removal from public view, account closure and personal-data erasure requests have different effects. Deleting or unpublishing content does not mean that all related versions, transaction evidence or backups are erased simultaneously. When handling an erasure request, we will explain the categories we need to retain, the reasons and applicable retention criteria. Data no longer needed or supported by a lawful basis for retention will be deleted or anonymized.

A license to remix a work does not replace a lawful basis for processing personal data or exclude applicable erasure rights. For copies held by independent third parties, we will meet applicable notification or assistance duties, but cannot promise to directly delete data outside our control.

10. Security

We use technical and organizational measures appropriate to the data and risks, including access controls, authentication protections and transmission safeguards. No system guarantees absolute security. We will meet applicable notification duties for reportable data incidents.

11. Your choices and privacy rights

You can manage personal information and privacy preferences in your account settings or send privacy requests to [email protected]. Please describe the right you wish to exercise and the account or content relevant to your request so we can locate and address it. You do not need an account to make a request.

Depending on applicable law and exceptions, your rights may include:

• Confirmation of whether we process your personal data, access, a copy and, where applicable, data portability;
• Correction of inaccurate data, erasure or restriction of specified processing;
• Withdrawal of consent or objection to processing based on legitimate interests;
• Opting out of legally specified sales, advertising sharing, targeted advertising, or certain automated decisions or profiling with legal or similarly significant effects.

Withdrawing consent does not affect the lawfulness of processing based on valid consent before withdrawal. You can disable usage analytics under Section 6 and contact the email above about other consent-based processing. Refusing nonessential processing does not itself restrict services that do not depend on it.

We request additional information only as needed to verify identity or an agent's authority or to fulfill a request. We will respond within applicable statutory periods, explaining the outcome, lawful retention exceptions and reasons for any extension or refusal. Requests are generally free; if a fee is legally permitted, we will explain its basis and amount in advance.

If you disagree with a decision, you may appeal to the same email address, identifying the original request and your objection. We will review it within the applicable period and explain the outcome and reasons. You may also complain to a competent privacy regulator or seek a legal remedy. We will not unlawfully disadvantage you for exercising your rights.

12. Additional information for United States users

Sections 2, 3, 7 and 9 describe the categories and sources of data we process, purposes, recipients and retention rules. United States state laws may give residents additional rights to information, access, correction, deletion, portability, limits on sensitive-data use or opt-outs of certain processing, subject to the applicable law.

You or a legally authorized agent may contact us under Section 11 to exercise these rights, including legally applicable opt-outs of personal-data sales, sharing for cross-context behavioral advertising or targeted advertising. You may appeal a decision through the same channel or complain to the competent state regulator.

Usage analytics is controlled by the choice described in Section 6; that setting currently does not change automatically in response to browser Do Not Track (DNT) signals. External sign-in, payment or other third-party services you use may link activity across different websites or services under their own policies. Their independent processing is addressed in Section 7.

13. International users and cross-border processing

We are a United States company and use the service providers described in Section 7. When you use the Services, data may be stored or processed outside your country or region, including through remote access by providers. Data protection rules may differ between jurisdictions.

Where relevant EEA or United Kingdom data protection law applies, we rely on the following legal bases according to the purpose and necessity of the processing:

• Contract performance or steps you request before entering a contract: processing necessary for accounts, creation, saves, AI requests, publishing, playing, payment and related support.
• Consent: optional usage analytics and other processing requiring separate consent, including model training by us or on our behalf as described in Section 4.
• Legitimate interests: securing services and accounts, investigating abuse and faults, resolving disputes and protecting lawful rights, where necessary and not overridden by your interests or fundamental rights and freedoms.
• Legal obligations: processing required by obligations recognized under the relevant data protection law, such as applicable accounting, tax and regulatory recordkeeping duties.

Legitimate interests do not replace consent or other conditions required for cookies, access to devices or sensitive-data processing. We take minors' particular protection needs into account in applicable assessments and measures.

For processing subject to international transfer requirements, we will take the protective measures required by applicable law. You may contact [email protected] to learn about international processing arrangements involving your data and request information about, or a copy of, the relevant safeguards as provided by law.

International users may make requests under Section 11 and retain applicable mandatory rights where they live. Our being based in the United States does not exclude those rights.

14. Age and minors

The minimum age to register for and use the Services is 13, or any higher minimum age for use required by applicable law where you live. Users who meet that minimum but have not reached the age of majority need a parent or legal guardian to agree to the Terms of Service on their behalf. Access to adult content requires users to be at least 18 and meet any other access requirements under applicable law.

The Services are not directed to anyone below the minimum age for use. Contact [email protected] if you believe a child below that age has provided personal data or have questions about our handling of minors' data. We will investigate and take appropriate action, including deleting data that should not be retained under applicable law.

For eligible users who are minors, we provide privacy protections required by applicable law. A guardian's acceptance of the Terms of Service does not replace legally required privacy consent. We will obtain separate or verifiable parental or guardian consent for the relevant processing where required.

15. Updates and contact

We will update this Policy as the Services and legal requirements evolve and state its effective date. We will communicate material changes to data uses, recipients or your rights through an in-service notice, email or another appropriate method, before the changes take effect where required by law. Where new consent is required, we will seek it separately rather than treat continued use as that consent.

The Chinese and English versions are intended to have the same meaning, without reducing applicable legal rights because of a language difference.

For questions, requests or complaints, contact [email protected].