Last updated: 23 October 2026
publish.my is built to need very little about you: an email address, and the files you choose to make public. This page says exactly what we collect, why, and how to have it deleted.
publish.my (the "Service") is operated by AISOFT TECHNOLOGY SDN. BHD. (Company Registration No. 202401005498 (1551348-X)), a company incorporated in Malaysia ("we", "us", or "our"). We handle personal data in accordance with the Malaysian Personal Data Protection Act 2010. This policy is part of our Terms of Service.
Contents
Your email address, which you give us to activate a site or sign in to the console.
If you sign in with Google, we ask Google only for your email address (the openid email
scope) and keep only that: not your name, photo or Google account ID.
The files you publish, each site's page title, a preview screenshot of its home page (not taken for password-protected sites), and the site's password in hashed form if you set one.
The IP address each upload comes from, and the IP address and browser user-agent of actions taken on your account (signing in, publishing, changing or deleting a site, creating API keys). We keep these in an audit log for security and abuse prevention.
Our web servers log each request to a published site, including the visitor's IP address. Those logs are deleted after 14 days. The view counts you see in the console are stored as daily totals per site, with no IP addresses or other visitor details.
If you report a site or write to us, we keep your email address, IP address and what you sent.
When an AI assistant publishes for you, through our API, our command-line MCP server or the publish.my connector in apps such as claude.ai and ChatGPT, we receive only what it sends to publish: the files of the site. We never receive your conversation.
When you connect a chat app, we record the app's name as it identifies itself, the address it returns you to after sign-in, and the IP address it connected from. The connection works through an API key on your account labelled with that app's name. It does not expire; you can revoke it at any time under Console → API keys, which disconnects the app. Publishes made through a connector are logged like any other, together with the app's name.
We do not sell personal data, use it for advertising, or build profiles of you.
We use these providers to run the Service. Each processes data only for that purpose:
We may also disclose data where the law requires it, or to protect the Service and its users against abuse.
__Host-pmsess) and a security token
(__Host-pmcsrf): 30 days, or until you sign out.The API sets no cookies. The sites you publish get no cookies from us.
You can ask us for a copy of the personal data we hold about you, and ask us to correct or delete it. To delete your account, together with its sites, upload archives and preview images, email [email protected] from the address on the account. We will do it within 30 days and confirm by email. We may keep a minimal record where the law requires it or to prevent abuse.
You can delete individual sites and API keys yourself at any time in the console.
Our servers, file storage and backups are in Singapore. Cloudflare, Google and Resend may process data in other countries. Where data leaves Malaysia, we rely on these providers' own safeguards for international transfers.
The Service is not for children under 13, and we do not knowingly collect their personal data. If you believe a child has given us their details, contact us and we will delete them.
When we change this policy, we update the "Last updated" date above. For material changes, we take reasonable steps to tell you, for example by email.
Privacy questions and requests: [email protected]
Legal: [email protected]
Report abuse: [email protected]