Privacy

What we hold, and how to make us delete it

Last updated 2026-08-27. Written to be read, not to be survived.

If you received an email from us

We contacted you because you are listed as corresponding author on a published article in a field we work in. Your name, institution, and contact address came from that publication's public record. We were writing to offer you paid professional work in your area of expertise.

Under the GDPR, our basis for that is legitimate interest (Art. 6(1)(f)): contacting a named professional about paid work in their own stated specialism, using an address they published for professional contact. You can object at any time and we stop — see below.

What we hold about you

Data	Source	Kept for
Name, institution, country	Public publication record	Until you ask us to delete it
Email address	Corresponding-author line of a published paper	Same
ORCID, publication counts	OpenAlex, PubMed (open databases)	Same
Whether we emailed you and whether you replied	Us	Same

That is the whole list. We do not buy data, and we do not enrich it from anywhere else.

Removal

Reply REMOVE to any email from us, or write to privacy@firstreferee.com. No reason needed and no questions asked.

We act within 24 hours. We delete everything except a one-way hash of your email address, which exists solely so that you are never contacted by us again. If you would prefer we not keep even that, say so and we will delete it too — but then we cannot guarantee you won't reappear in a future list drawn from public records.

Your other rights

Access, correction, portability, objection, and complaint to your supervisory authority. One email to privacy@firstreferee.com covers all of them; we answer within 30 days and usually within two working days.

If you sent us a manuscript

Your manuscript is confidential unpublished research and we treat it that way.

It is shown to one reviewer, after they have been cleared for conflicts and have signed a confidentiality agreement.
If you posted it openly, other reviewers saw the abstract and target journal only — never the full text.
Every file access is logged, and the log is yours on request.
It is never used to train any model, by us or by anyone we work with. This is written into every reviewer agreement.
We delete manuscripts 12 months after the report is delivered, or immediately if you ask.

Payment card details are handled by Stripe and never reach us. We see the last four digits and nothing else.

Who we share with

We do not sell data and we do not share it for anyone else's marketing. The only third parties involved are the ones needed to run the service: Stripe (payments), our email provider, and our hosting provider. Reviewers see your manuscript; nobody else does.