Privacy

What we store for every paste

What we hold depends on which of three kinds of paste you create:

• Unencrypted paste — the server stores your content as plaintext. The link is unlisted (marked noindex, with an unguessable 12-character ID) but not secret: anyone who obtains it can read the paste.
• Password-protected paste — the password is access control only. The server checks an Argon2id hash before serving the paste, but it still stores your content as plaintext. This is not end-to-end encryption.
• End-to-end encrypted paste — your browser encrypts the content with AES-256-GCM before upload, and the server stores only the ciphertext. The decryption key lives solely in the URL fragment (#key=…), which browsers never send to any server. If the fragment is lost, the paste is permanently unreadable — by anyone, including us.

Alongside the content (plaintext or ciphertext), each paste record holds:

• the paste ID, created-at and expires-at timestamps, a language tag, and a view counter
• an Argon2id hash of the password, when one was set
• a SHA-256 hash of the paste's one-time delete code (every paste gets one)
• a "burned at" timestamp after a burn-after-read paste is consumed — the content itself is wiped, and this tombstone is kept for about 30 days so the link shows "burned" instead of a generic 404
• abuse reports submitted about a paste: the paste ID, a reason, and an optional message

What we never store

• Raw IP addresses — never written to the database or to logs (see rate limiting below).
• Encryption keys — the key for an end-to-end encrypted paste exists only in your link's fragment and is never sent to or stored on the server.
• Raw delete codes — only a SHA-256 hash is kept, and codes are compared in constant time.
• Raw passwords — only an Argon2id hash is kept.
• Names, emails, or accounts — there is nothing to sign up for, so none of this exists.

Rate limiting

To limit abuse, requests are counted against an identifier derived from your IP address with HMAC-SHA256. Only that keyed one-way hash is used — the raw IP address is never written to the database or to logs, and the identifier cannot be reversed back into an address.

Cloudflare & Turnstile

When the site is served through Cloudflare, Cloudflare processes connection data — including IP addresses — at the network level under its own privacy policy, before traffic reaches our server. The optional Cloudflare Turnstile CAPTCHA runs only on paste creation, and only when it is enabled. The application itself ships no analytics and no third-party scripts on any page.

Cloudflare's proxy can additionally inject its Web Analytics beacon (a script loaded from static.cloudflareinsights.com) into pages at the edge while that feature is enabled. It sets no cookies and does no cross-site tracking, and it is not part of the application — our goal is zero third-party requests, and this page will be updated when the beacon is fully removed.

Retention & deletion

Timed pastes (10 minutes to 1 week; the default is 1 day) are removed by a cleanup job once they expire. A burn-after-read paste is wiped the moment a reader explicitly confirms opening it; only the "burned at" tombstone remains, for about 30 days.

Every paste comes with a one-time delete code, shown once on the creation screen. It lets you delete the paste at any time, no account needed. See the FAQ for details.

Under GDPR Article 17 and similar laws, you can have your data erased at any time: use your delete code, let the paste expire, or email us for anything else.

Contact

For privacy questions, deletion requests, abuse reports, or vulnerability disclosures, write to [email protected].