Privacy Policy
Effective 5 September 2026. The data controller is Your Company Ltd, reachable at [email protected].
What we collect and why
| Data | Why | Kept for |
|---|---|---|
| Paste content, title and settings | To store, display and print your paste. This is the service. | Until the paste expires or you delete it |
| A salted hash of your IP address, stored with each paste | To enforce the daily paste limit and to act on abuse. The raw address is not stored and the hash cannot be reversed. | As long as the paste |
| Username, password (hashed) and optional email | To run your account and, if you give an email, to reset your password and send receipts. | Until you delete your account |
| Stripe customer and subscription IDs | To know that you are a Pro subscriber and let you manage billing. Card details go directly to Stripe and never reach our servers. | Until you delete your account; Stripe keeps its own records as required by financial rules |
| API key hashes and daily request counts | To authenticate API calls and enforce limits. | Until you revoke the key or delete your account |
| Abuse reports, including your email if you give it | To review and act on reports. | Up to two years |
| Server logs (IP address, URL, browser type) | Security and debugging. | 30 days |
We do not sell personal data, show advertising, or use third-party analytics or tracking.
Cookies
We set two cookies, both strictly necessary for the site to function: a session cookie (which keeps you signed in and remembers which password-protected pastes you have unlocked) and a CSRF token that protects forms. Because neither is used for tracking or advertising, no consent banner is required. Stripe sets its own cookies on its checkout page, which is covered by Stripe's policy.
Who else sees your data
- Anyone with the link can read a public or unlisted paste, and public pastes are listed on the site and can be indexed by search engines. Private and password-protected pastes are not indexed.
- Stripe processes payments for Pro subscriptions.
- Our hosting provider stores the database and logs. Hetzner, Germany
- Authorities, if we are legally required to hand data over.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR or CCPA) you can ask to access, correct, export, restrict or delete your personal data, and complain to your local data protection authority. You can do most of this yourself:
- Export everything tied to your account as JSON from your account page.
- Delete individual pastes from the paste page, or your whole account (pastes, keys and profile) from delete account. Deletion is immediate and permanent.
- Anonymous pastes are not linked to an identity we can verify. To have one removed, use the abuse page and tell us how you can show it is yours.
For anything else, email [email protected].
Security
Passwords and API keys are stored only as salted hashes, traffic is encrypted in transit, and access to the database is restricted. No system is perfectly secure; if we learn of a breach affecting your data we will tell you as the law requires.
Children
The service is not directed at children under 16 and we do not knowingly collect their data.
Changes
We will post updates to this policy here and change the effective date. Significant changes will be announced on the site.