Privacy

Creating a paste writes one database row. It holds an internal id, the eight-character public id used in its URL, the content, a flag for whether the content is encrypted, and the time it was created.

That is the whole record. There is no column for an IP address, a user agent, a referrer, an email or an author, so none is recorded.

There is no sign-up, no login and no email field anywhere in the product. Pastes are not linked to each other or to a person. Two pastes made from the same browser have no stored relationship.

For an encrypted paste, the content field holds ciphertext produced in your browser. The password is never transmitted and never stored. The server cannot read the content, and neither can anyone with database access.

Full detail is on the security page.

Your theme preference (light, dark or system) is kept in localStorage so the site does not flash the wrong colours on load.

If you choose to remember a paste password, it is stored in that browser's localStorage. It is opt-in, it never leaves the device, and there is a control to forget it. Anyone with access to that browser profile can read it, which is why it is off by default.

The site uses Vercel Analytics to count page views. It is cookie-less and does not track visitors across sites or build individual profiles; it reports aggregate figures such as how many people viewed a page and roughly where they came from.

It runs on every page, including paste pages. It records the URL visited, which for a paste means its public id — not its content. Encrypted content is never readable by it, since decryption happens after the page loads and never leaves the browser.

The site runs on Vercel with a PostgreSQL database. As with any web host, infrastructure providers process connection data such as IP addresses in order to serve requests and to mitigate abuse. That is handled by the platform and is not written into the application database.

Pastes persist until deleted. Automatic expiry is planned but not built, so nothing currently removes a paste on a timer.

An encrypted paste whose password is lost is already effectively gone — the row remains, but it is unreadable ciphertext.

Content is not sold, shared or handed to advertisers. There are no advertising trackers, no social embeds and no third-party scripts beyond the analytics described above.