Privacy Policy

Last updated: November 7, 2026

This policy describes how Paste handles information when you create, view, or manage pastes. By using the service, you agree to this policy.

What we store

• Paste content — encrypted at rest in our database.
• Metadata — title, format, slug, expiry, options, view counts, and timestamps.
• Passwords — stored as one-way hashes; we cannot recover your password text.
• Visit logs — IP address, browser, device, and general location for analytics and abuse prevention (admin access).
• Comments — if discussion is enabled on a paste.

Anonymous vs signed-in use

Without an account, a private owner token in your browser links you to pastes you created on that device. With Google sign-in, pastes are associated with your account so you can access them across devices. You can delete your account from Settings; pastes are soft-deleted and can be reactivated if you sign in again with the same Google account.

Search engines

Individual paste pages use noindex and are excluded from our public sitemap. Marketing pages (home, Features, FAQ, etc.) may be indexed.

Security

Content is rendered through XSS-safe pipelines. We use HTTPS, rate limiting, CSRF protection, and Content Security Policy on paste views. This is not a zero-knowledge service — server operators can decrypt content for rendering, exports, and administration.

Cookies & local storage

We use session cookies for unlock state, authentication, and CSRF. Anonymous owners rely on a browser-stored token for My Pastes. Theme preference may be stored in localStorage. When Google Analytics is enabled, Google may set cookies (for example _ga) to measure traffic with IP anonymization.

Third parties

Google Sign-In is optional and governed by Google's policies. If configured, we use Google Analytics 4 to understand aggregate usage (page views, paste creates, shares). We do not sell your personal data.

Contact

Questions about privacy? Reach the site operator through the contact channel listed for Paste.