Privacy Policy

What we store

When you create a paste, we store the paste itself:

• · The file name, language, and content of each file in the paste
• · Metadata: title, creation time, optional expiry time, visibility setting, and view count
• · A per-paste owner token, used only to prove you can delete or manage your own paste

That's it. We don't require an account, an email address, or any personal identifier.

What we don't store or do

• · No web beacons, no fingerprinting, and no advertising cookies
• · No advertising and no tracking across other websites
• · No selling or sharing of data with third parties - there is no data to sell
• · No social logins, and we never ask for your email to use the service

Analytics

We use Minilytics, a self-hosted analytics tool that runs on our own infrastructure, to see which pages and buttons people use. It records the page you visited, the site that referred you, your browser and operating system, the country you connect from, and the buttons you click on our pages. To recognise return visits it keeps a random visitor and session ID in your browser's local storage - no cookies and no cross-site tracking. This data is not sold or shared with third parties.

We also use Google Analytics for aggregate traffic statistics. It sets its own cookies, which your browser or an extension can block without affecting the site.

Encryption

Password-protected pastes are encrypted at rest with AES-256-GCM. The encryption key is derived from your password using scrypt, and only the ciphertext is stored - the password itself is never saved. Without the password, the paste content cannot be read, including by us. If you lose the password, the paste content is unrecoverable.

Visibility

• · Public - visible on the recent-pastes archive and to search engines.
• · Unlisted - only reachable by direct link; never listed or indexed. This is the default.
• · Private - requires the password you set; content is encrypted as described above.

Retention and deletion

• · Pastes with an expiry are automatically deleted when the expiry passes.
• · Burn-after-read pastes are deleted after the first successful view.
• · You can delete any paste you created using its owner token - deletion removes it from storage immediately.
• · Pastes without an expiry are retained until deleted, or until we remove them for a violation of our Terms of Service.

IP addresses and server logs

Like any web service, our servers receive your IP address when you visit. We use it transiently for rate limiting (for example, a limit on paste creations per IP) and for basic abuse prevention. IP addresses are not stored as part of your paste and are not used to build profiles of you.

Your rights

Because we don't collect account data, there's usually nothing to access or erase beyond the pastes themselves - and you can already delete those yourself with the owner token. If you need help, or you're writing to us from a jurisdiction with data-protection rights (such as the GDPR), email support@codepastes.com and we'll respond within 30 days.

Children

CodePastes is a developer tool and is not directed at children under 13. We do not knowingly collect personal information from children.

Changes to this policy

If we change how we handle data, we'll update this page and revise the "last updated" date above. Material changes will be flagged on the site. Continued use of CodePastes after a change means you accept the updated policy.

Contact

Questions about this policy? Email support@codepastes.com.