Skip to content
Pastepile

Privacy Policy

Pastepile is designed around a simple rule: store as little as possible. There are no user accounts and no third-party trackers or analytics on paste pages.

What we store

  • Paste content: kept until the paste expires or is deleted. An hourly job removes expired pastes. Burn-after-read pastes are deleted on first view.
  • Secrets (hashed only): edit keys, paste passwords, and API keys are stored only as SHA-256 hashes. The raw values are shown to you once and never persisted, so we cannot recover them.
  • Abuse reports submitted via the in-page report button.
  • Short-lived rate-limit counters derived from your IP address, used to prevent abuse. These are pruned daily.

What we do not collect

  • No user accounts. There is nothing to sign up for.
  • No third-party analytics, advertising pixels, or tracking scripts on paste pages.
  • No ability to read end-to-end encrypted pastes. The decryption key lives in the URL fragment (after #), which browsers never send to servers. We store only ciphertext.
  • No ability to unlock time-capsule pastes early. Those use a public drand timelock beacon; not even we can decrypt them before the chosen time.

Retention

Pastes live until their expiry, until you delete them with your edit key, or until they are viewed once (for burn-after-read). An hourly background job permanently deletes any paste past its expiry. Rate-limit counters are pruned daily.

Cookies

Normal visitors get essentially no cookies, and there is no tracking cookie. A single session cookie may be set for site administrators to access moderation tools.

Processors

Pastepile is served from Cloudflare (edge / CDN) and stores data in Supabase (managed PostgreSQL). These providers process requests and data on our behalf and may log standard request metadata as part of providing their services.

Requesting removal

If you created a paste, the simplest way to remove it is to delete it with the edit key you were shown when you created it. For pastes you cannot delete yourself, or content you believe violates our terms, use the in-page report button or email abuse@pastepile.com. Copyright claims go to /dmca.

Contact

Privacy questions: hello@pastepile.com. Security issues: see /security.

Operator: Pastepile, United States.