Privacy Policy

Last updated: 10 November 2026. This policy explains what PastePad stores, what stays on your device, and that this site runs without ads or third-party trackers.

Content encryption in the browser

When you set a password, PastePad derives an encryption key with PBKDF2-SHA256 and encrypts your content with AES-GCM inside your browser before any network request. Your password is not uploaded. Without a password, content is still encoded into a paste payload; treat unpassworded links as readable by anyone who receives them.

What the server stores

In short-link mode the server stores only the opaque or encrypted payload string, an id, and an expiry timestamp. We do not operate user accounts for the public tools. Fragment-mode links keep the payload in the URL hash, which browsers do not send to the server.

Expiry and deletion

Each paste includes a time-to-live. After expiry, short-link lookups fail and stored rows are eligible for deletion. You should assume recipients may copy content before expiry.

Logs and security

Infrastructure providers (such as Cloudflare) may process standard request metadata like IP addresses for security and reliability. PastePad application logs are not used to reassemble paste contents.

No ads or tracking

This site has no ads and no third-party tracking scripts. We do not use cookies for ad delivery. A strict Content Security Policy keeps third-party scripts blocked.

Children

PastePad is not directed at children under 13. Do not submit personal information from children.

Contact

Questions about privacy: see the About page for contact guidance. About.