Policy

Privacy

Effective July 30, 2026

Local by default: formatting, preview, rich copy, Word export, standalone HTML export, and no-upload links run in your browser. Paste → Docs receives artifact content only when you explicitly choose “Publish short link.”

Local drafts and exports

Text pasted into the editor or loaded from a Markdown file is processed in your browser. We do not receive or store that text when you use local preview, downloads, rich copy, or a no-upload URL. A no-upload URL contains compressed content in its fragment; anyone who receives the complete URL can read that content.

Hosted artifacts

When you explicitly publish an artifact, we store its Markdown content, title, optional subtitle, public identifier, creation and update times, expiration state, and any link controls you choose. An unprotected hosted artifact can be read by anyone with its URL. A password-protected artifact requires the recipient password before the server returns its Markdown. We store a salted one-way password hash, not the recipient password. Password protection reduces accidental access but cannot prevent an authorized recipient from copying or redistributing content.

Management links

A private management token lets its holder update or delete an artifact. We store only a cryptographic hash of that token on the server. Your browser may retain the token locally so you can manage the artifact again. Treat the complete management link as a secret.

Publisher accounts and billing

Optional publisher accounts use one-time email links rather than passwords. We store the normalized email address, account creation and update times, a hash of each active session token, owned artifact identifiers, and subscription entitlement state. One-time sign-in tokens expire after 15 minutes and can be used once; browser sessions expire after 30 days and can be revoked by signing out.

When paid plans are enabled, Stripe processes checkout, payment details, invoices, and cancellation. Paste → Docs stores Stripe customer, subscription, price, status, and paid-through identifiers needed to grant or revoke Pro. We do not receive or store full card numbers.

Retention and deletion

Anonymous publishers choose 1, 7, or 30 days. Signed-in free links remain active for up to 7 days. Pro links can remain active while the subscription is entitled. When a persistent Pro link loses entitlement, it receives a 30-day export and deletion grace period before storage expiration. A valid management link or signed-in owner can delete an artifact earlier. Backups and operational logs may take a limited additional period to age out.

Operational data

We count total and unique artifact views, record the last-view time, and use one-way fingerprints derived from network and browser information to distinguish unique visits, enforce rate limits, and prevent abuse. We do not expose raw network addresses in the publisher dashboard. Abuse reports include the artifact identifier, reason, time, and a one-way reporter fingerprint. We do not use this information for advertising.

We also collect privacy-safe, aggregate product events such as preview opened, link published, export completed, or design-partner interest. These events do not contain your draft, artifact title, artifact identifier, management token, email address, URL query, or URL fragment. Vercel Web Analytics does not use third-party cookies; Paste → Docs uses only aggregate events to understand whether the sharing workflow is useful.

Service providers

Vercel provides hosting, serverless execution, and aggregate Web Analytics. Upstash provides hosted Redis storage. When publisher accounts are enabled, Resend delivers one-time sign-in emails. When paid plans are enabled, Stripe provides checkout, subscription billing, invoices, and the customer portal. Their processing is governed by their respective privacy and security terms.

Your responsibilities

Do not publish confidential, regulated, or personal information unless you have authority to share it through an unlisted public link. Remove sensitive prompt history and secrets before publishing.

Contact

Publishers can delete individual artifacts from their management view or account. For account deletion, privacy questions, or deletion help, email sudprakum@gmail.com.