Privacy Policy

1. Who is responsible

SecurePaste (securepaste.net and its browser extension) is operated by a private individual based in Norway, who is the data controller under the EU General Data Protection Regulation (GDPR) as it applies in Norway. Contact: privacy@securepaste.net.

2. What we store about a paste

When you create a paste, your browser compresses and encrypts its text, title and syntax choice with AES-256-GCM. The decryption key is part of the link after the #, which browsers never send to a server. We store:

• the encrypted paste (ciphertext), with its random IV and salts;
• a random paste ID, its size, when it was created and when it expires;
• whether it is burn-after-reading or password-protected, and, if you turned it on, how many times it was opened;
• a SHA-256 hash of the delete token, so that whoever holds the delete link can remove it.

We never receive the plaintext, the title, the key or the password, and we cannot decrypt a paste. We do not store IP addresses, user agents or cookies with a paste.

To know how the service is used we keep daily totals: how many pastes were created that day, from the website or the extension, how many used a password, burn after reading or the view counter, and their combined size. These totals are not linked to any paste or person.

3. Bot protection

When you create a paste, Cloudflare Turnstile checks that the request comes from a person and not an automated spam tool. Most visitors never see it. Turnstile runs in your browser and Cloudflare processes technical signals about it to decide; it never sees your paste. We send Cloudflare only the resulting token, not your IP address. Reading a paste loads nothing from third parties.

4. Hosting and technical data

The service runs on Cloudflare, which processes connection data such as your IP address, browser user agent and the requested URL in order to deliver and protect the site. We have turned off application logging, and we do not use any analytics, advertising or tracking.

5. Storage on your device

The site stores the following in your browser. None of it is used for tracking, and none of it is sent to us:

• securepaste.history (local storage): the links, keys and delete links of the pastes you created, shown under My pastes. You can turn this off per paste, or clear it at any time.
• securepaste.locale (local storage): your chosen language.
• sp-theme-choice (local storage): light or dark mode, if you picked one.

The browser extension keeps the same history in the extension's own storage. Text you share with its right-click menu is handed to the extension popup and kept only for that browser session. The extension only talks to securepaste.net and never reads the pages you visit unless you select text and choose “Share selection”.

6. Contacting us

If you use the contact form or email us, we receive your message, the email address you give and, if you give it, your name, as an email in our own inbox, so that we can reply. Messages to our addresses are forwarded by Cloudflare Email Routing. We keep them only as long as needed to handle your request.

7. Why we process data

We process the data above to provide the service you ask for and to keep it secure and available by preventing abuse. The legal basis is our legitimate interest in operating a functioning, secure service (GDPR Article 6(1)(f)). Storage on your device is strictly necessary for features you use or holds preferences you set.

8. How long we keep it

• Every paste has an expiry between 10 minutes and 1 year, chosen when it is created. Expired pastes are deleted automatically within about an hour.
• A burn-after-reading paste is deleted the moment it is opened.
• Anyone with the delete link can delete a paste at any time, with immediate effect.
• Daily totals are kept for as long as the service runs.

Deleted pastes cannot be recovered, by you or by us.

9. Who else processes data

• Cloudflare, Inc. hosts the website, database and file storage, provides Turnstile and delivers email to and from our addresses. Cloudflare acts as our processor and may process data outside the EEA under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.

Fonts and all other site assets are served from securepaste.net itself. We do not sell or share data with anyone else, except where we are legally required to. Because pastes are end-to-end encrypted, we have no readable content to hand over.

10. Your rights

You have the right to access, correct and erase your personal data, to restrict or object to its processing, and to data portability. As there are no accounts, we can usually not link any data to you. The quickest way to erase a paste is its delete link; every paste is erased automatically when it expires regardless.

To exercise your rights, write to privacy@securepaste.net. You may also complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or to the authority where you live.

11. Children

SecurePaste is not directed at children under 13, and we do not knowingly process their data.

12. Changes

If this policy changes, we update it here and change the date at the top.