1. Introduction

PasteRelay ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website. We are built on the principle of minimal data retention—we want to hold as little of your data as possible, for as short a time as possible.

2. Information We Collect

Encrypted Content

When you create a room or secret link, the text and files you upload are stored on our servers. Ordinary rooms and uploaded files do not provide the same end-to-end encryption guarantees as Quick Secrets. For "Quick Secrets", encryption happens entirely in your browser before the data reaches us. Quick Secret decryption keys remain in your browser. Private Handoffs encrypt text in your browser using AES-256-GCM; their decryption keys stay in the URL fragment and are never sent to the handoff service. The service stores ciphertext, expiration, deletion preference, and hashes of access capabilities. Access capabilities are sent securely to authorize retrieval or deletion, separately from the encryption key. Private Handoff pages do not load Google Analytics, and handoff links are not added to Recent Rooms. Ordinary room passwords are sent securely to authorize protected-room updates and file access; they are not stored in plaintext by that authorization service.

Usage Data

For connection feedback, shared rooms temporarily store random browser-session identifiers and last-active timestamps. They are not device fingerprints. Presence stops updating when a tab is hidden and stale entries are removed during subsequent room activity or room deletion. We collect aggregate counts of rooms, secrets, clips, accounts, uploads, file sizes, deletions, and operational failures to monitor system health. Storage inventories inspect file metadata, not file contents. The administrative overview does not expose shared content or filenames. Account and room-owner metadata is available separately for administration. Duplicate-event prevention uses server-only fingerprints without shared content. We may log standard technical information such as your IP address and browser type for security purposes (e.g., rate limiting and abuse prevention).

3. Data Retention

Rooms follow the expiration chosen when created. Rooms set to Never remain until deleted. Expired room records are scheduled for deletion every 15 minutes. Deleting or expiring a room queues its uploaded files for removal, and failed removals are retried. Orphaned files are identified during hourly inventories and queued for cleanup. Removal can be delayed by service failures. File links issued by the updated service expire within two minutes and no later than the room’s current expiration time. Aggregate statistics and duplicate-event fingerprints can remain after shared content is deleted. Recipients may retain their own copies.

4. Cookies and Local Storage

Private Handoffs block new retrievals at expiration. Expired server records are scheduled for cleanup every 15 minutes; cleanup may be delayed by service failures. Optional deletion after copying requires a successful browser Copy action and confirmed server deletion. This cannot confirm a subsequent paste or erase copies already received. Keep complete receiver links private and never share the management link.

We use local storage on your device to store a history of your "Recent Rooms" for your convenience. This data stays on your device and is not sent to our servers. Google Analytics, when configured on public pages, may use cookies to measure visits. We also store recent Quick Secret history locally in your browser.

5. Third-Party Services

We use Google Firebase for hosting, database, and storage services. By using PasteRelay, you acknowledge that room content, uploaded files, and encrypted Quick Secret text are stored on Google Cloud infrastructure.

6. Contact Us

If you have any questions about this Privacy Policy, please contact us at [email protected].