Privacy
What data we process for accounts, pastes, and operations. This is a product privacy notice, not legal advice.
Who we are
VoidPaste is a paste-sharing service at voidpaste.com. Privacy and data questions: [email protected].
Data we process
- Account data — email, optional display name, password hash, role, email verification state, session token hashes, API key hashes and metadata. Verification state is used server-side to keep unverified accounts read-only; it is not exposed by public account-recovery endpoints.
- Paste metadata — title, language, visibility, size, timestamps, expiration, flags (burn-after-read, no-index, client-encrypted), view counters when enabled.
- Paste content — plaintext or ciphertext stored in object storage. Client-encrypted pastes are ciphertext only from the server’s perspective.
- Operational logs — request metadata, rate-limit counters, error codes, normalized route templates, latency, and random request ids. Application request logs do not include client IP addresses.
- Product and reliability telemetry — daily aggregate counts for create/read outcomes, official client channel, account/API/anonymous class, coarse size/expiration/visibility buckets, lifecycle flags, scanner choices, anonymous deletion, mail template and coarse delivery state, normalized API routes, latency buckets, and worker/object-cleanup outcomes. Aggregate rows are retained for 90 days.
Data excluded from telemetry
Telemetry never includes paste content, title, filename, language text, paste or user identifiers, object keys, IP addresses, email addresses, passwords, session or API tokens, encryption keys, request URLs, query strings, fragments, clipboard data, or shell commands. Scanner telemetry is three counters only: warning shown, redacted, and publish anyway. We use no third-party analytics scripts or analytics cookies.
Cookies and sessions
Authenticated web use relies on an HttpOnly session cookie. We do not use that cookie for third-party advertising. Theme preference may use local storage via the theme provider.
Retention
These are the production defaults enforced by cleanup jobs and storage configuration. “Delete” below means removal from live systems; encrypted historical backups follow the separate backup schedule.
| Data | Window or trigger | What happens |
|---|---|---|
| Account/profile/auth links | Until self-service erasure | Hard-deleted; operator accounts must transfer duties first. |
| Sessions | 30-day session default; revoked/expired rows up to 30 more days | Revoked immediately on erasure, then deleted. |
| API keys and email tokens | Until revocation/expiry; verify 24h, reset 1h | All revoked/deleted immediately on erasure; expired/used tokens are cleaned automatically. |
| Paste metadata/content/versions | Chosen expiry, burn/max views, deletion, or account erasure | Unavailable immediately and objects enter durable GC. Ordinary soft-deleted metadata: 30 days; account erasure: hard-delete. |
| Paste access records | 30 days | Deleted. |
| Collections/favorites | Life of account or referenced paste | Deleted with the account/paste. |
| Resolved reports and moderation evidence | 365 days | Direct account/paste links are removed on erasure; bounded abuse evidence then expires. |
| Audit/moderation actions | 365 days | Account links and associated metadata/notes are cleared on erasure, then records expire. |
| Mail delivery state | 60 days | Redis expiry; only keyed digests, template, coarse state, and timestamps are kept. |
| Redis body/idempotency/auth controls | Body cache 120s; WebAuthn about 5m; rate limits about 1h; create replay 24h | TTL expiry. Body cache is invalidated during erasure; account replay records are indexed and deleted when erasure is requested. Replay data can contain the create response, but never the anonymous management token. |
| Daily telemetry / minute metrics | 90 days / 7 days | Aggregate rows are deleted; there is no raw product-event table. |
| Usage / capacity aggregates | 90 days / 400 days | Deleted; account linkage is cleared on erasure. |
| Object-GC / reconciliation / quota findings | Completed GC 30 days; resolved findings/runs 90 days | Deleted after operational verification; pending deletion retries until successful. |
| Caddy / application logs | Caddy: 30 days, active 50MiB plus up to five rotated files; app: 3×10MiB per service | Rotated; app routes are normalized, while edge logs omit raw URI/path, headers, and client/remote IP. |
| Backup/capacity system-service logs | 30 days and 200MiB shared namespace cap | Rotated by an isolated VoidPaste journald namespace; stage/count/result fields only. |
| Encrypted backups | Local 14 days; R2 GFS 14 daily, 8 weekly, 12 monthly | Expire by schedule. Erased data can remain encrypted for about 12 months. |
| Erasure status / tombstone | Status 30 days; pseudonymous tombstone 13 months | Status expires; tombstone suppresses resurrection after an older restore and has no email/content. |
Sharing
We do not sell paste content. Content is shared with recipients according to the visibility and password/encryption choices you make. Infrastructure providers (hosting, database, object storage, email) process data as subprocessors for running the service.
Your choices
- Create pastes anonymously without an account.
- Use unlisted, private, password, and/or client-side encryption.
- Set no-index so we request that search engines not index the paste page.
- Revoke API keys and sessions from the dashboard when signed in.
Right to erasure
Signed-in users can choose Delete account and data on the dashboard Security page. A recently created session, CSRF protection, rate limiting, and an exact confirmation phrase are required. We immediately revoke sessions, API keys, and recovery tokens, then queue deletion of the profile, collections, favorites, every owned paste, and every version. Public pastes are deleted by default, not silently orphaned.
Minimal abuse/security evidence may be retained for up to 365 days with direct account linkage removed. Deletion does not rewrite immutable encrypted backups: those expire under the schedule above. A separate pseudonymous erasure ledger is replayed after restore so erased accounts are not reactivated. It contains no email, user ID, paste ID, or content. Copies already received or indexed by third parties are outside our control.
If self-service deletion is unavailable, email [email protected]. Applicable rights and exceptions depend on jurisdiction; this notice is not a blanket compliance claim.