VOIDPASTE

Privacy

What data we process for accounts, pastes, and operations. This is a product privacy notice, not legal advice.

Who we are

VoidPaste is a paste-sharing service at voidpaste.com. Privacy and data questions: [email protected].

Data we process

  • Account data — email, optional display name, password hash, role, email verification state, session token hashes, API key hashes and metadata.
  • Paste metadata — title, language, visibility, size, timestamps, expiration, flags (burn-after-read, no-index, client-encrypted), view counters when enabled.
  • Paste content — plaintext or ciphertext stored in object storage. Client-encrypted pastes are ciphertext only from the server’s perspective.
  • Operational logs — request metadata, rate-limit counters, error codes, request ids. Paste bodies, passwords, session tokens, API secrets, and encryption keys must not be logged.

Cookies and sessions

Authenticated web use relies on an HttpOnly session cookie. We do not use that cookie for third-party advertising. Theme preference may use local storage via the theme provider.

Retention

  • Pastes expire according to the expiration you set.
  • Burn-after-reading and max-view pastes are deleted when those rules fire.
  • Soft-deleted pastes may remain briefly for operational cleanup.
  • Account deletion and full retention schedules depend on the running deployment’s policy.

Sharing

We do not sell paste content. Content is shared with recipients according to the visibility and password/encryption choices you make. Infrastructure providers (hosting, database, object storage, email) process data as subprocessors for running the service.

Your choices

  • Create pastes anonymously without an account.
  • Use unlisted, private, password, and/or client-side encryption.
  • Set no-index so we request that search engines not index the paste page.
  • Revoke API keys and sessions from the dashboard when signed in.

Right to erasure

Where applicable law (including GDPR Article 17) grants a right to erasure, you may request deletion of personal data associated with your account. Email [email protected] with the subject “Data deletion request” and the account email. We will respond within 30 days and delete or anonymize personal data unless a legal obligation requires retention. Paste content you created may already be expired, burned, or deleted by you; public share links you distributed cannot be un-shared by us from third-party copies.

See also Security and Terms.