This policy explains what data PastedNow collects, how we use it, who we share it with, and how to exercise your rights over it.
1. What we collect
Account data: Email, username, display name, password hash (bcrypt), avatar URL, and the OAuth provider used to sign in (if applicable). Telegram users contribute their Telegram ID, first/last name, and photo URL.
Paste data: Content, title, language, expiration, visibility, and (for encrypted pastes) the encrypted ciphertext + salt + IV. Plaintext encrypted content never reaches our servers.
Usage data: Unique view records (hashed IP + user agent, never raw IP), paste likes, view counts, and rank-tier progression. We use this to power /recent, /top, the leaderboard, and creator rewards.
Payment data: For banner ad purchases, we receive transaction IDs, payment status, and (optionally) a referral code from Cryptomus. We do not store full card details, private keys, or wallet seed phrases — Cryptomus handles all payment authorization.
Cookies: A NextAuth session cookie (JWT, HTTP-only) for signed-in users. A Cloudflare Turnstile cookie set by the bot challenge widget. No third-party advertising or analytics cookies.
2. How we use it
- Provide the core paste-sharing service and account management.
- Compute view counts, rank tiers, badges, and event leaderboards.
- Detect bots and prevent abuse (hashed IPs are used to dedupe views and rate-limit registration).
- Process banner ad payments and pay out event rewards to addresses you provide.
- Respond to support requests sent to support@pastednow.com.
- Comply with legal obligations and respond to lawful requests.
3. Who we share with
We do not sell your data. We share only with:
- Service providers that operate our infrastructure: Supabase (database), Upstash (Redis), Cloudflare (Turnstile, edge), Vercel (hosting). Each is contractually bound to handle data on our behalf.
- Cryptomus for payment processing. They see the transaction amount, order ID, and your wallet address.
- Telegram if you use Telegram login. They see standard OAuth data.
- Law enforcement when legally compelled by a valid request.
4. Retention
Account data is retained until you delete your account. Pastes are retained until their expiration window or until you delete them. Transaction records and audit logs are retained for 6 years for accounting and tax compliance, even after account deletion.
Hashed view-tracking entries roll off after 24 hours from Redis (used only for deduplication) but the aggregate `viewCount` on each paste persists for the lifetime of the paste.
5. Your rights
You can:
- Access a copy of your data — email us.
- Correctaccount info through your dashboard, or email us for fields you can't edit yourself.
- Delete your account and personal pastes — email us from the address on file. We process within 30 days.
- Object or restrict certain processing — email us with your specific request.
- Withdraw consent for optional features (badges, leaderboard, events) by emailing us.
We respond to verified requests within 30 days. We may ask you to confirm identity before processing.
6. Security
Passwords are hashed with bcrypt (cost 12). Encrypted pastes use client-side AES-GCM — we never see your decryption password. Sessions are HTTP-only cookies signed with a server secret. Transport is HTTPS only.
No system is perfectly secure. If we discover a breach affecting your data, we'll notify you within 72 hours of discovery via the email on file.
7. Children
PastedNowis not directed at children under 13. If we learn we've collected data from a child under 13 without parental consent, we'll delete it.
8. International
Our infrastructure runs on services that may transfer data internationally. By using PastedNow you consent to this transfer and the application of the laws of the jurisdiction where each provider operates.
9. Changes
We may update this policy. Material changes will be announced on the homepage or by email. The "Last updated" date at the top will always reflect the current version.
10. Contact
Privacy questions, data requests, or complaints? Reach us at support@pastednow.com. You can also see the full list of channels on the Contact page.