Privacy Policy

The short version

Accounts on Thpaste are optional. We don't run third-party ad or tracking scripts, and never stores your IP address. Analytics are first-party, aggregate, and can be switched off. The longer version is below.

Who's responsible

Thpaste is the data controller for the information described here. Contact: support@thpaste.com.

What we collect

Pastes you create

We store the content you paste, along with the options you choose — language, expiry, whether it's listed publicly, and a hash of the password if you set one. That's what makes the paste work. A paste is deleted when its expiry passes, immediately after it's read if you chose burn-after-reading, or when you or we remove it.

Please don't paste personal or sensitive information about other people. Anyone with the link can open a paste unless you password protect it.

Your account (optional)

If you create an account we store your email address, a salted hash of your password (never the password itself), when you joined and last signed in, and which pastes and premium key belong to the account. Pastes you make while signed in are linked to your account so you can see and delete them from your dashboard. Deleting your account there removes the account and those pastes.

Usage analytics

We run our own analytics — no Google Analytics, no third-party trackers, no advertising pixels. For each pageview we record the time, the path, a randomly generated visitor ID stored in a first-party cookie, the referring site's hostname, your device type, browser, operating system, browser language, and a two-letter country code.

Your IP address is used only in memory to derive that country code and to apply rate limits. It is never written to our database.

Payments

If you buy premium, payment is handled by our payment provider acting as merchant of record. They collect the billing details needed to take payment and to calculate tax. We never see or store your card number. We receive only what we need to give you access and to answer billing questions — such as your email address and the status of your subscription.

Cookies

Our analytics use two first-party cookies and no third-party cookies: pl_vid, a random identifier that lets us count visitors without knowing who they are, and pl_no_track, which is set only if you opt out and whose presence disables analytics entirely. There are no advertising or cross-site cookies to consent to.

If you sign in, we also set pl_member, which keeps you signed in for up to 30 days, and pl_mh, which only tells the page to show “Account” instead of “Sign in”. Signing out removes both.

How to opt out

Setting the pl_no_track cookie stops analytics collection for your browser. Sending a Do Not Track signal, using a content blocker, or clearing cookies also works — analytics are fire-and-forget and blocking them never breaks the site.

How long we keep things

Pastes are kept until they expire or are deleted. Accounts are kept until you delete them. Raw analytics events are pruned after 400 days. Payment and tax records are kept by our payment provider for as long as the law requires them to be.

Who we share with

We don't sell your data and we don't share it for advertising. Data is handled by the infrastructure providers needed to run the service — our hosting provider and our payment provider — and may be disclosed if we're legally required to, or where it's necessary to investigate abuse of the service.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to how we use it. Because we deliberately hold very little, most requests resolve quickly. Email support@thpaste.com and we'll respond within 30 days.

To have a specific paste removed, send us its link. If it's password protected, tell us the link — we don't need the password to delete it.

Where data is processed

Thpaste is operated from Nigeria and hosted on servers in Europe. If you access the service from elsewhere, your data is processed in those locations.

Children

Thpaste isn't directed at children under 13, and we don't knowingly collect their personal data.

Changes

If this policy changes, the date at the top changes with it. Material changes will be announced on the site.