Privacy Policy

Last Updated: October 10, 2026

This Privacy Policy explains how Pastebox ("Pastebox," "we," "us," or "our"), available at pastebox.io, collects, uses, shares, and protects information when you use our website, tools, and related services (collectively, the "Service"). This Policy is incorporated into and forms part of our Terms of Service. By accessing or using the Service, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Service.

For the purposes of applicable data protection laws, the data controller is the operator of Pastebox, who can be reached through our contact form at https://pastebox.io/contact.

1. Information We Collect

a. Information You Provide

Content of pastes you create, including titles, syntax/formatting selections, and expiration settings
Optional passwords used to protect pastes, which are used solely to control access to the relevant paste
Information you submit through our contact form, such as your name, email address, and message
Account information (such as username, email address, and password) if account features are offered and you choose to register

The content of your pastes may be transmitted to third-party providers for review and processing. See Section 4 for details.

b. Automatically Collected Information

IP address and approximate location derived from it (such as country or region)
Browser type and version
Operating system and device type
Access timestamps and pages viewed
Referring pages and URLs
Usage logs, error logs, and security and abuse-detection data
How you interact with our pages, such as clicks, taps, scrolling, and mouse movement, recorded by Microsoft Clarity (see Section 6)

This data is collected for security, abuse prevention, fraud detection, service performance, and analytics purposes.

c. Cookies and Similar Technologies

See Section 5 below.

We do not knowingly collect special categories of personal data (such as health, religious, or biometric information), and we ask that you do not submit such data through the Service, whether about yourself or others.

2. How We Use Information

We use collected information to:

Operate, maintain, and provide the Service
Detect, investigate, and prevent abuse, spam, fraud, security incidents, and illegal activities, including through automated scanning and filtering of content and through review by third-party providers (see Section 4)
Enforce our Terms of Service, including content removal and user, account, or IP bans
Respond to inquiries, reports, and requests submitted through our contact form
Monitor, analyze, and improve the performance, reliability, and usage of the Service, including through usage metrics, heatmaps, and session replays (see Section 6)
Display advertising, including, where permitted, personalized advertising served by third-party networks (see Section 7)
Comply with legal obligations and respond to lawful requests from authorities
Create aggregated or de-identified statistics that do not identify any individual

3. Legal Bases for Processing

Where data protection laws such as the EU/UK GDPR apply, we process personal data on the following legal bases:

Performance of a contract: to provide the Service in accordance with our Terms of Service
Legitimate interests: to secure the Service, prevent abuse and fraud, review paste content through third-party providers, analyze and improve the Service (including cookieless measurement with Microsoft Clarity), and display non-personalized advertising
Consent: where required, for example for non-essential cookies (including Microsoft Clarity's analytics cookies) and personalized advertising; you may withdraw consent at any time (see Section 5)
Legal obligation: to comply with applicable laws, regulations, and lawful requests

4. Paste Content and Visibility

Public pastes are accessible to anyone and may be indexed by search engines.
Unlisted pastes are accessible to anyone with the direct URL and may still be shared or discovered.
Password-protected pastes require the correct password to access.

While we implement security measures, no online platform can guarantee absolute privacy. Treat every paste as potentially accessible. Do not include personal data (your own or anyone else's), passwords, credentials, API keys, financial information, or other sensitive data in pastes.

Once a paste has been viewed, copied, cached, archived, or indexed by third parties (including search engines), we have no control over those copies. Deleting a paste from the Service does not remove copies that may already exist elsewhere.

Third-Party Review of Paste Content

Paste content may be sent to third-party providers for review and processing, for example, for security scanning, abuse and spam detection, content moderation, formatting, or similar purposes. This may apply to any paste, including private, unlisted, and password-protected or encrypted pastes. When this occurs, the content leaves our systems and is processed by the relevant provider in accordance with its own terms and privacy policy, over which we have no control.

This processing is part of how the Service operates and is not something you can opt out of while using the Service. Because of this, you should not submit any content you are not willing to have transmitted to and processed by third-party providers. If you are posting pastes on behalf of others or within an organization, it is your responsibility to ensure that this is acceptable for your users and complies with any applicable confidentiality, contractual, or legal obligations.

5. Cookies and Similar Technologies

We may use cookies and similar technologies in the following categories:

Strictly necessary cookies: required for core functionality and security of the Service
Preference cookies: remember your settings, such as dark mode or language
Analytics cookies: help us understand how the Service is used, including the Microsoft Clarity first-party cookies _clck and _clsk and the Microsoft third-party cookies CLID, MUID, MR, SM, and ANONCHK (see Section 6)
Advertising cookies: used by third-party networks to serve and measure ads (see Section 7)

When you first visit, our cookie banner lets you choose "Accept all" or "Essential only". If you choose "Essential only", Microsoft Clarity does not set cookies and runs in a limited mode in which each page view is recorded on its own and is not linked to your other visits. Your choice is stored for one year in a cookie named pastebox_cookie_consent. To change it, delete that cookie in your browser settings and reload the page; the banner will appear again.

You can control or delete cookies through your browser settings; disabling certain cookies may affect the functionality of the Service. Where required by law, we will request your consent before placing non-essential cookies. The Service does not currently respond to "Do Not Track" browser signals.

6. Analytics

We may use third-party analytics providers, such as Google Analytics, to collect and analyze usage information (such as pages visited, session duration, approximate location, and device and browser data). These providers may use cookies and similar technologies and process data in accordance with their own privacy policies. You can opt out of Google Analytics using the browser add-on available at https://tools.google.com/dlpage/gaoptout.

None of our analytics tools, including Google Analytics and Microsoft Clarity, run on encrypted pastes or on the page used to unlock a password-protected paste, because the addresses of those pages can contain a decryption key.

Microsoft Clarity

We use Microsoft Clarity, provided by Microsoft Corporation (and, for users in the European Union, Microsoft Ireland Operations Limited), together with Microsoft Advertising, to understand how visitors use and interact with the Service. Clarity captures behavioral data such as clicks, taps, scrolling, mouse movement, the pages you view, and how those pages are laid out on your screen. It turns this data into usage metrics, heatmaps, and session replays (reconstructions of a visit) that help us find problems and improve the Service. This data is collected with first-party and third-party cookies and similar technologies. Microsoft also uses it for site optimization, fraud and security purposes, and advertising. For more information about how Microsoft collects and uses your data, see the Microsoft Privacy Statement at https://www.microsoft.com/privacy/privacystatement.

We limit what Clarity can see:

The content of pastes and the text you compare in the diff tool are masked, so they are never sent to Clarity. Text you type into form fields, such as the paste editor, passwords, and email addresses, is masked as well.
Clarity does not run on pastes embedded in other websites or in our administration area.
If you choose "Essential only" in our cookie banner, Clarity does not set cookies (see Section 5).

7. Advertising

We may display advertisements served by third-party advertising networks, such as Google AdSense. These third-party vendors may use cookies, web beacons, and similar technologies to collect information about your visits to this and other websites in order to serve ads, measure ad performance, and, where permitted, provide advertising based on your interests and prior visits. Google's use of advertising cookies enables it and its partners to serve ads to users based on their visits to this Service and/or other sites on the Internet.

You may opt out of personalized advertising by visiting:

Google Ads Settings: https://adssettings.google.com
Digital Advertising Alliance opt-out: https://www.aboutads.info/choices
For EU users: https://www.youronlinechoices.eu

Where required by law, personalized advertising will only be shown with your consent.

8. How We Share Information

We do not sell personal information for monetary consideration. We may share information in the following circumstances:

Service providers: hosting providers, CDN services, security and anti-abuse tools, analytics providers (such as Google and Microsoft), advertising networks, and contact form or email processing services, only to the extent necessary to operate the Service
Third-party review providers: paste content may be sent to third-party providers for review and processing, as described in Section 4
Legal compliance: to comply with legal obligations, court orders, legal process, or lawful requests from law enforcement or other authorities
Protection of rights and safety: to enforce our Terms of Service, investigate fraud or abuse, or protect the rights, property, or safety of Pastebox, our users, or the public
Business transfers: in connection with a merger, acquisition, sale, or transfer of the Service, in which case information may be transferred as part of that transaction
Aggregated or de-identified data that cannot reasonably be used to identify you

Note that the use of third-party advertising and analytics cookies may be considered "sharing" or a "sale" of personal information under certain laws, such as some US state privacy laws. You can opt out as described in Section 7, through your browser and cookie controls (including choosing "Essential only" in our cookie banner), or by contacting us through our contact form.

9. International Data Transfers

The Service is operated and accessible globally, and your information may be stored and processed on servers located in countries other than your own, which may have data protection laws that differ from those of your jurisdiction. Where required by applicable law, we take reasonable steps to ensure appropriate safeguards for such transfers. By using the Service, you acknowledge that your information may be transferred and processed as described in this Policy. For example, Microsoft Clarity data is stored in Microsoft's Azure cloud and may be processed in the United States; for users in the European Union, Microsoft transfers it under the European Commission's Standard Contractual Clauses.

10. Data Retention

Pastes are stored until their expiration time or deletion. Expired or deleted pastes may persist temporarily in backups or caches before being permanently purged.
Logs and security data may be retained for as long as reasonably necessary for security, abuse prevention, and legal compliance purposes.
Contact form submissions may be retained for as long as needed to respond to you and to keep records of reports, complaints, and legal notices.
Content sent to third-party review providers is retained and processed by those providers under their own retention practices and privacy policies, which we do not control.
Microsoft Clarity session replays are kept by Microsoft for up to 30 days from the time of recording, except for a small number of saved or randomly sampled replays, which may be kept for up to 9 months.

We are not responsible for restoring deleted or expired content. We may retain information for longer periods where required by law or where necessary to establish, exercise, or defend legal claims.

11. Data Security

We implement reasonable technical and organizational measures designed to protect stored information. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. Any information you submit to the Service is provided at your own risk. If you believe your information has been compromised, please notify us through our contact form.

12. Your Rights and Choices

Depending on your jurisdiction (for example, under the EU/UK GDPR or certain US state privacy laws), you may have rights to request:

Access to the personal data we hold about you
Correction of inaccurate or incomplete data
Deletion of your personal data
Restriction of, or objection to, certain processing
Portability of your data in a structured, machine-readable format
Withdrawal of consent, where processing is based on consent (for cookies, see Section 5)
Opting out of targeted advertising (see Section 7)

You may also have the right to lodge a complaint with your local data protection authority or regulator.

To exercise these rights, contact us through our contact form at https://pastebox.io/contact. We may need additional information to verify your identity, and because the Service can be used without registration, we may be unable to link specific pastes or log entries to you without sufficient proof. We may decline requests that we cannot verify or where a legal exception applies (for example, where retention is required for security, abuse prevention, or legal compliance). Please note that we cannot delete copies of public pastes that third parties have already made, cached, or archived, nor content that has already been transmitted to and processed by a third-party review provider.

13. Children's Privacy

The Service is not intended for children under 13 (or a higher minimum age where required by your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided personal information through the Service, please contact us through our contact form and we will take reasonable steps to delete it.

14. Third-Party Links and Services

We may use third-party providers such as hosting services, CDN providers, advertising networks, analytics services, and content-review providers; these providers may process limited data necessary to operate the Service, and do so under their own privacy policies. In addition, pastes and other parts of the Service may contain links to third-party websites or services that we do not operate. We are not responsible for the content or privacy practices of any third party, and their own privacy policies govern any information you provide to them. We encourage you to review those policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Material changes may be announced on the Service, but we are not obligated to provide individual notice. Continued use of the Service after changes constitutes acceptance of the updated Policy. It is your responsibility to review this Policy periodically.

16. Contact

The sole official channel for privacy questions, rights requests, and complaints is our contact form at https://pastebox.io/contact. Communications sent through any other channel may not be received or reviewed.