Pastehere is designed to be privacy-first. To run the service we store: your room code, your end-to-end-encrypted messages and files (ciphertext only — we can't read them), basic routing metadata (timestamps, which device sent an item, and sizes), each device's public key and an access token so we can authorize it, and your IP address briefly to rate-limit abuse.
We use data solely to run pastehere: room codes connect your devices, and your encrypted messages and files are stored so every device in the room can load them. We do not analyze, profile, sell, or advertise against your data.
Your content is encrypted in your browser before it leaves your device, using AES-256-GCM. Our servers, our database (Supabase), our file storage (Cloudflare R2), and our hosting provider (Cherry Servers) only ever see ciphertext — they cannot decrypt your content, even if compelled to. The remaining trust assumption — true of every web-based end-to-end-encrypted app — is the JavaScript we ship to your browser. A native desktop app and/or browser extension would remove that assumption and is a planned addition.
No advertisers and no data brokers. Three infrastructure providers help run the service: Supabase (Postgres database) holds your encrypted messages along with room and device metadata; Cloudflare R2 stores your encrypted files; and Cherry Servers hosts the app, which keeps requester IP addresses in memory for a few minutes for rate-limiting. The messages and files Supabase and Cloudflare hold are end-to-end encrypted, so they can't read them either.
Your encrypted messages and files stay until you remove them — delete an item, clear the room, or destroy the room, which permanently deletes everything in it. There's no timed auto-expiry, though you can enable auto-cleanup to drop the oldest items once a room reaches 80% of its storage. IP records used for rate-limiting are held in memory only and discarded within a few minutes.
Pastehere doesn't use cookies at all. Your encryption keys and device identity live in your browser's local storage (IndexedDB) and never leave your device.
We count visits to our public pages (the homepage, guides, and pages like this one) with Umami, an open-source tool we host on our own server. It sets no cookies and no data goes to a third party. For each visit it records the page path, the referring site, your browser, operating system, device type, language, and country. Your IP address is used to work out the country and to tell visits apart through a hash that changes every month; the IP address itself is not stored. Nothing is recorded from inside a room, and room addresses and pairing codes are never sent. If your browser sends a Do Not Track signal, we don't count your visit.
Questions about privacy? Contact us at hello@pastehere.app
Last updated: October 2026