Privacy Policy
Last updated 18 September 2026
jpaste has no server, no account and no analytics. Everything you put into it stays on your devices. This page explains exactly what that means, including the parts where it is not the whole story.
The short version
- The app collects nothing about you and sends nothing anywhere of its own accord.
- Your snippets, boards and settings are stored on your device.
- There is no sign-up, no login and no user account.
- There is no advertising, no tracking and no third-party SDK inside the app.
- This website uses one privacy-preserving visitor counter — see This website below. The app does not.
What the app stores, and where
jpaste keeps three kinds of thing, all of them locally, in the app's own storage on your Mac, iPhone or iPad:
- Your snippets — the text you save, and any label you give it.
- Your boards — their names, colours, layout and privacy setting.
- Your settings — appearance, language, whether the window floats, and whether you have purchased the unlimited unlock.
None of this is transmitted to us, because there is no "us" to transmit it to: jpaste has no backend. The app makes no network requests of its own. That is an architectural commitment, not a current-version promise.
iCloud
If a version of jpaste offers iCloud sync, your boards travel only through your own private iCloud database, using Apple's CloudKit. The developer has no access to it and cannot read it. Sync can be turned off inside the app, and snippet text and labels are additionally encrypted with keys only your Apple Account holds.
Apple's handling of that data is covered by Apple's Privacy Policy.
Purchases
The one-time unlock is sold through Apple's In-App Purchase. Payment is handled entirely by Apple; jpaste never sees your payment details, your name or your billing address. The app asks Apple whether this Apple Account owns the unlock, and stores only the yes-or-no answer on the device.
Face ID, Touch ID and the device passcode
Boards marked Protected are unlocked by biometric authentication. That check is performed by the operating system through Apple's LocalAuthentication framework. jpaste receives only a yes or no. The app never receives, sees or stores your fingerprint or face data, and no biometric information ever leaves the Secure Enclave.
Vault boards, and why there is no recovery
Boards marked Vault are encrypted on the device with AES-256-GCM. The key is derived from the passphrase you choose, using PBKDF2-HMAC-SHA256 with a large iteration count and a random salt unique to each board.
jpaste never writes your passphrase anywhere — not to the device, not to the Keychain, not to iCloud. It exists only for as long as it takes to derive the key. That is what makes the encryption meaningful, and it is also why a forgotten Vault passphrase cannot be recovered or reset, by you or by us. The contents of that board are unreadable without it.
If your own password manager offers to save it, that is your choice and happens outside the app — jpaste neither asks for it nor can prevent it. Either way, choose a passphrase you will still have in a year.
What jpaste cannot promise
Two honest limits, stated here rather than buried:
- On iPhone and iPad, screenshots of a private board cannot be prevented. No app can block them. jpaste detects screen recording and mirroring and locks private boards when it sees them, and it tells you after a screenshot that it could not stop it — but that is detection, not prevention. On macOS, where the system does allow it, an unlocked private board is excluded from screen capture entirely.
- Anything you copy goes to the system clipboard, which other apps can read. Snippets you mark concealed are flagged so that the system and well-behaved clipboard managers leave them out of history, and they expire — but the clipboard is shared ground, and jpaste does not control what else is installed on your device.
This website
jpaste.com is a small static site hosted on Vercel. It uses Vercel Web Analytics, which counts page views and referrers without cookies and without building a profile of you or following you across other sites. Vercel's hosting also records standard server logs, including IP addresses, for security and operations.
This applies to the website only. The app contains no analytics of any kind.
The site loads its typefaces from Google Fonts, which means your browser contacts Google when you open the page.
Children
jpaste is not directed at children and collects no personal information from anyone, including children.
Your rights
Regulations such as the GDPR and the CCPA give you rights to access, correct, export and delete the personal data a company holds about you. jpaste holds none, so there is nothing for us to hand over or erase. Your own data is on your device, under your control: delete the app, and it goes with it.
Changes to this policy
If this policy changes, the date at the top of the page changes with it, and anything material will be described in the app's release notes rather than introduced quietly.
Contact
Questions about privacy, or anything else: support@jpaste.com.