Privacy Policy

Last updated 18 September 2026

jpaste has no server, no account and no analytics. Everything you put into it stays on your devices. This page explains exactly what that means, including the parts where it is not the whole story.

The short version

What the app stores, and where

jpaste keeps three kinds of thing, all of them locally, in the app's own storage on your Mac, iPhone or iPad:

None of this is transmitted to us, because there is no "us" to transmit it to: jpaste has no backend. The app makes no network requests of its own. That is an architectural commitment, not a current-version promise.

iCloud

If a version of jpaste offers iCloud sync, your boards travel only through your own private iCloud database, using Apple's CloudKit. The developer has no access to it and cannot read it. Sync can be turned off inside the app, and snippet text and labels are additionally encrypted with keys only your Apple Account holds.

Apple's handling of that data is covered by Apple's Privacy Policy.

Purchases

The one-time unlock is sold through Apple's In-App Purchase. Payment is handled entirely by Apple; jpaste never sees your payment details, your name or your billing address. The app asks Apple whether this Apple Account owns the unlock, and stores only the yes-or-no answer on the device.

Face ID, Touch ID and the device passcode

Boards marked Protected are unlocked by biometric authentication. That check is performed by the operating system through Apple's LocalAuthentication framework. jpaste receives only a yes or no. The app never receives, sees or stores your fingerprint or face data, and no biometric information ever leaves the Secure Enclave.

Vault boards, and why there is no recovery

Boards marked Vault are encrypted on the device with AES-256-GCM. The key is derived from the passphrase you choose, using PBKDF2-HMAC-SHA256 with a large iteration count and a random salt unique to each board.

jpaste never writes your passphrase anywhere — not to the device, not to the Keychain, not to iCloud. It exists only for as long as it takes to derive the key. That is what makes the encryption meaningful, and it is also why a forgotten Vault passphrase cannot be recovered or reset, by you or by us. The contents of that board are unreadable without it.

If your own password manager offers to save it, that is your choice and happens outside the app — jpaste neither asks for it nor can prevent it. Either way, choose a passphrase you will still have in a year.

What jpaste cannot promise

Two honest limits, stated here rather than buried:

This website

jpaste.com is a small static site hosted on Vercel. It uses Vercel Web Analytics, which counts page views and referrers without cookies and without building a profile of you or following you across other sites. Vercel's hosting also records standard server logs, including IP addresses, for security and operations.

This applies to the website only. The app contains no analytics of any kind.

The site loads its typefaces from Google Fonts, which means your browser contacts Google when you open the page.

Children

jpaste is not directed at children and collects no personal information from anyone, including children.

Your rights

Regulations such as the GDPR and the CCPA give you rights to access, correct, export and delete the personal data a company holds about you. jpaste holds none, so there is nothing for us to hand over or erase. Your own data is on your device, under your control: delete the app, and it goes with it.

Changes to this policy

If this policy changes, the date at the top of the page changes with it, and anything material will be described in the app's release notes rather than introduced quietly.

Contact

Questions about privacy, or anything else: support@jpaste.com.

This is the original English text. Translations of this page are provided for convenience; where one differs from the English, the English is the version that applies.