Legal

Privacy Policy

Effective and last updated: July 27, 2026

This Privacy Policy explains how Paste Panda (“Paste Panda,” “we,” “us,” or “our”), operating from Toronto, Ontario, Canada, handles information when you use pastepanda.com and its temporary device-to-device transfer service (the “Service”). Our privacy practices are governed by applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) where it applies. If you do not agree with this policy, please do not use the Service.

1. Information we process

Transfer content

When you create a transfer, we process the text and supported files you submit, the original file names and sizes, a generated claim code, and the transfer’s creation and expiry times. The content must be stored on the server temporarily so it can be retrieved from another device.

Technical and usage information

Our server processes technical and usage information needed to operate, secure, troubleshoot, and improve the Service. This can include request times, requested pages or endpoints, browser and device information, response status, and network information.

We retain content-free operational and security records for security, fraud prevention, incident investigation, performance measurement, capacity planning, and service improvement. These records may include a pseudonymous transfer reference, event and outcome, request and expiry times, claim method, item and file counts, aggregate byte size, general file categories, browser and device information, full IP address, and a derived masked network identifier. They do not include transferred text, file contents, file names, or claim codes.

Ratings and reviews

You may submit a star rating, an optional name, and an optional written review. When a name is supplied, we format it as a first name and last initial for public display; otherwise the review is labelled “Anonymous User.” Reviews are not anonymous to us because the associated transfer reference, where applicable, full and masked IP address, browser-provided user-agent information, and submission time are retained for moderation, fraud prevention, and duplicate-review controls. Reviews are checked before publication. An approved rating may be selected as featured whether or not it includes a written comment.

Communications

If you contact us, we process the information you provide, including your name, email address, message, submission time, IP address, and browser and device information, for correspondence, support, record-keeping, and the protection of the Service.

Review reports

If you flag a public review, we store the review identifier, your explanation, submission time, IP address, and browser-provided user-agent information so the report can be assessed and misuse of reporting tools can be limited.

2. How we use information

We use information to provide and maintain transfers; retrieve content when a valid claim code is supplied; enforce file, rate, and expiry limits; protect the Service from misuse; identify unusually heavy or repeated usage; investigate malicious activity; understand send-and-claim behaviour and transfer volumes; collect, moderate, publish, and calculate genuine aggregate ratings from reviews; diagnose errors; improve capacity and reliability; respond to messages; and comply with applicable legal obligations.

3. Transfer access and security

A claim code acts as the credential for a transfer. Anyone who obtains the code may be able to retrieve its content before it expires. Do not use Paste Panda for passwords, authentication secrets, financial account data, health records, highly confidential material, unlawful content, or anything whose disclosure could cause harm.

Use the Service only over HTTPS in production. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or disclosure will never occur.

Paste Panda does not routinely read, scan, classify, or verify transfer content for legality. This does not restrict measures we may take when required or permitted by law, when responding to a valid report, or when necessary to protect people, rights, or the Service.

4. Retention and deletion

Under the standard configuration, transfer content is available for five minutes from creation and is scheduled for deletion promptly after expiry. Content may be removed earlier where necessary to protect the Service, comply with law, or enforce these terms.

Content-free operational and security records, including IP addresses, are normally retained for 180 days and then deleted through scheduled processes. Particular records may be preserved for longer where required or permitted by law, including a valid preservation demand, investigation, dispute, security incident, or legal hold. Infrastructure providers may maintain separate logs under their applicable retention practices.

Ratings, reviewer information, communications, reports, and related technical records are retained for moderation, correspondence, service integrity, and legal purposes. Information may also be maintained in protected backups for a limited period after removal from live systems.

5. Cookies and local technologies

The public send-and-receive experience does not require an account. Strictly necessary cookies may be used for authentication, security, and the operation of restricted service functions.

We use Google Analytics 4 to measure site usage and Microsoft Clarity to understand how visitors interact with pages. These services may use cookies or similar technologies and may process device, browser, interaction, approximate location, and network information. You can limit these technologies through browser privacy settings, consent tools where provided, or provider opt-out controls. Blocking analytics does not prevent you from using the core transfer service.

6. Sharing and service providers

We do not sell personal information. Information may be processed by infrastructure providers that host, route, secure, or back up the Service on our behalf, and by Google Analytics and Microsoft Clarity for the measurement purposes described above. Those providers process information under their own terms and privacy notices. We may disclose information in response to valid legal process, or where disclosure is otherwise required or permitted by applicable law, including to protect rights or safety, investigate abuse, comply with preservation or reporting duties, or complete a business reorganization subject to appropriate safeguards.

7. Illegal content and legal cooperation

Users must not use the Service for child sexual abuse material, non-consensual intimate images, infringing or pirated material, malware, or other unlawful content. Paste Panda cannot control every use of the Service and does not routinely monitor temporary transfers. Where we become aware of suspected unlawful activity, we may preserve relevant content-free records, restrict access, make a legally required report, and cooperate with law enforcement or other competent authorities in accordance with applicable law. We will not voluntarily disclose personal information merely on an informal request where legal authority is required.

8. International processing

The Service and its providers may process information in countries other than your own. Privacy protections may differ by jurisdiction. Where required, we use appropriate measures for cross-border processing.

9. Your choices and rights

Subject to applicable law, you may request access to personal information we hold about you, ask that inaccurate or incomplete information be corrected, or withdraw consent to future processing where consent is the applicable legal basis. We may request information reasonably necessary to verify your identity and locate responsive records. Legal exceptions may limit access, correction, deletion, or withdrawal in particular circumstances.

Because transfers are short-lived, require no account, and are identified primarily by a claim code, we may be unable to associate an expired transfer with a particular person. If you have a concern about our privacy practices, please contact us first so we can assess it. You may also have the right to make a complaint to the Office of the Privacy Commissioner of Canada or another regulator with jurisdiction.

10. Children

The Service is not directed to children under 13, or the minimum age required to consent to data processing where they live. We do not knowingly collect personal information from children in violation of applicable law.

11. Changes to this policy

We may update this policy as the Service or applicable requirements change. We will post the revised version here and update the date above. Material changes apply prospectively unless otherwise required by law.

12. Contact

Questions, access or correction requests, and privacy complaints may be sent to the Paste Panda Privacy Contact at ask@pastepanda.com. Please include sufficient information to identify the nature of your request. Privacy correspondence is administered from Toronto, Ontario, Canada.