Privacy policy

Last updated: September 29, 2026.

pasteup ("we") publishes websites on its users' own domains. This policy covers pasteup.dev, the panel at dash.pasteup.dev and the sites we host. Questions: hola@pasteup.dev.

What we collect

• Account: your email; your name and profile photo if you sign in with Google; the sites you can open and your role on each one.
• Sign-in: one-time sign-in links and sessions, stored only as hashes, with the IP address that asked for a link and the browser that opened the session.
• Sites: domains, the address of the git repository you connect, the access token for that repository (encrypted), the deploy history (commit, author, message and validation results) and the published files.
• Connected assistants (MCP): which AI assistants you connected and when, their tokens (stored only as hashes), and a record of each tool they used (tool, site, result and commit), without the content of the changes.
• Visitors of the sites we host: our infrastructure providers process technical request data (IP address, browser, requested page) to serve the pages and protect the service. pasteup does not add analytics or tracking to your site.

What we use it for

To give you access, publish and serve your sites, send sign-in links and invitations, keep the service secure and answer you. We do not sell data or use it for advertising.

Who processes it

We use providers that process data on our behalf:

• Cloudflare: hosting of the API, the panel, the database and the site files; the containers that build each deploy and that edit your sites when an assistant asks; email routing.
• Fly.io: the network edge that serves sites on your domain.
• Resend: sending emails.
• Google: sign-in with Google, only if you use it.
• Your git provider (GitHub, GitLab or another): we read and write the repository you connect, with the token you give us.

Some of them process data outside your country.

AI assistants (MCP)

If you connect an AI assistant (Claude, ChatGPT or another), it reads and changes your sites for you, with your role, through pasteup's MCP server. What it reads from your sites goes to the operator of that assistant (for example Anthropic or OpenAI), which handles it under its own policy. You disconnect an assistant in the panel, in Assistants, and its access stops at once.

Cookies

The panel uses one cookie, needed to keep you signed in. pasteup.dev and the sites we host do not set cookies of ours.

How long we keep it

While your account exists. Sign-in links expire in 15 minutes and sessions in 30 days. An assistant's access token expires in 1 hour and its refresh token in 30 days. When you delete a site, we delete its files, its repository connection and its deploy history.

Your rights

You can ask us to see, correct, export or delete your data by writing to hola@pasteup.dev. We answer within 30 days.

Security

Repository tokens are encrypted, sign-in links and sessions are stored only as hashes, and all traffic uses HTTPS.

Changes

If we change this policy, we update this page and its date. If the change matters, we tell you by email.