Privacy policy

Last updated 2026-11-09

This policy explains what Onepaste collects when you browse the site or ask for an email, why, and what you can do about it. We keep it short and only describe what the site actually does.

Who is responsible

The controller of your personal data is Wiktor Kulas, Poland. Contact: wiktorkulas51@gmail.com.

What we collect

  • Email address. With the form you used (the homepage signup, the copy gate sign-in, the founder waitlist or the next-release notice), the template you were looking at when relevant, the time you signed up, and where you came from: the utm_source, utm_medium and utm_campaign values in the link, or the referring website.
  • Visitor ID. A random identifier stored in your browser's localStorage. It is not an account and does not contain your name or email address. It lets us count visits and events without knowing who you are.
  • UTM parameters. Kept in your browser's sessionStorage until you close the tab, so that they are attached to your signup if you give your email in the same session.
  • Product events. Page and template views, preview openings, video plays, copy clicks, gate views, successful copies, reaching the daily limit, founder clicks, waitlist joins and signups. Each event is linked to your visitor ID, the template slug if any, the page path and the traffic source.
  • Daily prompt count. The number of different prompts you copied on a given UTC day, stored against your email address so that the free daily limit can be enforced.
  • Account cookie. After you open the sign-in link we email you, a signed cookie named pg_account keeps you signed in for up to 30 days. A signed cookie named pg_free remembers which free prompt you copied without an account, also for up to 30 days. Both are httpOnly and strictly necessary for the copy gate, your account and paid access to work. Signing out deletes the account cookie.
  • Visit statistics. Anonymous counts of page views, clicks on prompts and templates, and form submissions, kept by the WebScale statistics panel. The visitor ID is a hash that changes every day, sets no cookies and is not linked to your email address.
  • Account and purchase data. Your account is the email address you sign in with. If you buy a plan or a single template, the payment provider (Polar or Lemon Squeezy, depending on the checkout you use) collects your name, billing address and payment details. We receive the email on the order, the product bought and the plan status. We do not receive or store your card number.
  • Watermark on copied prompts. Each prompt served to a signed-in or paying visitor carries a license line with a short ID and a hidden signature tied to that account. It is there so that copies of paid prompts can be traced to the account they came from. It contains no personal data beyond what the account already has.
  • Hosting data. Our hosting provider processes standard request data, such as your IP address, to deliver the site.

Why we use it and on what basis

  • Sending the prompts you request and occasional product emails. Legal basis: your consent, art. 6(1)(a) GDPR. You can withdraw consent at any time, as described below. Withdrawing does not affect processing done before.
  • Product analytics, the daily limit and abuse prevention, such as per-minute rate limits. Legal basis: our legitimate interest in understanding how the site is used and keeping it working fairly, art. 6(1)(f) GDPR.
  • Selling a plan or template and activating your access. Performance of a contract with you, art. 6(1)(b) GDPR, and our legal obligations for invoicing and tax, art. 6(1)(c) GDPR.
  • Signing you in to your account. The sign-in link and the pg_account cookie are strictly necessary for the service you asked for.

Who processes the data

  • Polar or Lemon Squeezy is the merchant of record and payment processor for paid plans and single templates. Which one serves your checkout depends on the store configuration. It takes the payment, issues the receipt, and handles VAT and sales tax on the sale. Its privacy policy applies to the payment data it collects.
  • Resend sends the sign-in emails that contain your one-time link. It receives your email address and the content of that message.
  • Cloudflare, Inc. hosts the site.
  • Upstash Inc. provides the Redis database where emails, counters and event logs are stored.
  • SeoHost (Poland, European Union) hosts the WebScale statistics panel that counts visits.

Cloudflare, Upstash, Resend, Polar and Lemon Squeezy are based in the United States. Your data may therefore be transferred outside the European Economic Area, on the basis of the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR).

How long we keep it

  • Email address and signup record. Until you unsubscribe or ask us to delete it.
  • Sign-in links. Each link is valid for 15 minutes and is deleted when it is used or expires.
  • Plan and access record. While the plan or single-template unlock is active. Order and invoice records are kept by the payment provider and by us for as long as tax law requires.
  • Traffic source of a visitor. 90 days.
  • Daily prompt count. About two days.
  • Event log. The raw log keeps only the latest 5,000 events; older entries are dropped. Daily counters and unique-visitor totals are aggregated per UTC day, without personal content beyond what is listed above.

Your rights

You can ask us for access to your data, its correction, erasure, restriction of processing or a copy of it in a portable format. You can object to processing based on our legitimate interest and withdraw consent at any time. To do any of this, write to wiktorkulas51@gmail.com.

You also have the right to lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), uodo.gov.pl.

What we do not do

We do not sell your data, and we do not use it for advertising or ad-tracking.