Privacy Policy

We collect information you provide, information generated by your use of the service, and limited technical information needed to operate, secure, and debug the service.

• account and Workspace data, such as your email address, authentication provider identifiers, Workspace membership, settings, and Plan
• Artifact data, such as uploaded files, file paths, display metadata, Revision records, Bundle state, Access Link state, and claim or expiration state
• credential metadata, such as credential name, public identifier, scopes, creation time, expiration, revocation state, and last-used timestamps, but not recoverable credential secrets
• usage and security data, such as request metadata, IP address, user agent, route, status code, rate-limit state, audit events, abuse signals, and operational diagnostics
• billing data when paid features are enabled, generally handled by a payment provider rather than stored directly by agent-paste

We use service data to authenticate users, provision Workspaces, publish and serve Artifacts, resolve Access Links, enforce limits, maintain audit records, provide support, detect abuse, protect the service, improve reliability, and comply with legal obligations.

We do not sell personal information and do not run cross-context behavioral advertising on the service.

We share information only as needed to operate the service, comply with law, protect users and the platform, complete business transactions, or with your direction through features such as Access Links.

Service providers may process information for hosting, storage, authentication, security, payment processing, error monitoring, and operational tooling. They are authorized to use that information only to provide services to Zaks.io, LLC or as otherwise permitted by law.

This is the public version of our storage and protection model. It describes the protections users should know about without publishing internal key names, exact topology, operational runbooks, or other details that would help an attacker.

• Workspace data is isolated by tenant controls, application authorization, and database-level access rules.
• Artifact bytes are stored in private object storage and encrypted at the application layer before durable storage. The public content path does not expose direct object-store URLs.
• Untrusted Content is served from an isolated content origin with restrictive browser security headers and sandboxing appropriate to the content and trust tier.
• Credential secrets are shown only when created, stored in non-recoverable verifier form, and must be replaced if lost.
• Access Links use signed, revocable URLs. Sensitive link material is designed to avoid normal server-side logs where practical.
• Operational logs and audit summaries are designed to exclude request bodies, credential secrets, full signed URLs, and other high-risk values.
• Human access uses a dedicated authentication provider. Abuse-response controls are separated from normal credential access.
• Security-sensitive secrets are handled through managed secret storage and rotation procedures, not committed to the repository.
• Automated and manual controls may rate-limit, revoke, disable, or delete content when needed for security, abuse response, or policy enforcement.

No internet service can guarantee absolute security. If you believe you found a vulnerability, do not test against other users' data. Report it privately through the Security Policy.

When you publish an Artifact or share an Access Link, people or agents with the relevant link may be able to view the content until the link or Artifact expires, is revoked, is deleted, or is locked down. Treat shared links as sensitive.

Ephemeral publishing allows an agent to publish before a human claims the Workspace. Ephemeral content has shorter retention and lower limits. Claim links should be protected because they can transfer control of the published content.

Retention depends on the type of data and the Workspace settings or Plan. Artifacts may expire automatically. Audit, security, billing, abuse-prevention, and operational records may be kept longer where needed to operate the service, resolve disputes, enforce terms, or meet legal obligations.

Deletion can make content inaccessible before all backups, logs, caches, or queued cleanup jobs have aged out or completed.

The service uses first-party functional cookies for authentication, login protection, theme preference, and privacy choices. The shared theme and optional analytics preference cookies may be set from either the apex marketing site or dashboard so your choices carry across agent-paste.sh and app.agent-paste.sh.

Cloudflare Web Analytics is optional and cookieless. We skip that beacon when your browser sends Sec-GPC: 1, when it sends DNT: 1, or when this browser has the optional analytics preference set to off. These choices do not disable authentication, security, billing, audit, abuse-prevention, error-monitoring, or Artifact publish/read telemetry needed to operate the service.

You can manage credentials, Access Links, Workspace settings, Artifact lifecycle settings, and optional web analytics in the dashboard where those features are available. You can also delete content or revoke links when you no longer want them accessible.

Depending on where you live, you may have rights to access, correct, delete, or export certain personal information, or to object to some processing. Send requests to contact@agent-paste.sh.

The service is only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18.

The hosted service is currently offered only in the United States. Zaks.io, LLC and its providers may process information in the United States and, where provider operations require it, other jurisdictions with privacy laws different from where you live.

We may update this policy as the service changes. The effective date above shows when this version took effect.

The hosted service is operated by Zaks.io, LLC. Privacy questions and data-rights requests can be sent to contact@agent-paste.sh.

Mailing address: Zaks.io, LLC, 2108 N St, Ste N, Sacramento, CA 95816, USA.