PasteOkay for Chrome

This policy covers the browser extension “PasteOkay – Instant Private Pastebin” distributed through the Chrome Web Store, and the pastes it creates on our service at okay.ovh. It is written to be read, not to hide things.

Effective 14 October 2026 · extension version 1.0.1

In one box

We never read your clipboard. The extension only writes a link into it.
Your selected text is read only in the moment you click “Save to PasteOkay”.
With encryption on, the text is sealed in your browser and the key never leaves it.
No analytics, no trackers, no advertising, no selling of data, no account required.

1. What the extension reads

The text you have selected, and only at the moment you use the “Save to PasteOkay” menu item.
The text you type into the extension's own popup.
The settings you save in the popup (lifetime, encryption, burn after reading, address, password).
The public turnstile-sitekey value of the okay.ovh page, which the extension needs to draw the Cloudflare check there.

It does not read other websites, other tabs, form fields, passwords, browser history, bookmarks, downloads, files, or your clipboard.

2. What is sent to our server

Data	Why
The paste text, or its ciphertext when encryption is on	to store the paste you asked for
Link lifetime, burn after reading flag, optional custom address	to apply the settings you chose
A PBKDF2-SHA256 derived value, salt and iteration count	to protect a paste with a password. The password itself is never sent
Proof of work: challenge, counter, timestamp, SHA-256 of the payload	to prove the request came from a real browser without tracking you
A Cloudflare Turnstile token	abuse protection, verified by Cloudflare
Your IP address	rate limiting and blocking abuse. Stored as a keyed hash, not as a readable address

3. What stays on your device

chrome.storage.sync: lifetime, encryption, burn after reading, custom address and the notification preference. If you are signed into Chrome with sync enabled, Google may sync these settings between your devices.
chrome.storage.session: the optional password and the link from your last save. This lives in memory, is never synced, and is gone when Chrome closes.

No paste content is ever stored on your device by the extension.

4. Encryption in your browser

When you switch encryption on, the text is sealed with AES-256-GCM by the extension before anything is sent. The key is placed in the part of the link after the # symbol. Browsers never transmit that fragment to a server, so we receive only an opaque blob and cannot read your text — not while storing it, not afterwards.

The flip side is worth stating plainly: if the link is lost, or someone sends it without the part after #, nobody can recover the text, including us.

5. Clipboard and notifications

The extension writes the new link to your clipboard, because that is what you asked it to do. It never reads the clipboard. Notifications are used only to confirm a save or to tell you that something failed.

6. Permissions and why they exist

Permission	Reason
contextMenus	adds the “Save to PasteOkay” entry to the right-click menu
storage	keeps your settings, and the password in memory only
notifications	tells you the link is ready, or that something went wrong
offscreen	a background worker has no page of its own, and copying needs one
clipboardWrite	puts the new link on your clipboard. Write only
scripting	draws the Cloudflare check inside the okay.ovh page, where Cloudflare requires it to run
https://okay.ovh/*	the only site the extension talks to. It reaches no other host, other than Cloudflare's challenge script inside that page

7. Why a tab on okay.ovh opens for a moment

The Cloudflare check we use for abuse protection is tied to the okay.ovh domain, so it can only run on an okay.ovh page. The extension opens that page in the background, or reuses a tab you already have open, takes the resulting one-time token and finishes. That visit reaches our server like any other page view; it is not used to identify you.

8. Who else is involved

Cloudflare, Inc. — serves okay.ovh through Cloudflare Pages, stores pastes in Cloudflare D1, and runs the Turnstile check. Cloudflare sees the connection, as any hosting provider does.
Google LLC — distributes the extension through the Chrome Web Store and, if you have sync enabled, stores the settings you chose.

There is nobody else. No analytics providers, no advertising networks, no data brokers, no third-party scripts on the pages you are sent to.

9. What we never do

We do not sell or rent your data, and we do not share it for advertising or creditworthiness.
We do not read your clipboard, other tabs, form fields or browsing history.
We do not run analytics or tracking pixels in the extension or on the pages it opens.
We do not download or execute remote code: every line of the extension ships inside it.
We do not build a profile of you, and no account is needed to use the extension.

The extension's use of your data is limited to the purposes described on this page. We do not use paste content for anything other than storing and serving the paste you created.

10. How long data lives

A paste is deleted when its lifetime runs out (10 minutes to 30 days, or never if you chose that), or after the first open when “burn after reading” is on.
You can delete a paste at any time with the manage link you received when it was created.
Abuse-prevention records — hashed IP addresses, rate-limit counters, firewall rules — are kept for the short period needed to block attacks, and are not tied to a name or an email address.
The extension keeps nothing after you remove it, and clearing your browser data clears the settings it stored.

11. Your rights

Using the extension requires no account, so we hold no profile to correct or export. Pastes are attached to a hashed IP address rather than to your identity, which means the reliable way to have one erased is the manage link or simply letting it expire. If you are in the EU, the UK or a region with similar rules, you can still contact us to ask about access, erasure or objection, and we will answer within a month.

12. Security

Everything travels over TLS. Paste content is encrypted at rest with a key held by the server, on top of the browser-side encryption you can switch on. IP addresses are stored only as keyed hashes. The site sends a strict content security policy with no inline scripts, and the extension loads no remote code.

13. Children

The extension is not directed at children under 13, and we do not knowingly collect their personal data.

14. Changes to this policy

If the extension starts handling data differently, this page changes first and the date and version below move with it. Continuing to use the extension after an update means you accept the current version of this policy.

15. Contact

Questions, privacy requests or anything unclear on this page: [email protected].

Last updated 14 October 2026 · policy version 1.0 · applies to extension version 1.0.1 and later.