Privacy Policy

ScorchPad is architecturally designed so that we are technically incapable of reading your paste content. Encryption and decryption occur entirely in your browser using the Web Cryptography API (AES-256-GCM). The decryption key exists only in the URL fragment — a portion of the URL that browsers never transmit in HTTP requests. Our servers receive only encrypted ciphertext.

This is not a privacy policy claim — it is a technical fact. Even if compelled by a court order, subpoena, government demand, or any legal process, we cannot produce plaintext content we have never possessed. We cannot hand over what we do not have.

This zero-knowledge guarantee applies exclusively to paste content. Other data described below (account information, metadata) is subject to standard privacy protections.

We store exactly the following. Nothing more.

In Redis (paste storage):

• Encrypted ciphertext blobs — unreadable without the decryption key, which we never have
• Initialization vectors (IVs) — not sensitive without the key
• PBKDF2 salts — not sensitive on their own
• Paste metadata: expiry timestamp, view count limit, syntax language tag, ciphertext size in bytes
• All paste data auto-deletes at TTL expiry or upon reaching the maximum view count

In rate-limiting records:

• HMAC-SHA256 hashed IP addresses only — raw IP addresses are NEVER stored anywhere
• Rate limit counters with 24-hour TTL
• The HMAC secret is unique to ScorchPad and cannot be used to reverse-engineer IP addresses

In Supabase (only if you create an account):

• Email address (via Clerk authentication)
• Display name (optional, if provided)
• Subscription tier and plan details
• Clerk user ID
• Account creation and last-seen timestamps

We explicitly do NOT store:

• Plaintext content — ever, under any circumstances
• Decryption keys — architecturally impossible
• URL fragments — never transmitted to us by browsers
• Raw IP addresses — only one-way HMAC hashes
• Passwords — or any password-derived value; the password is never transmitted to our servers under any circumstances
• Browser fingerprints, device identifiers, or tracking identifiers
• Browsing history, navigation patterns, or analytics data

We use browser localStorage only for:

• Theme preference (light/dark mode) — stored locally, never transmitted
• Consent acknowledgement record — stored locally, never transmitted

Zero advertising cookies. Zero tracking pixels. Zero third-party analytics. Zero fingerprinting. Zero behavioral tracking. We do not sell, rent, share, or trade your data with advertisers or data brokers. We never have and never will.

ScorchPad uses the following third-party services. Each processes data according to their own privacy policies:

• Clerk (authentication) — processes email and name for sign-in. clerk.com/privacy
• Upstash (Redis storage) — stores encrypted blobs and rate limit records. upstash.com/privacy
• Supabase (Postgres database) — stores account records only. supabase.com/privacy
• Vercel (hosting) — serves the application. May process access logs. vercel.com/legal/privacy-policy
• Sentry (error tracking) — configured with aggressive content scrubbing. URL fragments and any potential key material are stripped before transmission. sentry.io/privacy
• Resend (transactional email) — processes email address for account emails only. resend.com/privacy
• Razorpay (payments, India) — processes payment data for Indian subscribers. razorpay.com/privacy
• Lemon Squeezy (payments, international) — processes payment data for international subscribers. lemonsqueezy.com/privacy

Payment processing is handled entirely by Razorpay and Lemon Squeezy. We do not store, process, or have access to card numbers, bank details, or payment credentials of any kind.

We do not voluntarily cooperate with any government agency, law enforcement body, intelligence agency, or regulatory authority. We are not an arm of the state and we do not proactively assist surveillance of any kind.

WE WILL NOT RESPOND TO:

• Informal police requests, letters, or verbal communications
• Administrative notices that do not constitute valid court orders
• Foreign government requests without a valid MLAT process through Indian courts
• Intelligence agency requests of any kind without proper legal process
• Requests from any body lacking jurisdiction over Rsaat Labs under Indian law

WE WILL ONLY RESPOND TO:

• Valid orders issued by courts of competent jurisdiction in India with proper legal process
• After exhausting all available legal challenges to overbroad or legally deficient orders

When legally compelled to comply with a final, valid, unchallenged court order, we can only produce what we technically store:

• Encrypted ciphertext — useless without the decryption key, which we do not have
• Paste metadata: expiry, view count, language, size — no content
• Creation timestamp
• HMAC-SHA256 hashed IP address — a one-way hash, not the raw IP
• Account information (email, name) only for registered users — anonymous pastes have zero linkage

We cannot produce plaintext content, decryption keys, URL fragments, or raw IP addresses. No back door exists. We will notify affected users of legal requests before complying, unless explicitly prohibited by court order. If we are gagged, our warrant canary at /warrant-canary will reflect this.

Paste data is automatically deleted from our servers at the earlier of: (a) the expiry time set by the creator, or (b) when the maximum view count is reached. Redis TTL handles deletion automatically and irrevocably — no manual intervention, no cleanup cron, no background worker.

Account data is retained while your account is active. Upon account deletion, your account data is removed within 30 days. Rate limiting hashes are retained for 24 hours.

We do not maintain backups of paste content. Once deleted by TTL or view limit, paste data is permanently unrecoverable.

You have the following rights regarding your personal data:

• Right to access: request a copy of account data we hold about you
• Right to deletion: request deletion of your account and associated metadata
• Right to correction: request correction of inaccurate account data
• Right to portability: request your account data in a machine-readable format

These rights apply to account data only. Because paste content is encrypted and we hold no key, we cannot retrieve, produce, or delete paste content on your behalf. Encrypted blobs with no account linkage are fully anonymous to us.

To exercise your rights, contact: rsaatlabs@gmail.com. We will respond within 30 days.

For privacy-related inquiries or data requests:

rsaatlabs@gmail.com

Security vulnerabilities: /.well-known/security.txt