What CPYNET keeps, what it never keeps, and why - verified line by line against the actual running code, not a boilerplate policy.
Paste content lives only in memory (RAM) - it is never written to disk or a database. It's permanently deleted the moment it's read (or its read budget runs out) or its timer expires. A server restart loses every paste that hasn't been read yet, too - that's not a bug, it's the whole point.
If password-protected, it's kept encrypted at rest with AES-256-GCM; the server only holds the decrypted text in memory for the brief moment it checks a password. With zero-knowledge encryption, the server never sees anything but ciphertext at all - the decryption key never reaches it.
Every request gets one standard access-log line: client IP, HTTP method, path (e.g. /123456 - just the code, never the content), status code, duration. This goes to the server's own stdout (typically captured by systemd or Docker), not stored in a queryable database by CPYNET itself.
The /admin panel (off by default, only reachable if ADMIN_PASSWORD is set) keeps the last 200 activity entries (who did what, from which IP) and lifetime paste counters - metadata only, never content, and visible only to whoever holds the admin password.
Exactly two: a lang cookie remembering your language choice, and - only if you actually log into the admin panel - a session cookie scoped to the /admin path. No tracking or advertising cookies of any kind.
Off by default. It only loads if whoever runs a given deployment sets a Measurement ID in their own admin panel - that's their choice for their instance, CPYNET itself never loads a tracker on its own.
The server has zero external Go dependencies (pure standard library). The web page loads one font from Google Fonts - the only third-party network request in the whole product. No other third-party scripts, CDNs, or trackers.
CPYNET is provided "as is," without warranty of any kind. You use it at your own risk. Whoever runs a given instance (the operator) is not liable for any damages, direct or indirect, arising from its use - including lost data (pastes are ephemeral by design and can't be recovered once expired or read), service interruptions, or anything shared through it.
You're solely responsible for what you paste or upload: its legality, its accuracy, and your right to share it. Don't use it to distribute anything illegal, infringing, or malicious. An operator may remove access, rate-limit, or block a source at their discretion, though in the normal case content is simply never inspected (see above) - abuse is generally caught by the automated limits below, not manual review.
To keep one bad actor (or a burst of automated ones) from taking an instance down for everyone: writes and reads are rate-limited per IP, total in-memory storage across every live paste is hard-capped (further writes get a 503 once full, rather than the process running out of memory), and file uploads specifically get a tighter maximum lifetime than plain text (see the API reference for current limits). None of this requires an account or identifies who's using the service in the normal case - it only kicks in under actual load.
This is a small, single-file, open-source project - if anything here is unclear, the actual behavior is verifiable by reading the source code directly.