Privacy policy
Last updated: 2026-08-15
1. Data controller
The pastebin service (available at anyja.hu) is operated by colada.systems (“we”, “the operator”). For privacy-related requests, contact us at [email protected].
This notice is written under Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.), since the service is operated from Hungary.
2. What we process
- Account data: email address, password (stored hashed, never recoverable), an optional display name.
- Two-factor authentication (optional): an encrypted TOTP secret, passkey public keys, and hashed recovery codes.
- Pastes: the content you submit, its title, language, visibility, expiry setting, and creation/edit timestamps. Pastes posted while signed in are tagged with your display name (or your email's local part if you have none set); pastes posted anonymously are tagged with a randomly generated label (e.g. “lucid-ridge-18”) that carries no personal data.
- Session: a session identifier stored in a cookie for up to 30 days after login.
- View counting: the IP address and browser identifier used to view a paste are hashed with a salt into an irreversible value and kept for at most 30 minutes, solely to filter duplicate view counts. The original IP address and browser identifier are never stored.
- API keys: any API keys you create, stored only in hashed form.
3. Purpose and legal basis
- Creating and running your account: performance of a contract (GDPR Art. 6(1)(b)).
- Security (two-factor authentication, rate limiting, abuse prevention): legitimate interest (GDPR Art. 6(1)(f)).
- Captcha checks on registration and login: legitimate interest, abuse prevention.
4. Who we share data with
- Hosting: the service runs on servers located in the European Union (France, Hungary, and Germany).
- Outgoing email: Brevo (Sendinblue SAS, France) — used to deliver verification codes, password resets, and account notifications.
- Captcha: Cloudflare, Inc. (Cloudflare Turnstile) — used to protect the registration and login forms from abuse. Cloudflare is based in the United States; the transfer relies on Standard Contractual Clauses approved by the European Commission.
None of these processors use your data for their own purposes or for marketing.
5. Retention
- Account data: for as long as your account is active. Deleting your account permanently and immediately erases your personal data (email, password hash, two-factor data).
- Pastes: deleting your account does not delete your pastes — they remain online, anonymized and unowned, unless you gave them an expiry. You can delete individual pastes yourself before deleting your account, or contact us.
- Session cookie: up to 30 days.
- View-deduplication data: up to 30 minutes.
6. Your rights
Under the GDPR you have the right to access, correct, and erase your data, to restrict or object to processing, and to data portability.
You can delete your own account at any time from Settings → Security.
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11., Hungary, [email protected]), or with the supervisory authority in your own country of residence.