privacy policy

baston.dev is a personal website run by one person, baston ("we", "us"). we decide what happens to the personal data described here, so we are its controller under brazil's LGPD and the EU's GDPR. for anything about your data, write to [email protected].

• –visitors don't have accounts. there are no ads, no analytics and nothing that follows you around the web.
• –we never sell or rent personal data, and we don't share it for advertising.
• –most of what we see about you is kept in memory only and is gone within hours.

• –your ip address and basic request details (browser, page requested), as every website receives them. we use them to deliver the site, keep it safe and limit abuse: how many pastes or rooms one person can create, one download at a time per person, and counting a video view once per person every 6 hours. this stays in memory and is dropped within hours.
• –pastes. the text you post, shown to anyone who has the link, until the expiry you choose (5 minutes up to 7 days). then it is deleted. please don't paste passwords or other people's personal data.
• –screenshare rooms. your nickname, the room password (stored only as a one-way hash) and, while the room is open, the ip address of whoever created it and of each person inside. screens travel directly between the people in the room, so they can see each other's ip address, as with any direct connection. we don't record screens. a room and its data are deleted once it is empty.
• –downloads. to hand out a download link we check a captcha and tie the link to your ip address for 10 minutes. files made by the private video tool are deleted within an hour.
• –the visit counter is a single number. it doesn't record who you are.
• –emails you send us: your address and message, to answer you.
• –settings in your browser, such as volume or your nickname, are stored on your device only. see the cookie policy.

under the GDPR (art. 6) and the LGPD (art. 7), we rely on:

• –providing what you asked for (a paste, a room, a download): performance of a service you requested.
• –legitimate interest in running a safe, working website and stopping abuse. you can object at any time (see your rights).
• –legal obligation, when the law requires us to keep or hand over data.

• –cloudflare delivers and protects the site and runs the captcha, so it handles every request, including your ip address. see cloudflare's privacy policy.
• –google stores our backups. a backup can include pastes and open-room data from the day it was made; backups are deleted after at most 30 days.

these providers may process data outside your country, including in the united states. they do so under safeguards recognized by the LGPD and the GDPR, such as standard contractual clauses.

• –ip addresses and request details: in memory, hours at most.
• –pastes: until the expiry you picked, 7 days at most.
• –screenshare rooms: until the room is empty.
• –video tool files: one hour at most.
• –backups: 30 days at most.
• –emails: as long as needed to answer and follow up, then deleted on request.

wherever you are, you can ask us what we hold about you, and ask us to correct or delete it. write to [email protected]. we answer within 15 days, and may ask you to confirm it's you first. it's free.

• –brazil (LGPD, lei 13.709/2018, art. 18): confirmation that we process your data, access, correction, anonymization, blocking or deletion, portability, information about who we share it with, and withdrawal of consent. you can also complain to the ANPD (autoridade nacional de proteção de dados).
• –european union, eea and uk (GDPR, art. 15 to 22): access, rectification, erasure, restriction, portability and objection. you can also complain to the data protection authority where you live.
• –united states (such as california's CCPA/CPRA and similar state laws): the right to know, delete and correct, and to opt out of the sale or sharing of personal information. we don't sell or share it, so there is nothing to opt out of, and we never treat you differently for using these rights. we don't track you, so do not track and global privacy control signals change nothing here.

this site isn't made for children under 13, and we don't knowingly collect their data (COPPA in the us, art. 14 of the LGPD). if you think a child sent us personal data, write to us and we'll delete it. content marked 18+ asks you to confirm your age first.

the site only works over https, passwords are stored as one-way hashes, and we keep as little as we can. no system is perfect: if a breach puts your data at risk, we'll tell you and the authorities as the LGPD (art. 48) and the GDPR (art. 33 and 34) require.

if this policy changes, the date at the top changes too. big changes will be pointed out on the site.

baston, [email protected].