Privacy Policy

The short version: we cannot read what you send. Your content is encrypted on your device with a key that never reaches our servers, and everything is deleted after 48 hours.

一句话:我们看不到你送的内容。它在你的装置上就用一把从来没上过服务器的钥匙加密了,而且 48 小时后全部删除。

What we receive / 我们收到什么

• Encrypted content. Text, images and files, already encrypted (AES-GCM) on your device. We store the ciphertext only. We do not hold the key and cannot decrypt it.
  加密后的内容。文字/图片/档案在你的装置上就用 AES-GCM 加密好了;我们只存密文,手上没有钥匙,解不开。
• Your email address and a provider user id, when you sign in with Apple or Google — used only to recognise you and link your own devices together.
  你的 email 与该供应商给的使用者编号(用 Apple / Google 登入时)—— 只拿来认出是同一个人、把你自己的装置串在一起。
• Device names you choose, and technical metadata we cannot avoid seeing: the size of each item, its type (text / image / file), and its mime type.
  你自己取的装置名,以及藏不住的技术资料:每条的大小、类型(文字/图片/档案)与 mime。
• A push token per device, so we can tell your other devices that something arrived. The push itself carries no readable content.
  每台一枚推送凭证,用来通知你的其他装置「有东西来了」;推送本身不带看得懂的内容。
• Usage counters — how many items and how many bytes your own device group sent and received in the last 24 hours. They exist to enforce the plan limits and to stop abuse. They are counted per device group, not per person and not per device, they are never linked to advertising or profiling, and they are not tied to the content itself.
  用量计数 —— 你自己那个装置组在过去 24 小时送出/取回了几件、几个 byte。 它只为了执行档位上限与挡滥用,以装置组为单位(不是按人、也不是按装置), 从不用于广告或用户画像,也不跟内容本身挂在一起。

File names are encrypted too. We never see them in the clear.

档名也是加密的,我们看不到明文。

What we do not do / 我们不做的事

• No advertising, no analytics, no tracking, no profiling.
  没有广告、没有分析、没有追踪、不做用户画像。
• We do not sell or share your data with third parties.
  不卖、不给第三方。
• We do not read, scan or index your content — we could not, even if asked.
  不读、不扫、不建索引 —— 就算有人要求也做不到。

Where it is stored, and who processes it / 存在哪里、谁在处理

Encrypted content is stored on our own Cloudflare infrastructure (Workers, KV and R2), and nowhere else. We use these data processors, and no others:

加密后的内容只存在我们自己的 Cloudflare 基础设施上(Workers / KV / R2),没有别的地方。我们用到的资料处理者只有以下这些:

• Cloudflare, Inc. — hosting, storage and delivery of the encrypted content (Workers, KV, R2, Durable Objects). Cloudflare holds ciphertext only.
  Cloudflare, Inc. —— 承载、储存与传送加密内容(Workers / KV / R2 / Durable Objects)。它手上只有密文。
• Apple Inc. — Sign in with Apple, and push notifications to Apple devices via APNs.
  Apple Inc. —— Apple 登入,以及经 APNs 推送到 Apple 装置。
• Google LLC / Google Firebase — Google Sign-In, and push notifications to Android devices via Firebase Cloud Messaging (FCM). FCM receives a device token and a wake-up signal; it does not receive your content.
  Google LLC / Google Firebase —— Google 登入,以及经 Firebase Cloud Messaging(FCM) 推送到 Android 装置。FCM 收到的是装置凭证与一句「有东西来了」,拿不到你的内容。
• Apple and Google also process your purchase if you subscribe — we never see your payment details.
  你若订阅,付款由 Apple 与 Google 处理 —— 我们看不到你的付款资料。

Sign-in is verified against Apple's and Google's public keys. We use no analytics, advertising or attribution SDK of any kind.

登入用 Apple 与 Google 的公开金钥验签。我们没有装任何分析、广告或归因 SDK。

How long / 留多久

48 hours. Every item expires automatically on the server and on each device. There is no "keep forever" option and no backup — VicPaste is a clipboard, not storage. Your account and device list stay until you sign out or remove the device. One exception: on the Mac app, items you mark as a favorite are kept until you un-favorite them.

48 小时。每一条在服务器与每台装置上都会自动过期。没有「永久保存」这个选项,也没有备份 —— VicPaste 是剪贴板,不是储存空间。帐号与装置清单会一直留着,直到你登出或移除那台装置。只有一个例外:Mac 版「收藏」的项目会保留到你取消收藏为止。

Your choices / 你可以做的

• Remove a device at any time — it loses access immediately, and the group key is rotated so it can never read anything new.
  随时可以撤掉一台装置 —— 它马上失去存取权,而且群组钥匙会换掉,它从此读不到任何新内容。
• Sign out on a device to delete its local copy and its key.
  在某台登出会删掉它本机的内容与钥匙。
• Delete your account, in the app — Settings → Danger zone → Delete account. It removes your account, your device list, your device group and all of its content, and it revokes the Apple / Google sign-in link. You can also request deletion on the web, without installing anything, at vicpaste.victech.my/delete-account, or by writing to support@victech.my.
  在 app 内删帐号 —— 设定 → 危险动作 → 删除帐号。它会删掉帐号、装置清单、装置组与其中全部内容,并撤销 Apple / Google 的登入连结。 也可以不装任何东西、直接在网页 vicpaste.victech.my/delete-account 申请,或写信到 support@victech.my。
• What happens after you delete. Your account record, device list and sign-in links are removed straight away, and every device loses access immediately. A small amount of encrypted residue (ciphertext we could not read in the first place) may survive in storage for a short while; it is cleared by the system within 30 days at the latest. Nothing readable is kept, and nothing is kept for any other purpose.
  删完之後会怎样。帐号记录、装置清单与登入连结当场删掉,每台装置立刻失去存取权。 储存层可能还留下少量加密残留(本来就是我们读不懂的密文),系统会在最长 30 天内清掉。 不留任何读得懂的东西,也不为别的用途留下任何东西。

Children / 儿童

VicPaste is not directed at children under 13.

VicPaste 不面向 13 岁以下儿童。