Privacy and secrets

Secrets stay on your Mac

Every copy is checked on your Mac the moment you copy it, before anything else happens. If it looks like a secret, Pasta keeps it on this Mac only, locked and masked (like sk-proj-••••••••••••0A). It’s never labeled, previewed, synced or sent anywhere. Click Reveal on the card when you need to see it. You can still paste it as usual.

Pasta looks for:

• API keys and tokens from OpenAI, Anthropic, OpenRouter, Stripe, AWS, Google, GitHub, GitLab, Slack, npm, SendGrid, Hugging Face, PostHog and others, plus JWTs and bearer tokens.
• Private keys and connection strings with a password in them.
• Passwords, like a DB_PASS=… line in a config file or “my password is …” in a message.
• Sign-in and signed links, such as password reset links or links with a token in them.
• Card numbers, US Social Security numbers and bank account numbers (IBANs).
• One-time codes (like 482 913) and crypto wallet recovery phrases.
• Anything else that looks like a random token: a long string mixing letters and digits, or a long hex string.

Pasta leans toward locking. A false alarm just means a card you click to reveal; a miss could leak a secret. Our server runs the same checks again before anything reaches the AI.

Password managers are skipped

Nothing you copy from these apps is saved at all:

• Apple Passwords and Keychain Access
• 1Password, Bitwarden, LastPass and KeePassXC
• Proton Pass, Enpass, NordPass, Dashlane, Strongbox, MacPass and KeeWeb

Pasta also checks which app wrote the copy, so a password manager’s browser extension is caught too. And any copy an app marks as concealed or temporary (many password tools do) is ignored.

Ignore other apps

You can add your own apps to that list in Settings → Ignore Copies From. Pick one of the apps that copied something lately, or click Choose App… and pick any app. Copies from those apps are skipped exactly like a password manager’s: nothing is saved, labeled or synced. You can ignore copies that come from your iPhone or another Mac too: they show up as “Another device”.

The list stays on this Mac and isn’t synced, so set it on each of your Macs. Adding an app doesn’t delete what it copied before; delete those cards from the panel if you want them gone. Remove an app from the list to start saving its copies again. One limit: Pasta goes by the app that’s in front when you copy (or the app the copy says it came from), so a copy made in the background by an ignored app’s helper, while another app is in front, can still be saved.

What leaves your Mac

• Your synced history, encrypted on your Mac first. See Sync and encryption.
• Text for Smart Cards and search, with emails, phone numbers and link query strings removed, while Smart Cards are on. See Smart Cards and search.
• Anonymous usage stats.

Anonymous usage stats

Pasta sends anonymous usage stats, like “a link was pasted”, to help us decide what to build.

They never include what you copied, links or domains, your searches, or your account. Stats go through our server, so our analytics provider never sees your IP address.

When something breaks, Pasta also sends an anonymous error report: the kind of error and where in Pasta’s own code it happened, and whether the app froze or quit unexpectedly. Never the error’s message, file names or paths on your Mac, or anything you copied.

For the full details, including who we share data with and your rights, read the Privacy policy.