PatchPage Privacy Notice
Last updated: August 17, 2026
This notice covers the hosted PatchPage service — the free instance at post.patchyhq.com, operated by Patchy. It explains what we record when you publish a page, when someone reads one, and when someone reports one. The patchyhq.com website has its own privacy policy, and a self-hosted PatchPage instance is run by whoever deployed it, not by us — this notice does not describe those.
The short version: we record nothing about the people who read a page — no cookies, no scripts, no analytics — though a page that embeds an image from another site will show that site a reader’s IP address. Publishing is not anonymous: it records your IP address, your user agent, and — when you publish from inside a git repository — that repository’s name, branch, and commit. Pages are deleted when they expire. We do not sell anything.
What we record when you publish
Each time you publish or update a page, we store:
- The page itself — its HTML, the original filename, the file size, and a content hash.
- Request details — the IP address the publish came from, the user agent, and the PatchPage CLI version.
- Git details, if you publish from a git repository — the repository’s organization and name, the branch name, and the commit SHA. The CLI reads these from your working directory automatically. Branch and repository names sometimes carry internal project or client names, so publish from a repository whose names you are comfortable sharing with us — or publish from a directory that is not a git repository, in which case there is nothing to read and nothing is sent.
- Timestamps for the page’s creation and each update.
We use this to operate the service, apply the fair-use limits in the acceptable use policy, and investigate reports of abuse.
Your publishing key
The first time you publish, the tool obtains a publishing key and saves it on your machine. We store only a hash of that key — we cannot read it back, which is also why a lost key cannot be recovered. When a key is issued we record the IP address it was requested from and the date; that record is what enforces the limit of five new keys per address per day, and it stays with the key as its provenance.
What readers experience
Nothing we collect identifies a reader, and that is structural rather than a promise we remember to keep:
- No cookies, no login, and no session on the host that serves pages.
- No scripts at all. Published pages are served under a content security policy that permits no script source of any kind, and your page is rendered inside a sandboxed frame. There is no analytics JavaScript on a published page because there is no JavaScript on one.
- No referrer leakage. Pages are served with
Referrer-Policy: no-referrer, so following a link out of a page never hands anyone the unlisted URL the reader was on. - Pages are served
noindex, asking search engines to keep them out of results. - A visit is not an event we record. The only thing reading a page can move is that page’s expiry date, which a visit holds at least 30 days out. We do not log which reader read which page, and a visit is deliberately absent from the analytics events listed below.
There is one exception, and it belongs to the publisher. A published page may load images hosted on other sites. Doing so tells the site hosting that image the reader’s IP address and browser, exactly as it would anywhere else on the web — which means an image can be used as a tracking pixel. It is a narrow channel: the page still cannot run scripts or read cookies, and Referrer-Policy: no-referrer means the other site never learns which page the reader was on. Using remote content this way violates the acceptable use policy, and we remove pages that do it — but it is the publisher’s choice of content, so we cannot promise it never happens.
Separately, our hosting provider keeps standard operational logs of requests — the ordinary records any web server keeps to stay up and secure — for 30 days.
Reporting a page
Every published page has a report link in its footer, and the report form says the same thing this notice does: filing a report stores which page you reported, the time, the IP address the report came from, and anything you wrote. Reports go to a person to read, and no volume of them takes a page down on its own.
Reports outlive the page they are about, on purpose. When a page is deleted or expires, the record of what was reported and what we did about it remains.
Analytics
We use PostHog for server-side product analytics. It receives a short, closed list of events — a publishing key was issued, and a page was created, updated, reported, disabled, deleted, or expired — carrying only identifiers, sizes, counts, and states. No IP address, no page URL, no filename, no page content, and no reader’s visit is ever included, and there is no PostHog code in your browser or on a published page.
How long we keep things
- Pages stay for at least 90 days after they were last published or updated, and a visit holds a page at least 30 further days out. When a page finally expires it is permanently deleted — the page, every version of it, and the publish records described above, including the IP address, user agent, and git details. We cannot restore it for you. Deleted content does persist for a while in our providers’ routine backups, which we keep for disaster recovery and which age out within 35 days.
- A page that is deleted leaves service immediately, and its stored content is purged when the expiry sweep next reclaims it.
- Reports are kept after the page is gone, as above.
- Publishing keys and their issue records are kept for as long as the key exists. Revoking a key does not delete its record.
- Operational logs are kept for 30 days.
Who processes this information
We do not sell personal information, and we do not share it for advertising. We rely on two providers, which process information only on our behalf:
- Microsoft Azure — hosting, database, page storage, and operational logs. The service runs in Azure’s Central US region.
- PostHog — the product analytics described above, processed in the United States.
We may also disclose information where the law requires it, or where it is necessary to enforce the acceptable use policy — including reporting sexual content involving minors to the relevant authorities.
Your choices and rights
Every page comes down on its own when it expires. To take one down sooner, the key that published it can delete it through the service’s API — the patchpage command line tool has no delete command today — or email us the page URL and we will remove it for you. You can also email us to ask what we hold about you, or to correct or delete it. Depending on where you live you may have additional rights under laws such as the EU / UK GDPR or the California Consumer Privacy Act; email us and we will honor any that apply to you, and we will not discriminate against you for asking.
Children
PatchPage is a tool for work and is not directed to children. We do not knowingly collect personal information from children.
Changes to this notice
If we change this notice we will update the “Last updated” date above, and we will note significant changes more prominently where appropriate.
Contact us
Questions about any of this? Email us.