Bashr.run ("Bashr", "we", "us", or "our") provides a service for creating, sharing, and managing temporary shell scripts through raw URLs and generated terminal commands.
This Privacy Policy explains what information is processed when you usehttps://bashr.run and its associated API and raw-content endpoints, how that information is used, and the choices available to you.
Service operator: Shubhransh
Privacy contact: query@bashr.run
1. Information We Process
Script content and paste information
When you create a paste, we process and store:
- The script content you submit.
- The information needed to identify, retrieve, and manage the paste.
- The expiry setting you select.
- Information needed to support editing, deletion, link resets, and other paste-management operations.
Bashr.run does not require account registration to create or share scripts.
Your script remains available according to its selected expiry and our service's deletion behavior. Available expiry options are 1 hour, 24 hours, 3 days, and 7 days, with a default of 24 hours.
Browser storage and editing access
Bashr.run uses browser-side storage or credentials to preserve editing access to pastes you create. This editing access is associated with the browser that holds the necessary credential; it is not an account or a publicly shareable editing link.
If you clear your browser data, close an environment that does not preserve that data, or otherwise lose the editing credential, you may lose the ability to edit or delete your paste.
Keep your editing credentials and devices secure.
Request, device, and security information
Our infrastructure provider, Cloudflare, processes technical information associated with requests to Bashr.run. Depending on the request and enabled Cloudflare services, this information may include:
- IP addresses and timestamps.
- Requested URLs and paths, HTTP methods, response statuses, and request headers.
- Browser and device-related information, including User-Agent strings.
- Approximate geographic and network information, such as country, region, or network provider.
- Connection and TLS metadata, browser-environment signals, and other technical information used for security and bot detection.
We use Cloudflare's security features, including Workers rate limiting, Bot Fight Mode, and Turnstile verification, to help manage excessive requests, distinguish automated traffic, and prevent abuse.
Operational logs
Cloudflare Workers Observability may automatically record request and response metadata, invocation events, errors, and related technical information for monitoring and troubleshooting.
Depending on the enabled logging features and configuration, these records may contain requested URLs, IP addresses, browser information, approximate location, response status, and connection or security metadata.
We do not currently maintain a separate custom, permanent database of script-creation events for analytics. Cloudflare's own logging and retention settings govern the provider-generated records, and retention can vary according to the Cloudflare service, plan, and configuration in use.
We do not intentionally include script contents or editing credentials in custom security logs.
2. How We Use Information
We process information for the following purposes:
- To create, store, retrieve, edit, and delete temporary script pastes.
- To apply selected expiry settings and make expired pastes unavailable.
- To preserve authorized editing and paste-management functionality.
- To apply rate limits and protect the service against spam, automated abuse, and excessive requests.
- To investigate technical errors, diagnose failures, and maintain service reliability.
- To detect and investigate security incidents or suspected misuse.
- To comply with applicable legal obligations and respond to valid legal requests.
We do not use script content or security telemetry for advertising or unrelated behavioral profiling.
3. Sharing and Access to Scripts
A paste's raw URL provides read-only access to its contents. Anyone who obtains that URL can read the script while it remains available.
Bashr.run does not provide password-protected raw URLs by default. Treat a raw URL as shareable access to the script.
Do not include passwords, access tokens, private keys, personal records, confidential business information, or other secrets in a paste.
Editing and deletion require the appropriate editing credential. Knowing a raw URL alone does not grant editing access.
We may share information with:
- Cloudflare: To provide infrastructure, hosting, content delivery, Workers, rate limiting, Turnstile verification, security, and operational monitoring.
- Authorities or other parties where legally necessary: When required by applicable law or a valid legal process, or when reasonably necessary to investigate abuse, protect the service, or defend legal rights.
- A successor operator: If the service or its relevant assets are involved in a business transfer, subject to applicable legal requirements.
We do not sell personal information.
4. Third-Party Infrastructure
Bashr.run relies on Cloudflare for infrastructure and security-related services.
Cloudflare may process technical information under its own policies and applicable contractual arrangements. Its processing, storage, and retention practices are not determined solely by Bashr.run.
For further information, review:
Cloudflare's Turnstile service may process browser and technical signals to help detect automated abuse. The information processed and the applicable settings depend on the implementation and configuration.
5. Data Retention and Deletion
Script pastes
Scripts are retained according to their selected expiry and the service's deletion behavior.
When a paste expires, its raw URL becomes unavailable and the script is automatically removed afterward. You may also delete a paste before expiry. Resetting a link creates a replacement paste with a new URL and invalidates the old URL.
Deletion or expiry does not guarantee the immediate removal of every copy that may already have been downloaded, cached, or retained in third-party infrastructure logs.
Browser-side data
Browser storage used to preserve editing access may remain on your device until it is removed by you, your browser, or another process. We cannot restore lost editing access through an account because Bashr.run does not require accounts.
Technical and security records
Retention for Cloudflare-generated request and security records depends on the applicable Cloudflare products, plan, and logging configuration.
We do not promise a single retention period for all provider-generated records. We aim to limit information retained under our control to what is reasonably needed for service operation, troubleshooting, security, and applicable legal obligations.
If information must be retained to investigate a documented security incident or satisfy a legal obligation, it may be retained for the period reasonably necessary for that purpose.
6. Cookies and Browser Technologies
Bashr.run uses browser-side storage or credentials necessary to preserve editing access and manage pastes.
Cloudflare and Turnstile may use browser technologies and technical signals associated with service delivery, verification, and security.
We do not use these technologies for advertising or cross-site behavioral advertising.
If we introduce analytics, advertising, or other optional tracking technologies in the future, we will update this policy and implement any notices or choices required by applicable law.
7. Security
We use infrastructure and security measures intended to protect Bashr.run against abuse and unauthorized access, including rate limiting, bot detection, and verification mechanisms.
No internet-connected service can guarantee absolute security. You are responsible for reviewing a script and deciding whether to run it.
Bashr.run does not execute scripts on its servers, scan or verify their contents for safety, or guarantee compatibility with your environment. A generated command runs the retrieved script in your local environment with the permissions available to the selected interpreter.
Because a raw URL is readable by anyone who obtains it, do not use Bashr.run to store secrets or sensitive information.
8. International Processing
Cloudflare operates a global infrastructure network. Depending on the services used and the applicable configuration, technical information associated with requests may be processed in locations outside your country.
Where required, relevant processing and transfers are subject to applicable legal requirements and the arrangements governing the service providers involved.
9. Your Privacy Choices and Requests
Depending on the law applicable to you, you may have rights concerning personal information, such as requesting access to information, correction of inaccurate information, deletion, or other available remedies.
To make a privacy-related request, contact us using the address listed below. We may need to verify your request before acting on it.
Because Bashr.run does not require accounts and does not provide an account-based recovery system, we may be unable to associate a request with a particular paste unless you provide sufficient information to identify it. Do not send passwords, private keys, or other secrets when making a request.
We will assess and respond to requests as required by applicable law.
10. Children's Privacy
Bashr.run is designed for developers and technical users and is not directed at children. Do not submit children's personal information or other sensitive personal information through the service.
11. Changes to This Policy
We may update this Privacy Policy when the service, our data practices, or applicable legal requirements change.
We will publish the revised version on this page and update the "Last updated" date. Your continued use of the service after an update is subject to applicable law; it does not replace any consent or notice that the law may require.
12. Contact Us
For privacy questions, requests, or concerns, contact:
Bashr.run operator: Shubhransh
Privacy email: query@bashr.run
Website: https://bashr.run/