Yeah, this was a very quick project and that slipped through. All fixed now. If people are interested I'd be happy to put due diligence in and put up a privacy policy!
Edit: maybe I'm an idiot and can't repro the js injection, could you link me? http://copypastecsv.herokuapp.com/pastes/8279b342