The link does far more work in the places people already are than on a page they have to remember to visit.
Five placements, in rough order of return. The first two are worth more than the other three combined.
An all-staff email announcing the policy is not a placement. It is an event. It gets read once by perhaps a third of the recipients, and it is gone by the following week — which is fine as an announcement and useless as a control.
Everything on the list above is a place rather than a moment: it is still there in March when someone new joins and in August when somebody is under deadline at ten at night, which are the two occasions that actually matter. Send the email as well if you like — there's a template — but count it as the announcement, not the intervention.
The framing throughout this site is don't lecture, just send the link, and that holds for placements too. A line that scolds gets ignored by exactly the people most likely to paste.
Before you paste it into an AI tool: dontpastethat.com/check-a-paste
Read dontpastethat.com (2 min) — what not to paste into AI tools. Optional: dontpastethat.com/paste-test, five minutes, most people score lower than they expect.
Why these five categories, and what to do instead when you still need the AI's help: dontpastethat.com To check a specific block of text before you send it, use dontpastethat.com/check-a-paste — it runs in your browser and sends nothing anywhere.
Be honest with yourself about the shape of the result. This does not produce a measurable drop in anything, because a paste leaves no trace on your side — no alert, no log, nothing to count before or after. Anyone promising you a metric here is selling monitoring, which is a different purchase.
What it produces is narrower and worth more: people who recognise the moment. The signal that it worked is somebody forwarding the link to a colleague without being asked to, or a message in a channel that starts "is this one okay to paste?" — a question that did not previously get asked out loud.
The reasoning behind the no-trace point, with the documented cases, is on the incidents page.
Everything in this kit is released under CC0 — public domain. No attribution, commercial use fine, and rewriting it in your own voice is encouraged rather than merely tolerated. Deliberately not CC BY: an attribution requirement nobody can satisfy inside an internal policy document would make ordinary use technically infringing, and this exists to be used.
One ask, not a rule: leave a link to dontpastethat.com somewhere in it. It is the only thing that turns a paragraph someone skimmed into a page they can actually read when they need it.