Privacy Policy

CopyPasta — Clipboard Manager for macOS
Effective Date: October 21, 2026

1. Who We Are

CopyPasta is developed and operated by Maksimov Anatolii, registered as autónomo in Spain (hereinafter "we", "us", or "our"). For any privacy-related inquiries, you can reach us at:

Email: legal@copypasta.pro

2. What This Policy Covers

This Privacy Policy explains what data CopyPasta collects, why, how it is processed, and your rights regarding that data. It applies to the CopyPasta macOS application, the temporary web-based sharing feature accessible via browser, and this website.

3. Our Core Privacy Principle

CopyPasta is a local-first application. Your clipboard history is stored on your device, encrypted, and is never uploaded to our servers. Items you choose to share pass through our relay server only in end-to-end encrypted form (see Section 5). We do not have access to, and cannot read, your clipboard history or the items you share.

4. Data We Collect

4.1 Data We Never Collect

We never collect, read, or store your clipboard content. This includes text, images, files, passwords, API keys, credit card numbers, or any other data you copy. Clipboard content leaves your device only in two cases: when you share items in a sharing session, end-to-end encrypted so that we cannot read them (see Section 5), and when CopyPasta loads a preview of a web link you copied, directly from that website (see Section 5.1).

4.2 Crash Reports (Collected by Default)

We use Sentry to receive crash reports and performance diagnostics so we can find and fix bugs. This is always on in the released app. When CopyPasta crashes or records an error, it sends a technical report containing the stack trace, the app version and build, the macOS version, and basic device information (such as the Mac model). A sample of performance measurements (how long certain operations take, about one in five) is sent as well. Crash reports never include your clipboard content, and the app is configured not to attach personal identifiers and not to record network requests. Reports are sent to and stored in Sentry's EU data region (Frankfurt, Germany).

4.3 Analytics (Opt-In Only)

Usage analytics are disabled by default and are only sent if you turn them on, either during onboarding or at any time in the application settings. When enabled, CopyPasta sends anonymized events through TelemetryDeck, a privacy-friendly analytics provider based in the European Union (Frankfurt, Germany): application launches, subscription purchase events, feature usage signals (e.g., "an item was pinned"), the type of content category copied (e.g., "a link was copied" — never the actual link), the app version and the macOS version. Events are tagged with a random installation identifier generated on your Mac, which is not linked to your identity. TelemetryDeck does not store IP addresses and does not use device fingerprinting. We never receive your actual clipboard content through this mechanism. You can turn analytics off again at any time.

4.4 Subscription & Purchase Data

Subscriptions and purchases are processed entirely by Apple through the App Store. We do not collect or store your payment information, Apple ID, or billing details. Apple may share with us anonymized transaction data (such as subscription status) necessary to unlock features in the app. Apple's handling of your purchase data is governed by Apple's own Privacy Policy.

4.5 Sharing Relay and Website Metadata

Our servers never record your clipboard content, but running the sharing relay and this website involves some technical metadata. What we keep, and for how long, is listed in Section 8.

5. Secure Sharing Feature

CopyPasta includes an optional feature that lets you share clipboard items through a temporary, end-to-end encrypted link that you open in a browser. Here is how it works technically:

When you start a sharing session, your Mac creates a random 128-bit secret. The secret is part of the share link and of the QR code, after the "#" sign. Browsers never send this part of a link to any server, and the CopyPasta web page removes it from the address bar as soon as it has read it. Shared items are encrypted with AES-256-GCM on your Mac or in the browser, using a key derived from the secret, and are decrypted only on the other end. Our relay server, hosted by Webdock in Denmark (EU), only forwards these encrypted messages in real time. The secret and the encryption key are never sent to or stored on our server. So that browsers can join, the server receives a one-way hash of the secret (PBKDF2) and stores only a hash of that hash; neither the secret nor the key can be recovered from it. No content is stored on the server at any point.

Anyone who has the full link or the QR code can open the session, so share it only with your own devices or with people you trust. The six emojis shown in the app and on the web page are a verification code derived from the secret: if both show the same emojis, the page belongs to your Mac. "New Link" in the app replaces the secret; old links, and browsers that opened them, stop working immediately. With the session address alone, without the secret, a browser cannot join and the content cannot be viewed.

A session lasts for the duration you choose (from 1 hour to 1 month) or until you press "Stop Sharing", which deletes it from the relay immediately and closes the page in every connected browser. While the CopyPasta app is closed or offline, no browser can join the session and nothing is relayed; the session becomes usable again when the app reconnects within its duration.

Like any relay, our server can see when messages are sent, which session they belong to and how large they are. It cannot read shared items, and it cannot alter them or slip in items of its own: the receiving device rejects anything that was not encrypted with the session key. It could, however, delay or drop messages, or tell a device to delete an item that was shared in the session.

5.1 Link Previews

When you copy a web link without a query string or "#" part, CopyPasta loads that page directly from its website to show a title and an image, as a browser would. This request goes to the website you copied, not to our servers, and it is subject to that website's privacy policy. You can turn link previews off in the application settings.

6. Where Your Data Is Processed

• Clipboard content: on your device. Items you share pass through our relay end-to-end encrypted; link previews are requested from the linked website.
• Crash reports: stored by Sentry in its EU data region (Frankfurt, Germany).
• Analytics data (only if you opt in): processed by TelemetryDeck on servers located in Frankfurt, Germany (EU).
• Sharing relay and website: our server is hosted by Webdock in Denmark (EU).
• Web fonts: pages on copypasta.pro, including the sharing page, load the Inter font from Google Fonts (Google LLC, United States), so your browser contacts Google's servers when it opens them.
• Purchase data: processed by Apple, Inc. (United States), subject to EU-US Data Privacy Framework commitments.

All data we store is kept within the European Union. Apple (purchase transactions), Functional Software, Inc. (the United States-based operator of Sentry) and Google (web fonts) may process data under their own safeguards for international transfers.

7. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process data on the following legal bases:

• Crash reports and performance diagnostics are processed under our legitimate interest in keeping the application stable and secure (Article 6(1)(f) GDPR).
• Analytics are processed based on your explicit consent, which you may grant or withdraw at any time (Article 6(1)(a) GDPR).
• The sharing relay operates based on your explicit action to initiate a sharing session, constituting performance of a contract (Article 6(1)(b) GDPR).
• Connection metadata of the relay and the website (Section 8) is processed under our legitimate interest in protecting the service against abuse and keeping it running (Article 6(1)(f) GDPR).

8. Data Retention

• Clipboard history: retained on your device according to the retention period you configure in the app (from 1 day to indefinitely). You have full control.
• Crash reports: retained by Sentry for a limited period in accordance with its data retention policy, then deleted.
• Analytics data: retained by TelemetryDeck in accordance with their data retention policy, typically aggregated and not linked to individual users.
• Shared content: never retained. The relay forwards encrypted items and does not save them.
• Sharing session records: while a session exists, the relay keeps its random session ID, its creation and expiry time, a hash of the secret's hash (Section 5), a hash of the token that lets your Mac reconnect, and hashes of the tokens that let joined browsers reconnect. The record is deleted when you press "Stop Sharing" or when the session expires (after at most 30 days); browser tokens are also deleted when you create a new link. It contains no IP addresses and no content.
• Relay connection metadata: to protect the relay against abuse, it counts open connections, join attempts and failed attempts per IP address. These counters exist only in the server's memory, are never written to disk or logs, and are discarded about 24 hours after the last activity. The relay's log records connection events (for example "a browser joined a session") with the time and a shortened hash of the session ID, without IP addresses; these log entries are kept for at most 14 days.
• Website logs: for visits to the pages of this website (not the sharing page or relay connections, which are not logged), our web server records the time, the page requested, and your IP address shortened to its first three parts (IPv4) or first three groups (IPv6). These entries are kept for at most 14 days.

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your data:

Under GDPR (EU/EEA residents)

You have the right to access any personal data we hold about you, to request rectification of inaccurate data, to request erasure of your data, to restrict or object to processing, to data portability, and to withdraw consent for analytics at any time. Because we collect minimal, anonymized data, most of these rights are already satisfied by design. To exercise any right, contact us at legal@copypasta.pro.

Under CCPA/CPRA (California residents)

You have the right to know what personal information is collected, to request deletion, and to opt out of the sale or sharing of personal information. We do not sell or share your personal information as defined under the CCPA/CPRA.

Under LGPD (Brazilian residents)

You have similar rights to access, correct, anonymize, block, or delete unnecessary or excessive personal data.

For all jurisdictions: because CopyPasta is designed to minimize data collection, in most cases there is little to no personal data associated with your use of the app. If you contact us with a request, we will respond within 30 days.

10. Children's Privacy

CopyPasta is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has somehow provided us with personal data, please contact us at legal@copypasta.pro and we will take steps to delete such information.

11. Third-Party Services

CopyPasta uses only the following third-party services:

• Sentry (crash reporting and performance diagnostics, always on): operated by Functional Software, Inc.; CopyPasta sends its reports to Sentry's EU ingestion endpoint and they are stored in Sentry's EU data region (Frankfurt, Germany). More information is available at https://sentry.io/privacy/.
• TelemetryDeck (analytics, opt-in only, off by default): a privacy-first analytics provider incorporated in the EU. TelemetryDeck does not collect IP addresses, does not use cookies and does not employ device fingerprinting. More information is available at https://telemetrydeck.com/privacy.
• Apple App Store (subscriptions): all payment processing is handled by Apple. We do not receive or store your payment details.
• Webdock (hosting): our relay server and this website run on a virtual server operated by Webdock in Denmark. Like any hosting provider, Webdock could technically access that server. Shared items pass through it only end-to-end encrypted, and the server holds nothing that could decrypt them.
• Google Fonts (web fonts on copypasta.pro): your browser downloads the Inter font from Google's servers, which receive your IP address and browser details. More information is available at https://policies.google.com/privacy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the application or on our website at https://copypasta.pro. The "Effective Date" at the top of this document indicates when it was last revised. Continued use of CopyPasta after changes constitutes acceptance of the updated policy.

13. Contact

If you have questions, concerns, or requests related to this Privacy Policy or your data, contact us at:

Maksimov Anatolii
Autónomo, Spain
Email: legal@copypasta.pro
Website: https://copypasta.pro