Privacy Policy

Last updated: May 18, 2026

Clipper ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the Clipper application on iOS and any other supported platforms.

1. Information We Collect

We collect only what is necessary to deliver the service:

• Account identifiers: When you sign in with Apple, we receive an anonymized Apple User ID and, if you choose to share it, your Apple-generated relay email address. If you register with an email address, we store that email to authenticate your account.
• Encrypted clipboard data: Clipboard items (text, images, files, URLs, rich text, HTML, colors) are encrypted on your device with AES-256-GCM before transmission. We store only the resulting ciphertext; the plaintext is never accessible to us.
• Encrypted snippets: Saved snippets and their tags are encrypted under the same key hierarchy before being synced to our servers.
• Subscription status: We store whether your account has an active subscription or lifetime license, and its expiry date, to unlock Pro features.
• Support communications: If you contact us by email, we retain that correspondence to resolve your request.

2. How We Use Your Information

• To authenticate you and maintain your session across devices
• To sync your encrypted clipboard history and snippets across your devices
• To verify your subscription entitlement and unlock Pro features
• To respond to support requests and troubleshoot issues
• To enforce our Terms of Use and prevent abuse

3. End-to-End Encryption Architecture

Clipper uses a two-layer key hierarchy to ensure that only you can read your clipboard data:

• Key Encryption Key (KEK): Derived from your PIN and email using PBKDF2-SHA256 with 300,000 iterations and a unique per-account salt. The KEK is never sent to or stored on our servers.
• Data Encryption Key (DEK): A random AES-256 key generated on your device. The DEK is wrapped (encrypted) with your KEK using AES-256-GCM and stored on our server — but only in its encrypted form. We cannot unwrap it.
• Content encryption: All clipboard items are encrypted with your DEK using AES-256-GCM before upload. Our servers store only ciphertext.
• Local protection: The decrypted DEK is stored in the iOS Keychain with kSecAccessControlUserPresence, requiring Face ID, Touch ID, or your device passcode to access it.

Because the KEK is derived entirely on your device and never transmitted, a breach of our servers would expose only data that is cryptographically impossible to decrypt without your PIN and email.

4. Cross-Platform Sync

Clipper supports cross-platform clipboard synchronization. When you sign in on a new device, you re-derive your KEK locally (using your PIN and email), download the encrypted DEK from our server, unwrap it on-device, and use it to decrypt your history. The sync process never exposes your plaintext data to our infrastructure.

5. Data Storage and Security

Encrypted data is stored on servers hosted in a secure cloud environment. We apply industry-standard safeguards including HTTPS/TLS for all data in transit, access controls, and regular security reviews. However, no system is 100% immune to breach — our zero-knowledge design ensures that even a worst-case server compromise cannot expose your plaintext clipboard content.

6. Data Retention and Deletion

We retain your encrypted clipboard data for as long as your account is active. You may delete individual items at any time within the app. You may permanently delete your account and all associated data from Settings → Delete Account in the app. Deletion is irreversible.

7. Third-Party Services

• Apple Sign In: Authentication via Apple's Sign in with Apple service is subject to Apple's Privacy Policy. We never receive your Apple ID password.
• Apple iOS Keychain & Biometrics: Local key storage and biometric authentication are provided by Apple's frameworks on your device.

We do not sell, rent, or share your data with third-party advertising networks or data brokers.

8. Children's Privacy

Clipper is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Withdraw consent for data processing (where applicable)
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top. Continued use of Clipper after changes take effect constitutes your acceptance of the revised policy.

11. Contact Us