Trust & Security

The full content of every item you copy — text, code, links, images — and its metadata are encrypted at rest in the local database using a key sealed by your operating system's secure storage (macOS Keychain, Windows DPAPI, or Linux libsecret). Short titles and previews stay unencrypted so you can search and see snippets. Nobody can read your history by copying the database file off your machine.

Cross-device sync is off until you sign in and turn it on. When it's on, here is exactly what happens to a clip before it leaves your device:

• A random 256-bit sync key is generated on your first device and sealed in your OS secure storage. It never leaves the device in the clear.
• Every clip's content, preview, title, and metadata are encrypted with AES-256-GCM (authenticated encryption) — the cloud store sees ciphertext only. File and image bytes offloaded to storage are encrypted the same way.
• The sync key is wrapped by a key derived from a one-time recovery code(~100 bits of entropy) using PBKDF2-SHA256, 600,000 iterations. Email/password users can add a second password-derived wrapper for convenient web access. Only wrapped keys, salts, and KDF parameters live in the cloud.
• The recovery code is shown when it is issued. Pasteable cannot retrieve it, but an already-unlocked trusted device can replace it without changing the sync key or deleting history. Password changes rewrap the same sync key; password resets fall back to the recovery code or a trusted device.
• Only envelope metadata is visible to the server: item type (text/image/file), timestamps, opaque device id, a coarse capture channel (screenshot vsclipboard), and a content hash used for cross-device dedup. Source app names, device names, titles, previews, and rich metadata are encrypted insideenc.metadata. The hash reveals whether two clips are equal, not what they contain.

Desktop keeps the unwrapped key in OS secure storage and mobile uses its secure key store. The web app keeps the key only for the current browser session and decrypts clips locally. A new browser must unlock with its connected account password or recovery code; Google accounts use the recovery-code or trusted-device path.

Pasteable skips captures from known password managers (1Password, Bitwarden, LastPass, Dashlane, and similar) by default, and you can add your own ignored apps, file types, and formats. With “Blur sensitive content” on, passwords and API keys are visually hidden in the shelf so shoulder-surfers and screenshots do not leak them. Detection starts with on-device heuristics. Flagged clips are still captured and encrypted, never deleted, and never shared.

Routine capture, search, and sync do not send clipboard contents to Pasteable or a third-party model. Cloud AI is a separate, off-by-defaultPro feature you turn on in Settings.

When Pro cloud AI is enabled, selected text or images may be sent to our cloud provider (currently OpenAI-compatible) for the action you requested — summarize, translate, OCR, image captions, search-context enrichment, or the optional sensitive-content classifier that catches secrets the on-device heuristic missed. We use these requests only to return the result to your device; we do not use them for ads or model training.

Turn cloud AI off any time in Settings. With it off, no clip content leaves your device for AI processing.

We collect coarse, enumerated buckets to understand how the product is used — never free text, never clipboard contents.

• Collected: page views, signups, downloads, checkout/billing milestones, onboarding funnel steps (by screen id, not content), and coarse in-app engagement (e.g. “a text clip was copied”, “an AI action ran”) — all length-capped buckets.
• Never collected: clipboard contents, file paths, window titles, AI prompts/results, personal data, or error stack traces (errors are a short code).
• Default: product analytics is on by default in the desktop and mobile apps (coarse events only — never clip content).
• Off switch: Settings → “Anonymous product analytics” (desktop) or “Anonymous analytics” (mobile). The opt-out is checked in the app before any network call, so “off” means off — no events leave your device, and the server cannot opt you back in.
• Crash reports are a separate, opt-in toggle (off by default). A local log is always written for self-diagnosis; remote reports, when you enable them, contain error text, version, and platform — never clips.

We welcome independent review of our end-to-end encryption (algorithm choices, key wrapping, and on-device key storage), the sync pipeline (encrypt-before-write, decrypt-after-read, encrypted file offload), cloud access rules (each account scoped to its own data), telemetry boundaries (no clip content, client-side opt-out), and Pro billing gates. The trust boundary is your device: inside it, plaintext and keys; outside it, ciphertext and envelope metadata only. Contact us if you need the detailed protocol specification for an audit.

Because all content is end-to-end encrypted, the sync backend is a “dumb” encrypted store: it holds ciphertext and routes change notifications, and never needs to decrypt anything. That means a self-hosted relay operator cannot read user data even when they run the relay themselves. A self-host relay needs only four things: an encrypted per-user document store with realtime change notifications, an encrypted blob store for files/images, auth scoped to each user's own path, and optional server-side retention enforcement. Today the relay is Firebase-managed (Firestore + Cloud Storage + Functions + Auth), serving purely as the untrusted store. A reference self-host relay with a pluggable storage backend is on the roadmap; because the crypto layer is independent of transport, swapping relays is a transport change, not a security re-architecture. Until then, users who need fully self-hosted infrastructure can keep cloud sync off — local-only history never leaves the device.

• We do not read your clipboard for ads, product analytics, or model training.
• We do not routinely scan clipboard contents — capture stays on your device unless you enable Pro cloud AI.
• We do not sell or rent your data to third parties.
• We do not use your clipboard data to train models.
• We do not show advertising.
• We do not receive your password — Firebase Auth manages sign-in.
• We do not see your card number — Stripe handles payments.

• Delete individual items or your entire history from the app.
• Export your history from Settings → Data.
• Set automatic retention limits by days and item count.
• Disable sync, sign out, or request full account deletion.