Privacy policy

Clippy copies what you copy on one of your devices to your other devices. This page explains what that involves, what is stored, for how long, and what you can do about it. This service is run by Karam.

What is stored on the Clippy relay

• Your account: your email address and a hash of your password (we never store the password itself).
• Your sign-ins: which app signed in (for example “Web dashboard”), when, and when it was last used, so you can see and end them on the Account page.
• Your devices: the name you gave each one, its platform, the Clippy version it runs, when it was last connected, and whether it sends and receives clips.
• Clips on their way: the content you copied, its type and size, which device sent it, and when. The relay keeps a clip only until your other devices have received it, plus about 10 minutes, and never longer than 24 hours.
• Usage counts: how many clips each device sent per hour, by type (text, image), and their size. These contain no clip content. They power the Overview page and are kept while your account exists.
• Where: the relay runs on Cloudflare (Workers and Durable Objects), which stores the above for the operator. Cloudflare can restore that storage to any moment in the last 30 days, so its recovery copies can hold anything above, including clips that were waiting to be delivered, for up to 30 days.

Encryption

Clips travel encrypted between your devices and the relay when the service uses HTTPS. They are not end-to-end encrypted: while the relay holds a clip, the operator's systems could read it. Avoid syncing passwords and other secrets. On Windows, Clippy skips anything a password manager marks as sensitive.

What stays on your devices

Each device keeps its own clipboard history (50 clips by default, which you can change). Reading text in images happens on the device itself. Deleting a clip or clearing the history on one device does not affect your other devices. Files copied on one computer are saved on your others in Downloads/Clippy, where they stay until you delete them; phones keep received files inside the app until you save or delete them.

IP addresses and logs

The relay uses your IP address to limit repeated sign-in, sign-up and password reset attempts, and keeps it for that purpose for at most an hour. Cloudflare, which runs the relay, and Vercel, which hosts this dashboard, keep request logs that include IP addresses.

Password reset emails

If you ask for a password reset, the link is emailed to you through Resend, an email delivery service, which receives your email address and the message for that purpose. The link works once and expires after an hour. Nothing else is ever emailed.

Cookies

The dashboard sets two cookies: one keeps you signed in, and one remembers your time zone so charts show your own days. There are no advertising or analytics cookies, and Clippy does not use third-party trackers or share your data with advertisers.

Your choices

• Turn sending or receiving off for any device, or pause syncing, at any time.
• Remove a device, or sign out other sessions, on the dashboard.
• Delete your account on the Account page. This immediately deletes your account, devices, sessions, clips waiting for delivery and usage counts. Cloudflare's recovery copies of them disappear within 30 days.

Children

Clippy is not meant for children under 13.

Changes and contact

If this policy changes, the date at the top changes too. For questions or requests about your data, email [email protected].