Privacy Policy

The responsible party

Who I am

PasteDaemon is built and sold by Armand Halbert, an individual sole proprietor in Illinois, United States. For the purposes of the GDPR and similar laws, I am the data controller for the small amount of personal data described here — which is the order record from a purchase and, if you write in, an email thread. It does not include your clipboard, because that never reaches me.

Contact for any privacy question, request or complaint: hello@pastedaemon.app. I answer these myself.

The part that matters

What the app records

PasteDaemon watches the macOS clipboard and keeps what appears on it, so you can reach back through it later. That means the text, images and file lists you copy are written to a file on your Mac, along with a timestamp and — where macOS reports it — the app you copied from. All of it happens inside the app's own process, on your machine, and none of it is transmitted anywhere.

Text and file lists

Text is stored as text. A copied file list is stored as its paths, which is what makes it possible to paste the same files again later. An entry also keeps its past values, so that a transform which rewrote something can be undone and the original recovered.

Images

A copied image is written as a file of its own inside the app's folder, and read on the way in by Apple's Vision text recogniser so that the words in a screenshot are searchable. That recognition is entirely on-device — Vision is a local framework, no image or fragment of text is uploaded, and there is no cloud recognition option to accidentally enable. The recognised words are stored beside the image, in the same local file as everything else.

Where a copy came from

When macOS makes it available, the app records which application was frontmost when something was copied, so you can search by source and so per-app exclusions can work at all. It is an application identity — a bundle identifier and a name — and nothing else about that app or what you were doing in it.

How long it is kept

Each kind of entry has a retention period you set in Preferences: 24 hours, 7 days, 1 month, 3 months, or unlimited, chosen separately for text, images and file lists. Anything older is deleted from the history and, for images, from disk. The defaults are 3 months for text and file lists and 7 days for images. Pinned entries are kept until you delete them. Clear History and Clear Older Than remove entries immediately, on the spot.

The limits

What it never records

• Concealed clipboard items. When something is placed on the clipboard marked as concealed — the convention 1Password, Bitwarden and other password managers use for a copied password — PasteDaemon ignores it completely. No entry, no past value, nothing on disk.
• Anything from an excluded app. You can name applications whose copies are never recorded, in the General preferences pane. Nothing copied while one of them is frontmost is kept.
• Anything at all, while recording is paused. ⌘T in the overlay, or Pause Recording in the menu bar. The app says so plainly while it is paused, so a paused history is never mistaken for a working one.
• Keystrokes. If — and only if — you have written an abbreviation, the app watches for it with a listen-only keyboard tap: it sees key presses without delaying, swallowing or rewriting them. It holds the last few dozen characters in memory to notice when one of your abbreviations has just been typed, and that buffer is never written to disk, never accumulated into anything longer, and never transmitted. With no abbreviations defined there is no tap at all, which is every install until somebody writes one. macOS suppresses event taps entirely while a password field has secure input on, so nothing typed into one is seen, and nothing typed in an excluded app is read.
• Screen contents. The app has no screen-recording capability and requests no such permission. It reads the clipboard, not your display.
• No microphone, no camera, no location, no contacts, no address book. None of these are requested and none can be accessed.

On disk

What's stored on your Mac

Everything the app keeps lives in ~/Library/Application Support/PasteDaemon/, inside your own user library, readable by you and by software running under your account. Deleting that folder deletes everything.

That is the complete list. There is no hidden database, no usage log, no crash reporter, and no record of what you searched for beyond the pipeline history above — which is yours to clear.

These files are not encrypted, and that is a deliberate, stated choice rather than an oversight: config.json is meant to be read and edited by hand, and a history the app must rewrite after every copy cannot be locked behind a prompt without making the app unusable. They are protected the way the rest of your home folder is — by your account, and by FileVault if you have it on. Turn FileVault on. Secrets are the exception, and are described next.

About your licence key

A PasteDaemon licence key encodes the email address it was issued to, together with a cryptographic signature over that address. The app verifies the signature entirely offline, against a public key compiled into the app. There is no activation server, no device fingerprint, and no network request involved in checking it — not at activation, not afterwards. Your key is stored in your login keychain and used only on your Mac.

The one encrypted thing

Secrets and the vault

A variable whose name begins with ! — $!token — is a secret, and is the one thing PasteDaemon encrypts at rest. Its value is sealed the moment it exists: config.json holds ciphertext, and so does the copy in memory, which is what stops a secret from turning up in a preview, a row or a log line by accident.

• The vault is a P-256 key pair whose private half lives in the Secure Enclave, under an access control requiring you to be present. Reading a secret needs Touch ID or your login password. Writing one does not, because sealing needs only the public half — so a new secret is never sitting around in the clear waiting for you to authenticate.
• Each value is sealed against a fresh one-off key pair, stretched through HKDF-SHA256 into an AES-256-GCM key, so the same secret sealed twice produces two different runs of bytes.
• The private key never leaves the enclave. vault.key is an opaque blob the enclave wrapped and is useless on any other Mac. On a Mac without an enclave, the private half is in your login keychain instead.
• Secrets are not searchable, by value or by name, and are never exposed through the API.
• Deleting vault.key and vault.pub makes every stored secret permanently unreadable, including by me. There is no recovery, no escrow and no backdoor, because there is nowhere for one to live.

The question a careful reader asks

The local API and MCP server

PasteDaemon can serve an HTTP API so that scripts, and AI assistants speaking MCP, can read and change what it holds. This is the most powerful thing in the app and it is worth being precise about, because "a background app with a web server in it" is a reasonable thing to be suspicious of.

• It is off until you turn it on, in Advanced preferences. A default install listens on nothing.
• It binds to 127.0.0.1 and nowhere else. There is no setting that changes this, and it is the binding itself that enforces it rather than a check on incoming requests — so it cannot be pointed at your network by an edit to a config file, deliberately or otherwise. Nothing outside your Mac can reach it.
• Every request needs a key, sent as x-api-key, compared in constant time. The key is generated by you, kept in your login keychain rather than in a plain-text file, and generating a new one revokes the old from the next request onward. With no key generated, the API refuses everything and says where to make one.
• A web page cannot use it. Being on loopback is not authentication — every process running as you can reach the port, and so can any page open in your browser. Replies carry Access-Control-Allow-Origin: null, and the MCP endpoint refuses any request carrying an Origin header at all.
• Secrets are not served. A secret cannot be listed, read, written or deleted through the API, and a request for one is answered exactly as a request for a name that does not exist.
• Nothing runs. No API call evaluates a pipeline, fires a trigger or executes a script action. Changing the rules through the API changes what happens when you copy something; it is never a way to run a command on your Mac over HTTP.
• It talks to nothing. The server accepts connections from your own machine. It makes none of its own, to me or to anyone else, and no part of it reports that it is running or what passed through it.

The MCP server shares that port, that key and every restriction above. When you connect an AI assistant to it, the assistant sees what you have given it access to — your clipboard history, on request — and that is a decision you are making about that assistant's provider, under their privacy policy, not mine. PasteDaemon hands the data to a client running on your machine; where a client sends it afterwards is between you and them. Worth thinking about before pointing a hosted model at a clipboard history.

Automation

Actions that run commands

A script action runs a shell command on your Mac, with your clipboard as its input, and triggers can fire one automatically the moment you copy something. Those commands are yours — the ones you wrote, plus the small standard library that ships with the app, which is visible and editable in the Actions pane.

Two consequences worth stating. First, a command you write can send your clipboard anywhere you tell it to, and if you write one that does, that transmission is yours and this policy cannot cover it. Second, a rules file you import from someone else can contain script actions. Nothing in such a file runs at import time, and the import window lists every rule in it before any of them are added — but a script action added that way will run later, when you invoke it or when a trigger you also imported fires. Read an imported rules file the way you would read a shell script somebody sent you.

Being precise

The one network request

PasteDaemon can make a single kind of outbound request: an update check. It fetches a small JSON file from pastedaemon.app naming the latest released version, compares it to yours, and tells you if a newer one exists.

• It is on by default and runs at most once a day. Security and correctness fixes are worth little if they never reach anyone.
• You can turn it off in Preferences, in one click. With it off the app opens no sockets at all, and you can still check by hand.
• It sends nothing about you. No identifier, no licence key, no clipboard content, no usage data — it is an ordinary anonymous fetch of a public file, the same one your browser would get.
• It is not a usage signal. The file is static and identical for everyone. Nothing on the receiving end counts installs, distinguishes one Mac from another, or knows whether you hold a licence.
• The address is fixed, not a setting. A build that could be pointed at somebody else's feed is a build that can be handed somebody else's app. The switch is whether it is consulted at all.
• The web server sees what any web server sees: an IP address, a time and a user-agent string, in ordinary access logs. These are not linked to you, your licence or any other record, and are not used to profile anyone.

If you choose to install an update, the app downloads the release archive from the same site, checks its SHA-256 against the feed, and verifies its Apple code signature against the exact Developer ID requirement compiled into the copy you are running — so a substituted download fails before anything is unpacked. Updates are never installed silently: you are always asked first.

pastedaemon.app

The website

This site is a set of static pages. It sets no cookies, has no login, no comment box and no form that submits anywhere, loads no web fonts, and does not follow you anywhere.

Two things on the front page are not served from this site, and they are the only two: the demo video, and a visit counter. Neither is on the page you are reading. This policy, the terms and the refund policy load nothing from anywhere but this site — a privacy policy that makes your browser talk to somebody else in order to render is not one I would believe either.

The demo video. It is hosted on YouTube, and an ordinary YouTube embed would contact Google the instant the page opened, whether or not you ever watched it — on the page where I ask you to trust an app that watches your clipboard. So it is not an ordinary embed. Nothing is requested from Google until you click play. Until then the video is a still image and a play button served from this site.

• The demo video, if you play it. Clicking play loads a player from youtube-nocookie.com. From that moment Google receives what any web request discloses — your IP address, your browser and device details, and the address of the page you were on — and YouTube may store data in your browser to play the video and count the view. That is Google's processing, governed by Google's privacy policy, not mine, and I cannot narrow it. Two things I can tell you: the -nocookie host is a different domain from youtube.com, so your YouTube login cookies are not sent with the request; and Google states it sets no personalisation cookies unless the video is played. I have no way to verify Google's side of that, and I would rather say so than repeat it as a guarantee. YouTube shows me aggregate figures for the video — view counts and totals, never who watched. If you would rather not involve Google at all, do not click it: the page loses nothing else, and the same demo is described in words further up.
• The visit counter, on the front page only. It is Cloudflare Web Analytics, and it loads a small script from static.cloudflareinsights.com when the front page opens. It records the page you looked at, the site that sent you, and the broad shape of your browser and device. It sets no cookies and stores nothing in your browser, and it does not follow you between sites — there is no identifier to follow you with, which is the reason I use it rather than one of the alternatives. Cloudflare processes this on my behalf and I see only aggregate totals; their privacy policy governs their side. It is not on this page, the terms or the refund policy. If you block it, the page works exactly as it does otherwise — nothing here depends on it, and I would rather say that than have you find it out.
• Server logs. The host serving these pages keeps ordinary access logs — IP address, timestamp, requested page, referrer, user agent — for security and operational purposes. I summarise them to answer two questions: how many people downloaded the app, and which sites sent them here. The summary is aggregate — totals per page, per referrer, per day — and I do not build profiles from it or share it.
• No pixels, no remarketing, no session recording, no profiles. None of these are present and none are planned. What the counter above measures is how many people arrived and where from — two numbers, in aggregate, about the website. Nothing on this site or in the app measures you, and nothing connects a visit here to a copy you made, a licence you bought or an email you sent. If that ever changes, this page changes first, and any change that materially reduces what is described here will be said plainly on the front page rather than quietly amended in here.
• Outbound links. The checkout is hosted by Lemon Squeezy on checkout.pastedaemon.app; once you follow it, their privacy policy governs what happens there. Other outbound links are likewise governed by the site you land on.

None of this applies to the app. Visiting a website and running the app are different acts, and only the former is counted at all.

Buying a licence

Payments and licences

Purchases are processed by Lemon Squeezy, which acts as the merchant of record. The transaction is legally between you and Lemon Squeezy; they handle payment, fraud checks, invoicing, and sales tax or VAT.

At checkout they collect what a payment processor needs: your name, email address, billing address, country for tax purposes and payment details. Card numbers go to their payment providers and are never transmitted to or stored by me. Their handling is described in the Lemon Squeezy privacy policy.

What reaches me is the order record: your email address, the product, the amount, the date and the tax country. A small ledger on my server records the order and the licence key issued against it, which is what lets me re-send a key you lost rather than issuing you a second one. I use it for exactly three things — issuing your key, honouring refunds, and answering you if you write in. Order records are kept as long as needed to support the licence and to meet tax and accounting obligations, then deleted.

Your licence key is emailed to you through Amazon SES, which delivers the message on my behalf and receives your email address in order to do so. The email carries no tracking pixel and no rewritten links; SES's engagement tracking is switched off deliberately.

• No marketing email. Buying a licence subscribes you to nothing. There is no mailing list.
• Nothing is sold or shared. Your data is never sold, rented or handed to advertisers or data brokers, under any circumstances.
• Your email is inside your key. Keys are tied to the purchaser's address, so that address is encoded in the key itself — which is why keys should not be posted publicly.

When you write in

Email support

If you email hello@pastedaemon.app — for support, a refund, a bug report or a feature request — I receive your message, your address and whatever you choose to include. It is used to answer you and to improve the app, and is stored in the mailbox that handles that address. Threads are kept while they are useful and deleted when they are not.

Please don't paste clipboard contents, screenshots or configuration containing anything sensitive unless it is genuinely needed to reproduce a problem — and if it is, redact it first. A config.json sent as an attachment can contain more than you remember putting in it.

What you can ask for

Your rights

Depending on where you live — including under the GDPR in the EU and UK, and the CCPA/CPRA in California — you have the right to access the personal data held about you, to have it corrected or deleted, to receive a copy, to object to or restrict its processing, and to withdraw consent where processing rests on it. California residents additionally have the right not to be treated differently for exercising these rights; no personal information is ever sold or shared for cross-context behavioural advertising, so there is nothing to opt out of.

In practice the only personal data I hold about a customer is an order record, a ledger row naming the key issued, and possibly an email thread. To exercise any right, write to hello@pastedaemon.app; I will respond within 30 days. Your clipboard history is not among that data and cannot be — it is on your Mac, and deleting it is a matter of deleting the folder named above.

Legal bases

Where the GDPR applies, order data is processed to perform the contract of selling you a licence and to comply with legal obligations around tax records; support correspondence is processed under a legitimate interest in answering customers. The update check relies on a legitimate interest in keeping installed software secure and current — it transmits no personal data beyond the IP address inherent in any web request, and you can object at any time by switching it off.

International transfers

I am based in the United States; Lemon Squeezy and Amazon Web Services are US companies, so order and support data is processed in the US. Lemon Squeezy relies on Standard Contractual Clauses for transfers of EU and UK personal data; details are in their policy.

Children

PasteDaemon is a developer utility, not directed to children, and I do not knowingly collect personal data from anyone under 16. If you believe a child has provided data, write to me and I will delete it.

Security

The design does most of the work: there is no server holding your content, because your content never leaves your machine. What is on your Mac is protected by your user account and by FileVault, with secrets additionally sealed by the Secure Enclave. Order and support data sits with providers using industry-standard encryption in transit and at rest. No system is perfect, but the attack surface is deliberately close to nil.

Complaints

If you are in the EU or UK and unhappy with how I have handled your data, you may complain to your local supervisory authority. I would appreciate the chance to put it right first.

Housekeeping

Changes to this policy

If this policy changes, the "last updated" date changes with it and the revised version is posted here. For any change that materially reduces the protections described above — adding analytics, adding telemetry, transmitting anything about your clipboard — I will say so plainly on the site's front page, not quietly amend this text.

Questions: hello@pastedaemon.app.