Privacy Policy

Last updated 8 August 2026.

What the service itself collects

Nothing that identifies you, and nothing that can be read. There is no account, no email address, no password and no profile. What you copy is encrypted in your own browser with AES-GCM before it leaves the machine, using a key derived from the short session key you type. That key is never sent anywhere. The relay sees only a hash that tells it which room to route a message to, and ciphertext it has no way to open.

Messages are held in memory for the moment it takes to pass them on and are not written to disk. Files never reach the server at all — they travel directly between your devices over WebRTC. Closing the tab ends the session.

The relay records aggregate counts by country for the activity globe on the home page. That is a total per country and nothing else: no addresses, no session keys, no record of which devices are paired.

What is stored on your own device

Settings and clipboard history are kept in your browser's local storage, on your device, under a realtimeclipboard. prefix. They are never uploaded. Clearing site data removes them.

Google Analytics

This site uses Google Analytics 4 to count visits and see which pages people reach. It sets cookies and reports the page address, referrer, approximate location, device and browser to Google.

The page address it reports never includes the part after the #. That matters here more than on most sites: a share link carries its session key in that fragment, and following one lands you on this site for a moment before it forwards you to the app. The tag is configured to strip it before anything is sent, so Google does not receive session keys.

Google AdSense

Ads on this site are served by Google AdSense. Google and its partners use cookies and similar technologies to serve and measure ads, and may personalise them based on your prior visits to this and other sites. You can review and change your ad settings at My Ad Center, and opt out of personalised advertising at Google's ad settings.

The desktop app carries no advertising from anyone. Google forbids ads inside software applications, so the Windows, macOS and Linux builds show a promo for this project instead — served from the app itself, reaching no network at all. The same is true of the VS Code extension. Everything below about AdSense applies to this website and to the app in a browser, including an installed one.

Ads also appear in the app in a browser, below the editor. An ad tag is third-party code that runs inside the page it appears on, and in the app that page shows your decrypted clipboard text — so, like any third-party script, Google's tag runs where that content is visible. Your session key is protected separately: the ad request reports the page address, and the app removes the key from the address bar before the ad tag is allowed to load, so the ad never loads while the key is in the address. What you copy is still encrypted in your browser before it is sent, and the relay still cannot read it.

Consent

If you are in the EEA, the UK or Switzerland, a consent dialog appears before any advertising or analytics cookie is set, and everything stays off until you choose. You can reopen it at any time from the Privacy & cookie settings link in the page footer to change or withdraw what you agreed to.

Children

This service is not directed at children under 13 and does not knowingly collect information from them.

Your rights

Because there is no account and no server-side record of you, there is normally nothing to export or delete on request — the material a service would usually hold about you does not exist here. For the analytics and advertising data Google holds, use the Google links above, which reach further than any request to this site could.

Changes

Changes are published on this page with the date above. The site is open source, so the full history of what this policy said and when is in the repository.

Contact

Open an issue on GitHub. Do not include your session key in one.