Privacy Policy

1. Our Privacy Commitment

Cross Paste is built with privacy as a core principle. We use end-to-end encryption, which means your clipboard data is encrypted on your device before it ever reaches our servers. We do not have the keys to decrypt your data.

2. Data We Collect

Data We Can Access:

• Device metadata (device type, OS version) for compatibility
• Usage statistics (number of syncs, not content)
• Account identifiers for Pro subscriptions

Data We Cannot Access:

• Your clipboard contents (encrypted end-to-end)
• Your Recovery Key (never transmitted)
• Decrypted paste history

3. How We Use Data

The limited metadata we collect is used solely to:

• Provide and maintain the Service
• Process Pro subscription payments
• Send critical service notifications
• Improve Service performance and reliability
• Understand how the Service is used through privacy-respecting product analytics (aggregate event counts and feature usage only, never your clipboard contents)

4. Data Sharing

We do not sell your data. Ever.

We may share anonymized, aggregated statistics with partners. We will comply with valid legal requests, but due to E2E encryption, we can only provide encrypted data that we cannot decrypt.

5. Data Retention

Encrypted clipboard data is retained according to your plan. On the Free plan, encrypted items are automatically deleted after 24 hours, though your single most recent item is always kept so your clipboard stays available across devices. On the Pro plan, items are retained until you delete them. You can delete your data at any time through the app.

6. Data Security

We implement industry-standard security measures to protect your data:

• End-to-End Encryption: All clipboard data is encrypted on your device before transmission using strong encryption algorithms
• Secure Storage: Keys are stored using platform-native secure storage (Keychain on iOS, Keystore on Android)
• Transport Security: All data transmission uses TLS encryption
• No Key Access: We do not have access to your encryption keys or Recovery Key

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. International Data Transfers

Your data may be processed and stored on servers located outside your country of residence. Your encrypted clipboard data and account metadata are stored in the United States (Convex), while product analytics are processed in the European Union (PostHog). By using the Service, you consent to the transfer of your data to these locations. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

8. Children's Privacy

The Service is not intended for children under the age of 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at [email protected].

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

General Rights

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Request transfer of your data to another service
• Objection: Object to processing of your personal data
• Restriction: Request restriction of processing

GDPR Rights (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right to be informed about data collection
• Right of access to your data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

CCPA Rights (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information
• Right to access your personal information
• Right to request deletion of personal information
• Right to non-discrimination for exercising your rights

Note: We do not sell your personal information. You can exercise your CCPA rights by contacting us at [email protected].

10. Data Breach Notification

In the event of a data breach that may affect your personal data, we will notify you and relevant authorities as required by applicable law. Due to our end-to-end encryption architecture, the risk of unauthorized access to your clipboard content is significantly reduced, as we cannot decrypt your data even if our servers are compromised.

11. Third-Party Services and Subprocessors

We rely on a small number of third-party subprocessors to operate the Service. None of them can read your clipboard contents, which are end-to-end encrypted before they ever leave your device. Each subprocessor handles only the limited data described below and is bound by its own privacy policy:

• Convex — Backend and encrypted database hosting (United States). Stores your zero-knowledge encrypted clipboard data and account metadata and can never decrypt your content. Privacy Policy
• PostHog — Product analytics, hosted in the European Union (eu.posthog.com). Processes device identifiers and usage/event metadata (such as event counts and feature categories) so we can understand how the Service is used. It never receives your clipboard contents or other personal content. Privacy Policy
• RevenueCat — Subscription management for Pro plans. Privacy Policy
• Stripe — Payment processing for web and desktop subscriptions. Privacy Policy
• Apple App Store — In-app purchases on iOS. Privacy Policy
• Google Play — In-app purchases on Android. Privacy Policy

We do not use third-party advertising networks or cross-site tracking services, and we never sell your data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by:

• Updating the "Last updated" date at the top of this page
• Posting a notice on our website
• Sending an email notification (for significant changes)
• Displaying a notice in the Service

Your continued use of the Service after such changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or wish to exercise your privacy rights, please contact us at [email protected].

For GDPR-related inquiries, you also have the right to lodge a complaint with your local data protection authority.