Privacy Policy

1Controller, scope and summary

App: SkyPaste · Controller: [Your Name or Company Name, full postal address] · Privacy contact: support@skypasteapp.com · Version: 1.0, effective November 2026

SkyPaste (“we”, “us”) is responsible for the personal data described in this Policy. It applies to our mobile, desktop and cross-platform applications and to the support website (together, the “App”).

The App synchronizes the most recent clipboard text between your own devices. We designed it to know as little about you as possible.

In short:

• We collect your email address, a random user ID, your subscription status, an encrypted clipboard item and limited technical data needed to run and secure the service.
• Clipboard text is encrypted on your device before it is sent. We store only ciphertext and only the single most recent item per account.
• We do not sell or share your data, we do not use advertising or analytics trackers, and we do not build profiles.
• You can have your account and all associated data deleted at any time (section 8).
• No system is perfectly secure. We use the safeguards in section 6 and tell you what they do and do not protect.

Key terms

Who this Policy applies to

This Policy applies to everyone who creates an account or uses the App, wherever they live. It does not apply to websites, apps or services of third parties that you reach from the App or from our support page, such as Apple, Microsoft or GitHub. Please read their privacy notices separately.

Our approach to privacy

We follow privacy by design and by default. That means we decide what data the App truly needs before we build a feature, we turn the most protective settings on without you asking, and we remove data when we no longer need it. The clipboard feature is the clearest example: instead of storing your content and promising to look after it, we built the App so that we cannot read it.

2Data we collect

We process only the categories below.

Clipboard limits. Free accounts store up to 550 characters, Pro accounts up to 6,000 characters. A new item permanently overwrites the previous one.

Passwords. The App uses passwordless Magic Links. We never create, receive or store passwords.

What we do not collect

Voluntary provision. Email address and encrypted clipboard data are required to use sync. Without them we cannot provide the service.

How your data moves through the App

1. Sign-up and sign-in. You enter your email address. Our backend creates a random user ID and sends you a single-use Magic Link. When you open it, the App receives a session token that is stored in your device’s secure storage.
2. Copying. When you copy text on one device, the App encrypts it locally and uploads the ciphertext. It replaces the previous item for your account.
3. Syncing. Your other signed-in devices download the ciphertext and decrypt it locally with your key.
4. Subscribing. You buy Pro through Apple or Microsoft. The store tells the App and our backend whether your subscription is active. We never see your payment details.
5. Signing out or deleting. Signing out removes the token from that device. Deleting your account removes your records from our systems as described in section 8.

Technical and log data in detail

When the App contacts our servers, the servers and our providers automatically record a small amount of technical data. We use it only to deliver the service, find faults and defend against abuse.

We do not use this data to track you across other apps or websites, and we do not combine it with data from other companies. We do not attempt to derive your location beyond what is needed to operate and secure the service.

Device permissions

The App needs access to the system clipboard to do its job. It does not request access to contacts, photos, files, location, camera or microphone. On some operating systems, you can restrict clipboard access in the system settings. If you do, sync may stop working.

Data we receive from other sources

We receive subscription status and transaction IDs from Apple and Microsoft. We do not buy personal data from data brokers and we do not enrich your account with data from public sources or social networks.

3Purposes and legal bases

Each purpose has one legal basis. We do not use your data for any other purpose without informing you and, where required, asking for your consent.

Legitimate interests. Our interest is a secure, stable service. We keep the data used for it to a minimum and you may object (section 9). Where you are in Switzerland, processing follows the principles of the FADP (lawfulness, good faith, proportionality, purpose limitation) and does not require a legal basis other than where the law says so.

Consent. Where we rely on consent, you can withdraw it at any time for the future. Withdrawal does not affect earlier processing. If you withdraw consent needed for sync, we can no longer provide the service.

4Recipients and processors

We share personal data only with the service providers below, under written agreements that bind them to our instructions, to confidentiality and to appropriate security.

No sale, no sharing. We do not sell, rent or trade personal data and we do not share it for cross-context behavioral advertising.

Authorities and legal claims. We disclose data to courts or authorities only if a valid legal obligation requires it, and only to the extent required. Because clipboard content is encrypted on your device, we cannot hand over its readable content. Where permitted, we notify you of such requests.

Business transfers. If we are involved in a merger, acquisition or sale of assets, personal data may be transferred under the same protections as in this Policy, and we will inform you beforehand.

5International data transfers

Supabase Inc. is based in the USA, and some data may be processed outside your country. We transfer personal data only where a recognized safeguard applies:

• EEA and UK to the USA: the EU-U.S. Data Privacy Framework and its UK Extension, where the recipient is certified, and otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
• Switzerland to the USA: the Swiss-U.S. Data Privacy Framework where certified, and otherwise the EU Standard Contractual Clauses adapted for Switzerland as recognized by the FDPIC.
• Other regions: contractual safeguards that give an equivalent level of protection, as required by local law.

Where we rely on contractual clauses, we assess the destination country’s legal environment and add technical measures where needed. The strongest of these is client-side encryption: clipboard content reaches the provider only as ciphertext, and we do not give the provider the keys.

You can request a copy of the safeguards we use at support@skypasteapp.com. Commercially sensitive details may be redacted.

6Security measures and encryption

We apply technical and organizational measures appropriate to the risk. No online service can promise absolute security, so we describe what each measure does and what it does not.

Key handling. [Describe in one or two sentences where the encryption key is created and stored, for example generated on the first device and kept in the device’s secure storage, and how it is shared between your devices. State clearly that we cannot recover lost keys, if that is the case.]

Your part. Keep your devices updated and locked, protect your email account, and do not store highly sensitive secrets, such as banking passwords, in the clipboard.

Reporting vulnerabilities. If you find a security issue, please write to [Security Contact Email]. We will acknowledge your report and will not take legal action against good-faith research that avoids harming users.

Organizational measures

• Need-to-know access. Only people who need access to operate the service can reach production systems. Access is reviewed regularly and removed when a role ends.
• Strong authentication for administrators. Administrative accounts of our providers use multi-factor authentication.
• Separation of environments. We do not use real user data for development or testing.
• Confidentiality. Everyone who may come into contact with personal data is bound by a duty of confidentiality.
• Secrets management. Keys and credentials for our infrastructure are kept out of source code and rotated when exposure is suspected.
• Logging and monitoring. We monitor for unusual access patterns and review security events.
• Backups. Backups are encrypted and access to them is restricted.
• Provider diligence. We choose providers that offer recognized security certifications and contractual security commitments, and we review them when their terms change.

Limits of what we can promise

Encryption protects content, not everything around it. If someone gains access to your unlocked device, to the key stored on it, or to your email account, they may be able to read your clipboard content or sign in as you. We cannot prevent this by technical means on our side. For that reason we cannot guarantee that the App is free of all vulnerabilities, and we ask you to keep your devices and accounts secure.

7Data breach notification

We maintain an incident response process to detect, contain and assess security incidents. If a personal data breach is likely to put your rights at risk, we will:

1. Notify the competent supervisory authority without undue delay and, where the GDPR or UK GDPR applies, within 72 hours of becoming aware of it. Under the Swiss FADP the notification goes to the FDPIC as soon as possible.
2. Notify affected users without undue delay where the breach is likely to result in a high risk, and in line with US state breach laws, Canada’s PIPEDA, Brazil’s LGPD and other local rules.
3. Tell you what happened, which data is affected, what we have done and what you can do.

Because clipboard content is encrypted on your device, a breach of our database alone would not expose readable clipboard text. Email addresses and metadata could still be affected.

8Retention, deletion and backups

How to delete your account. Use [the in-app delete option, if available] or email support@skypasteapp.com from the address registered to your account. We may ask you to confirm the request by Magic Link to prevent misuse.

Timeline. We delete your account, profile and encrypted clipboard record from our live systems within 30 days of a verified request. Copies in encrypted backups are overwritten in the regular backup cycle, which lasts up to [35] days, and are not restored for any purpose other than disaster recovery, after which the deletion is repeated.

Anonymization. Where we keep data for statistics or security analysis, we remove identifiers so that it can no longer be linked to you.

9Your rights by region

How to exercise them. Write to support@skypasteapp.com. We may verify your identity through a Magic Link to your registered address. We respond within one month (GDPR, UK GDPR, FADP), 45 days (US state laws, extendable once by 45 days), 30 days (PIPEDA) or 15 days (LGPD), or sooner where local law requires. Requests are free unless they are manifestly unfounded or excessive. An authorized agent may act for you with proof of authority.

Because of end-to-end encryption, we cannot read your clipboard content. Access and portability requests therefore return the encrypted record and account data, which you can decrypt on your own device.

If we refuse a request, we tell you why and how you can complain.

10Complaints and supervisory authorities

Please contact us first so we can try to solve the issue. You always have the right to complain to a data protection authority, in particular where you live, work or where the issue occurred.

11Children’s privacy

The App is not directed at children under 13, or under the higher age of digital consent where local law sets one (for example 14 in Spain and Austria, 15 in France, 16 in Germany and the Netherlands). In Switzerland, minors capable of judgment may consent for themselves, otherwise a legal representative must. Where local law allows it, a parent or guardian may consent for a younger person and is then responsible for their use of the App.

We do not knowingly collect personal data from children below these ages. If you believe a child has given us data, write to support@skypasteapp.com. We will verify the request and delete the data without undue delay.

12Automated decisions, tracking and advertising

• We do not make decisions based solely on automated processing that have legal or similarly significant effects, and we do not profile users.
• The App contains no advertising, analytics or crash-tracking SDKs from third parties.
• The App does not use cookies.
• Apple and Microsoft may process data about your purchases and device under their own privacy policies, which we do not control.

13Changes to this Policy

We update this Policy when the law, our providers or the App’s features change. We publish the new version here with a new effective date. For material changes, such as a new purpose, a new category of data or a new recipient, we notify you by email or in the App at least 30 days before they apply, and ask for consent where the law requires it.

14Privacy principles and governance

We handle personal data according to the principles that all major privacy laws share.

How we stay accountable

• Record of processing. We keep an internal record of what data we process, why, where and with whom.
• Impact assessment. Before we add a feature that changes how personal data is used, we assess the privacy risk and adjust the design. Where the law requires a formal data protection impact assessment, we carry one out.
• Provider management. We conclude data processing agreements with providers, review their security and sub-processors, and stop using a provider that no longer meets our requirements.
• Regular review. We review this Policy at least once a year and after every significant change to the App or our providers.
• Training. Anyone who works on the App receives guidance on handling personal data.
• Complaint handling. We log privacy requests and complaints, answer them within the legal deadlines and learn from them.

15Your choices and controls

You decide how much of the App’s functionality you use and what you place in it.

• Decide what you copy. Only text you copy while the App is running and sync is on is uploaded. Pause sync or sign out before you copy something you do not want to leave your device.
• Sign out. Signing out removes the session token from that device. Sign out on every device to end all access.
• Replace or clear your clipboard record. Each new item replaces the previous one. Copying a short, harmless text overwrites the stored item.
• Update your email address. Contact us if your address changes, and we will update your account after verifying the new address.
• Delete your account. You can request deletion at any time (section 8).
• Cancel your subscription. Subscriptions are managed in your Apple or Microsoft account settings. Deleting the App or your account with us does not cancel a subscription automatically.
• Change system permissions. You can restrict clipboard access in your device settings, which may limit sync.
• Choose your email provider. Because sign-in works through email, using a provider with strong security and two-factor authentication protects your account.

You are not required to give us any data beyond what the service needs, and we do not make the service worse for you because you exercised a right.

16Emails and notifications

We use your email address only for messages that the service needs:

• Sign-in messages. Magic Links and related verification emails. These are sent when you ask for them.
• Security and account notices. For example a warning about suspicious sign-in attempts, a notice about a data breach or a change to your account.
• Service and legal notices. Material changes to this Policy or to the terms of the service.
• Support replies. Answers to questions you send us.

We do not send marketing emails or newsletters. If we ever want to, we will ask for your separate consent first and give you a one-click way to unsubscribe. Service and security messages cannot be turned off while you have an account, because they are part of the service.

Be careful with Magic Links: they work like a password. Do not forward them, and do not open them on a device you do not trust. We will never ask you for your password, your encryption key or the content of your clipboard by email.

17Requests from authorities

We handle requests from courts, police and other authorities as follows:

1. We check that the request is valid, issued by a competent authority and limited to what is necessary.
2. We challenge requests that are too broad, unclear or unlawful, and we disclose only the minimum data that the law requires.
3. We tell the affected user about the request unless the law or the authority forbids it.
4. We keep an internal record of such requests.

What we can provide is limited by our design. We hold your email address, user ID, subscription status, technical logs and the encrypted clipboard record. We cannot decrypt your clipboard content, and we do not have your key. We do not create backdoors or weaken encryption on request.

If you want to know whether we have received requests, contact us. Where permitted, we publish a summary of requests received in a given year on our support page.

18Region-specific notices

European Economic Area, United Kingdom and Switzerland

• We process data only where one of the legal bases in section 3 applies.
• Where we rely on legitimate interests, we weigh them against your rights and freedoms, and you may ask for details of that assessment.
• You can object to processing based on legitimate interests at any time. We then stop unless we can show compelling grounds, or the data is needed to protect or defend legal claims.
• Where the provision of data is required to use the service, we say so in section 2.
• For people in Switzerland, we also follow the FADP principles of transparency, purpose limitation, proportionality and data security, and we report breaches to the FDPIC as described in section 7.

United States: notice at collection

This table covers the last 12 months and applies to residents of California and of other states with similar laws.

We do not sell or share personal information, we do not use it for targeted advertising, and we do not use or disclose sensitive personal information for purposes other than those permitted by law. We do not knowingly sell or share the data of anyone under 16.

Shine the Light. California residents may ask once a year which personal information we disclosed to third parties for their direct marketing. We make no such disclosures.

Nevada. We do not sell covered information as defined by Nevada law. You may still send an opt-out request to support@skypasteapp.com.

Canada

We obtain your consent when you create your account and use the App. If we process your data for a new purpose, we ask again. Our processing is limited to what a reasonable person would consider appropriate. In Quebec, you may request information about the technology we use, and you may ask us to stop disseminating your data or to deindex it, where the law provides these rights. Your data may be processed outside Canada, as described in section 5.

Brazil

Our contact for questions under the LGPD is in section 19. You may request a clear and complete declaration about the processing, and you may ask for a review of any decision taken solely on automated processing. We do not take such decisions.

Australia

We handle personal information under the Australian Privacy Principles. We take reasonable steps to ensure that overseas recipients of your information, such as Supabase, protect it consistently with the APPs. If a breach is likely to cause serious harm, we notify you and the OAIC under the Notifiable Data Breaches scheme.

Japan, Singapore and South Korea

We use your data only for the purposes in section 3, we take security measures proportionate to risk, and we ensure that overseas transfers are protected as described in section 5. You may request disclosure, correction, suspension of use or deletion, as the APPI, the PDPA or the PIPA provide. In Singapore, you may withdraw consent by contacting us, and we tell you the consequences of withdrawal.

Other countries

If you live in a country not listed, the data protection law of that country applies to you where it is relevant, and we honor the rights it grants. Contact us if you are unsure.

19Contact and representatives

We aim to reply within 5 working days. Statutory deadlines in section 9 apply to formal rights requests.

20Language, interpretation and governing law

This Policy is written in English. Translations are provided for convenience, and if they differ, the English version prevails unless local law requires otherwise. Headings are for orientation and do not limit the meaning of the text.

If a part of this Policy is found to be invalid, the rest remains in force. Mandatory data protection rights in your country always apply and are not limited by this Policy. Nothing in this Policy takes away rights that you have under consumer protection or data protection law.

This Policy is governed by the law of [Country of the controller], without affecting the mandatory rights of consumers and data subjects in their country of residence.

Impressum

Legal notice for SkyPaste.

Provider: [Name or company name]

Address: [Street and number, postcode and city, country]

Email: support@skypasteapp.com

Represented by: [Name of the authorized person, if a company]

Commercial register or UID number: [Entry or number, if applicable]