Privacy Policy

1. Overview

DPaste is a local-first clipboard manager. Recording, searching, pasting, pinning and screenshot annotation all happen on your device, and no account or sign-in is required.

This policy covers three things separately: (1) the desktop app, (2) the Android app and (3) this website. Where a feature exists on only one platform, we say so explicitly.

We believe the less we know about you the better for both of us: apart from the ordinary network requests made when you check for updates, we do not collect your data, and we never read your clipboard contents.

2. Data stored on your device

The following data exists only on your device and is not accessible to us:

• Desktop clipboard history is kept in a local database: on Windows at %APPDATA%\com.sgtx.dpaste\data\.data\.history, on macOS inside the data directory under ~/Library/Application Support/com.sgtx.dpaste.
• Images, files and annotated screenshots on desktop are stored in the images / files subdirectories of the same data folder.
• On Android, history is kept in the app-private database and app-private storage, which other apps cannot read and which is removed when you uninstall DPaste.
• Default retention: single items are limited to 10 MB, history is kept for 365 days by default, and expired items that are not starred are cleaned up automatically. All of these limits, plus clearing your data, are under your control in Settings.
• Sensitive content filter (desktop, off by default; enable it yourself in Settings): runs entirely on your device. When content matches a Windows system sensitivity marker (for example the marker a browser writes when copying a password), a content pattern (private-key blocks, JWTs, common secret prefixes, credential assignments, high-entropy strings) or one of your own keyword / regex rules, that item is discarded outright — it is not written to the database, no associated images or files are saved, and no follow-up processing runs. Switches and rules are available under Settings → Data Management → Data Safety; logs record only the matched category and the source app, never the content itself. If copy notifications are enabled, a brief "privacy content skipped" toast appears when something is blocked (at most once every 3 seconds).

3. Sync features (optional, local network only)

DPaste syncs over your local network only: the desktop and Android apps transfer content directly between each other on the same LAN. Devices find each other via mDNS and connect over TCP; payloads are encrypted with AES-256-GCM using keys derived at pairing time via X25519 ECDH + HKDF, and those keys exist only on your paired devices.

Cloud sync is not used: your clipboard content, images and files are never uploaded, stored or relayed to our servers or to any third-party cloud. Everything stays on your devices and on the devices you have deliberately paired and authorised. Unpairing clears the pairing keys stored on your devices.

4. Anonymous usage statistics (discontinued; nothing is collected)

The desktop app previously included an anonymous usage statistics mechanism to gauge release quality and feature usage. The reporting service behind it has been shut down, so the mechanism is now discontinued: no usage data is received or stored on our side, and no endpoint exists that could receive it.

• Statistics reporting is off by default: a fresh install starts with it disabled, and existing installations are switched off during upgrade. While disabled, the client neither records local usage statistics nor makes any reporting request; no switch for this is exposed in the app.
• Fields that were designed historically (none of which are collected now): date, app version, operating system platform, a random device identifier generated locally (not a hardware serial, and not usable to identify you), window reveal count, paste count and clipboard item count.
• What is never reported, in any case: clipboard contents, source app names, search terms, file contents, account information or anything that directly identifies you.
• Users still on older versions may see the client attempt to contact that endpoint as before; those requests never contain clipboard contents, and because the service is down nothing is received or stored.
• If any form of usage statistics is ever reintroduced, we will update this policy first, state the fields and purposes, and provide a switch in the app (preferring off-by-default or prior consent).
• The Android app contains no analytics component.

5. System permissions and why they are needed

Clipboard management requires the following capabilities. Each one is used only for the purpose stated here:

• Windows global keyboard monitoring: used solely to detect global gestures such as double-tapping a modifier key to summon the panel, and to inject paste actions. Your keystrokes are neither logged nor stored.
• Clipboard monitoring: the desktop app polls the system clipboard sequence number for new content; on Android a foreground service (with a persistent notification) monitors the clipboard while the app is active.
• Screen capture: the screen is captured through system APIs only when you trigger a screenshot yourself.
• Launch at startup: optional, so the app is ready in the background; on Windows this uses the current user’s startup registry key and can be disabled in Settings.
• macOS Accessibility permission: used only to paste into the app you are working in.
• Android image media permission: used to detect new screenshots in the system screenshot folder and add them to your history.
• Optional Shizuku / Accessibility service on Android: used to recognise copy actions in the background. It only observes clipboard changes and copy actions, and never reads text input fields.
• Optional Android permissions: overlay windows, SMS reading (off by default, used only to auto-fill verification codes) and installing apps (used for APK self-updates).

6. Network activity and third-party services

Network activity is limited and predictable. Every external service, its purpose and what is transmitted:

7. Advertising and promotion

DPaste currently shows no promotional slots and no third-party advertising. We do not use your data for ad targeting, and we do not provide your data to advertisers or promoters.

8. This website

This website, including this page, is a purely static site with no accounts and no collection of anything you type:

• No cookies, and no third-party analytics, advertising or social tracking scripts.
• Your browser’s localStorage is used only for your appearance preference, language choice and a cache of the last fetched release information, and sessionStorage is used to count self-healing page reloads. This data never leaves your browser and is removed when you clear browser data.
• Latest version numbers and download links are fetched directly from GitHub / Gitee in your browser, so those platforms see your IP address and ordinary request information, subject to their own privacy policies.
• The site is hosted on Cloudflare; access logs may contain IP addresses and request information, used only for security and traffic statistics.

9. Retention, export and deletion

• Local data: you can clear all history, delete individual items, rely on retention-based cleanup, or export a backup (the desktop app can export and import data and configuration; Android supports encrypted export). Uninstalling the app and deleting its data folder erases everything.
• Synced data: unpairing clears the pairing keys stored on your devices, after which nothing is transferred between them; because no cloud storage is involved, there is no server-side copy to delete separately.
• The only data we may hold about you is support correspondence: when you contact us at support@d-paste.com or through WeChat or our QQ group, we keep what you choose to send (email address, message, screenshots) solely to answer you and follow up, and you can ask us to delete it at any time.
• Because there is no account system, there is no account-deletion process; neither the desktop nor the Android app requires registration or sign-in.

10. Your rights

You can do all of the following in the app at any time without asking us: view and export your data, delete some or all of it, unpair devices and uninstall the app. For support email you have already sent us, you may request access or deletion.

11. Children’s privacy

DPaste is not designed for children, and we do not knowingly collect personal information from children under 14. If you believe we have inadvertently retained such information, please contact us and we will delete it.

12. Changes to this policy

This policy may be updated as the product changes. The current version is always published on this page with an updated "last updated" date, and material changes to how data is used will be announced in the app or prominently on this website.

13. Contact us

For any privacy question or deletion request, email support@d-paste.com, or reach us through WeChat or the QQ group listed on our contact page.