Privacy and data — Klippster docs

This page explains the mechanics

The formal privacy statement is at klippster.app/privacy. Where the two differ, that one governs.

#Private Mode

Private Mode is the one switch that stops Klippster watching the clipboard at all. Turn it on from the Klippster menu in the menu bar. While it is on:

Nothing you copy is recorded — no history, no copy preview, and no note of which app you copied from.
Klippster does not read the clipboard in the background. This is not "read it and forget it" — the check that looks at the clipboard is switched off.
The menu-bar icon becomes hollow, so you can see at a glance that Klippster is not listening.
Klippster disappears from Finder's right-click menu — the whole menu, including Copy to Clipboard as and Convert to, which act on a file rather than the clipboard.

That last one is deliberate. Building the menu is what reads the clipboard, so there is no version of it that could be shown without reading; and a menu that was present but quietly different would leave you working out which parts of Klippster are still looking. Absent is easier to trust.

⌘⇧V and ⌘⇧C keep working. They read the clipboard only at the moment you ask them to, which is the opposite of monitoring.

Private Mode stays on until you turn it off, including across restarts. It never resumes on a timer or silently at the next launch.

#On your Mac

Clipboard reading, conversion, file writing and clipboard history all happen locally. Klippster does not upload clipboard contents, conversion inputs, generated files or history — and there is no analytics and no telemetry of any kind, so there is no aggregate version of it either.

What	Where	Encrypted
Clipboard history, and its image and vector sidecars	`~/Library/Application Support/Klippster/history`	No
Installed Format Packs, shared settings, an imported licence	Klippster's App Group container	No

Deleting those two removes everything Klippster has stored locally.

#The four times the network is used

All four are explicit actions. None of them carries your clipboard.

Browsing or installing a Format Pack

Requests the signed public registry and the pack files from GitHub. The hosting provider processes ordinary connection data — IP address, timestamp, user agent. A pack receives only the data you explicitly convert, and has no host imports for network or filesystem access at all. Never open that screen and Klippster never contacts the registry.

Buying Pro

Stripe processes the checkout and the payment. We receive the purchaser email, order identifier, payment state and timestamp needed to issue the licence — not your billing address and not your card details, which stay with Stripe.

Activating a licence, once

Sends the licence credential and a device code. That is the entire payload. No clipboard content, no file content, no usage data. After it, the app never contacts a licence server again.

Updates and the revocation list

Ordinary HTTPS requests carrying nothing about you beyond the connection itself.

#What we hold about a purchase

The website and the licensing service run on our own server at Hetzner in Germany, which processes ordinary server and security logs.

Each time a licence is delivered or activated, we record which licence, when, and by which route. The requesting IP address and browser identification are recorded only as a keyed hash — so a repeated request can be recognised as repeated without the address itself being stored. IPv4 is small enough to enumerate, so an address hash is only one-way while its key is well kept; this one is the licence signing seed, which lives in the environment and therefore never appears in a backup.

That record exists to detect a single licence being handed around, and for nothing else.

#The device code, specifically

It is worth being exact here, because "identifies your Mac" is the kind of phrase that should come with its mechanism.

The device code is 75 bits of a salted hash derived from a macOS hardware identifier, rendered in Crockford base32. It is not reversible. We do not receive your Mac's serial number, and we do not store it. The codes registered to a licence are kept so that you can see and manage your Macs, and so that one purchase is not shared without limit — you can release a Mac at any time.

#Getting a copy of your data

Sign in to your licence page with the address you bought with. There is no password; we send a link. Under Your account:

Download your data as a JSON file — your orders, your licences, the Macs registered to them, and when each licence was delivered.

#Erasing your data

Also self-service, from the same page. We remove your address, your name, the registered Macs and the sign-in links tied to you. Two consequences, so that neither is a surprise:

Erasure ends your licence

Klippster Pro stops working on your Macs, and we cannot restore it or recognise you afterwards, because there will be nothing left to look you up by. Buying again later is fine — it simply starts a new customer with no connection to the old one.

The sale itself stays. Amount, tax, country and date, with nothing in it pointing at you. Austrian bookkeeping law requires those records for seven years, and they are the one thing we cannot remove on request.

Records held by Stripe follow Stripe's own retention rules — ask them directly.

#Your choices

Keep Clipboard History off, change its limit, exclude apps, or clear it at any time.
Do not install optional Format Packs.
Decline the Finder permission — you keep the app and every right-click menu.
Activate a licence without connecting that Mac, using the device code.
Release a registered Mac from your licence at any time.
Delete ~/Library/Application Support/Klippster to remove the history.
Delete the App Group container to remove packs, shared settings and the imported licence.
Download or erase your purchase data yourself.

#How the app is distributed

Public builds are Developer-ID signed, notarized and Gatekeeper-tested, and matched to a SHA-256-verified Homebrew cask. The Finder extension is sandboxed with read-only, user-selected access, and it never runs converter code.