What Copywarden collects.

1. What Copywarden does not do

No advertising and no data brokering. Your data is never sold, rented, or shared with advertisers or data brokers.

Usage data and crash reports only if you opt in. Both are off until you turn them on, in onboarding or in Settings, and you can turn them off at any time. Neither ever includes anything you copy. Section 3 lists exactly what each one sends and where; section 5 covers crash reports.

Local-first processing. Clipboard capture, secret detection, AI categorisation, and search indexing all run on your machine. The AI models are Apple's on-device models; prompts and clipboard content are not sent to any inference service.

These are commitments about our collection. They are deliberately not phrased as "nothing ever leaves your Mac" — section 3 lists everything that can, so you can check the claim rather than trust it.

2. Clipboard data on your Mac

Clipboard history is encrypted at rest with AES-256-GCM, using a per-item key derived via HKDF-SHA256 from a 256-bit master key. On Macs with a Secure Enclave, the master key is stored wrapped by a non-extractable Secure Enclave key. On Macs without one, it is stored in the Mac's data-protection keychain, device-local and non-syncable, available only while the Mac is unlocked. If macOS refuses that keychain, the key is kept in the login keychain, where those limits are not applied, and Settings → Security → Key storage says so.

Versions after 0.9.7 encrypt the list of your clips the same way. That list holds each clip's identifier, type, size, times, use count, pin state and category label, and the SHA-256 fingerprint Copywarden uses to spot a repeat copy. Version 0.9.7 and earlier store it without encryption, and a later version encrypts it the first time it opens it. No version encrypts Copywarden's settings, which macOS keeps in its preferences store, its audit and compliance logs, the crash reports it keeps for a support request, or a file you export. It also keeps a few small bookkeeping files that hold nothing about your clips.

Revised 2026-10-13: this section did not say what is stored without encryption. One more file can stay unencrypted: a copy of the list that version 0.9.7 or earlier set aside because it could not read it. It stays as it is until you clear all stored data in Settings.

Deleting an item deletes its ciphertext on your Mac. If you sync with a Copywarden Account, it also removes the encrypted copy on our backend, and your other Macs delete theirs when they next sync. What stays there is a record with no content (identifiers, version numbers and timestamps), so that a Mac that was offline still learns of the delete; that record is deleted after 180 days. The history limits and rules you set in History & Storage, and Auto-delete detected secrets, remove clips only from the Mac they are set on, not from our backend or your other Macs. For now, Clear History and Clear all stored data also clear only the Mac you use them on.

Our backend's database is backed up once a day, and on our current plan each backup is kept for about a week, so anything deleted from that database (an item's encrypted copy, its deletion record, or your account) can remain in a backup for about a week; larger items, which are stored as files rather than in the database, are not in those backups.

3. When data leaves your Mac

The complete list for the shipping build. "Default-on" means it can happen without you enabling anything; "opt-in" means it cannot happen until you turn it on or ask for it. Transports that are built but frozen out of the shipping build are not listed, because they cannot carry your data in the app you have.

Clipboard content

Revised 2026-09-27: this list did not name Copywarden's registration with Apple's push service, which the last row now does. Version 0.9.6 registers at every launch, whatever your sync choice; from the next release it registers only while iCloud is your sync choice.

Revised 2026-10-12: the iCloud sign-in check row did not name first-run setup, where selecting iCloud sends the same check, and it did not say that the check also asks whether iCloud is turned off on the Mac. Settings asks both questions. First-run setup asks the second from the next release, and only after the first answers that the Mac is not signed in.

We cannot read clipboard ciphertext on any of these paths, and we cannot read your keys. With a Copywarden Account, our server stores the account key only in encrypted form, locked with your master password or Recovery Key, which we never see. The other keys that travel go only through your iCloud Keychain, which Apple end-to-end encrypts: the iCloud sync key, and, for an account with no master password, its account key backup unless you turn it off.

Copywarden never fetches a link you copied. An earlier version offered a link preview that requested the page, which told that site what you had copied and when, from your IP, without you ever visiting it. That feature was removed rather than restricted: a copied URL is frequently a single-use or capability-bearing token, and merely requesting it can spend it. A link’s title still appears when your browser hands one to the clipboard alongside the URL — read locally, never requested.

Account, licensing, and payment

The account surface is present by default, but no account data leaves your Mac unless you create an account or sign in. Once you do:

Revised 2026-09-27: starting a purchase in the app before your account is linked to a Paddle customer now sends your account's email address to Paddle before the checkout page opens, and the checkout row now says so; managing billing is unchanged.

Your computer's name is listed explicitly because Macs are commonly named after their owner. If that matters to you, rename the Mac before signing in.

Paddle is the merchant of record. Card details are entered on Paddle's hosted checkout and are never seen by, or transmitted through, Copywarden.

Usage data and crash reports

For usage data, our relay does not keep or forward your network address, and it discards anything that is not on the list above before passing the rest on. It also discards the random identifier, so no usage data we keep carries one, and it replaces the time of each event with a random moment in the hour it arrived. Usage data is kept for at most 14 days.

Revised 2026-10-15: from this date our relay discards the random identifier the app sends and keeps only the hour each event arrived in. The app still sends the identifier until an update removes it.

From version 0.9.7, crash reports go through a separate relay on the same host, telemetry.copywarden.com. It passes each report on unchanged, with only the three of the app's request headers that our error-reporting service needs to accept it, so that service sees the relay's network address instead of yours. The relay's code never reads your address and keeps no copy of the report: its log notes each delivery's result and the report's size, nothing from the report or about you, and is kept for 14 days. telemetry.copywarden.com keeps no access log. Earlier versions send crash reports to our error-reporting service directly, so it receives your network address; it is configured not to store it.

Revised 2026-10-03: crash reports from version 0.9.7 go through our relay. This table listed only our error-reporting service, which is still where earlier versions send them.

Updates

The update check and the download both go to copywarden.com; there is no second host. App Store builds update through the App Store instead and do not use this path.

We check so that security fixes reach you, and that is the basis we rely on for it (legitimate interest, GDPR Art. 6(1)(f)). The request carries your IP address, as every web request does; our CDN does not record it (section 7).

Feedback you send

The service that receives it keeps nothing. It emails the message to us, and from there it is handled like the support form in section 7. Leave the email address empty and we cannot reply. With Include the diagnostics report checked on a problem with the app, the window opens a mail draft instead of sending anything itself; what that draft carries is described in section 5.

4. Switches for what leaves your Mac

Each kind of traffic in section 3 has its own control. Sync: Copywarden Account, iCloud or Off; off until you choose. Usage data and crash reports: off until you turn them on. Automatic update checks (direct download build): on until you turn them off; “Check for Updates…” always works. Shortcuts and AI agents: allowed until you turn them off, and then every request is refused before any data is read. Account traffic starts when you create an account or sign in, and stops when you sign out.

These switches are enforced by the app, not by macOS: the direct-download build is not sandboxed. They do not affect macOS or any other app.

Revised 2026-09-25: this section described Local-Only Mode, one switch that did several of these jobs; the switches above replaced it.

5. Diagnostics and crash reporting

Copywarden subscribes to MetricKit, Apple's on-device diagnostics framework. It counts crashes, hangs, CPU and disk exceptions into a local tally, and keeps the crashing call stack in a file on your Mac. A crash report is sent only if you choose: with crash reports turned on, Copywarden sends one to our error-reporting service the next time it starts after a crash; with them off, it asks you at most once about the most recent crash and sends it only if you press Send. If our error-reporting service does not confirm that report within about 10 seconds — because your Mac is offline, for example — Copywarden tries to send it again on later launches, up to five more times, without asking you again; no other report is sent this way. It stops trying if you use Clear all stored data, if you turn crash reports on and then off, or once the report is no longer one of the three crashes kept on your Mac.

What is kept from a crash, and only this: the call stack (function addresses and our own binary's names), the Mach exception type and code, the signal number, and the app version that crashed. At most three crashes are retained, each capped in size, oldest dropped first. What is deliberately not kept, even though Apple hands it to us: the crash's device metadata, the termination reason, the virtual-memory region description, and any Objective-C exception message. Those are free-form text written by the OS, and free-form text is how a leak happens.

Those stacks travel only when you send them: they are shown in full in Settings ▸ About ▸ Export Diagnostics, and included in the mail draft that Report a Problem… prepares when Include the diagnostics report is checked — prefilled, unsent, in your own mail app, for you to read, edit or delete before pressing Send.

Two things this does not promise, stated because "zero crash tracking" would be wrong. Apple's own crash reporting still applies, governed by your macOS Share Mac Analytics setting — a system-level choice, not something Copywarden turns on or off. And on Mac App Store builds, Apple provides us aggregated crash reports through App Store Connect, as it does for every App Store app. These come from Apple, not from code in Copywarden, and are aggregated rather than tied to you.

6. Website launch list

For visitors to copywarden.com who join the launch notification list, we store: your email address, when and on which page you signed up, the exact consent text you saw, and a salted hash (never the raw value) of your network address as consent evidence. Purpose: sending you one email when Copywarden Pro launches. Legal basis: your consent (GDPR Art. 6(1)(a)), given by pressing the join button, with double opt-in. Unconfirmed signups are deleted after 7 days.

Retention: deleted within 30 days after the launch email is sent, or 3 years after signup — whichever comes first. After deletion we keep only a hashed suppression entry so we never email you again by mistake. A future newsletter would be a new purpose: we would ask again, never repurpose this list.

Withdrawing consent: the launch email carries a one-click unsubscribe (RFC 8058), so your mail client's built-in "unsubscribe" removes you in a single action — no login, no confirmation step. The same link is clickable directly, and the email also lists unsubscribe@copywarden.com as an alternative. Unsubscribing records only the date it happened; the link identifies you by an opaque, signed reference to your list entry, never by an email address in the URL.

7. The website and the update feed

Page visits. The website may count page visits with a cookieless analytics tool. It sets no cookies, stores no persistent identifier, and cannot follow you to another site. It does not profile visitors or run advertising trackers.

Server records. Our CDN records the requests it serves, so that we can count how many people download the app and see when something 404s. Those records deliberately do not include your IP address, any cookie, the query string, or the page you came from — the log is configured field by field, and the omitted fields are the ones that would identify you. What remains is the date and time, the file requested, the response status and size, and the browser or updater user agent. Records are deleted after 30 days. A live copy of the same records, reduced further — the query string removed, the user agent replaced by a type such as "browser" or "app", and addresses of pages the site never had replaced by a count — goes to our monitoring service for our status dashboard and is kept for at most 14 days.

The practical consequence, stated plainly because it is the point: we can tell you how many times the app was downloaded, and we cannot tell how many people that was, or which of them was you. A request is not a person, and nothing in these records links one to the other.

The support form. If you write to us with the form on the support page, what you enter — your email address, the topic you pick and your message — is sent to us as an email, with your address as the one we reply to. The form stores nothing itself: no database entry, and your network address is held only in memory, for up to an hour, to slow down floods of messages. After that it is an email like any other you send us: our mail system deletes its copy of incoming messages after 90 days, and the copy in our support inbox is kept for as long as we need it to answer you and any follow-up. Purpose: answering you. Legal basis: our legitimate interest in replying to a message you chose to send (GDPR Art. 6(1)(f)).

8. Recipients

Processors and third parties that may receive data described above, by role. The named provider behind each role is in our sub-processor list, available on request from privacy@copywarden.com.

9. Your rights

Under GDPR you may request access, correction, deletion, export, or restriction of your personal data, and may withdraw consent at any time. Clipboard content is encrypted with keys we do not hold, so for that data deletion is something you perform on your device. You also have the right to complain to your data-protection authority.

Deleting your account is something you do yourself, in the app: Settings › Account & Sync › Copywarden Account › Delete Account. It takes effect immediately and cannot be undone. It erases the encrypted clips we hold for you, your device list, your profile, your entitlement record and your sign-in. Our backend's database is backed up once a day, and on our current plan each backup is kept for about a week, so anything deleted from that database (an item's encrypted copy, its deletion record, or your account) can remain in a backup for about a week; larger items, which are stored as files rather than in the database, are not in those backups. It does not touch the clipboard history stored on your own Mac, because that is yours and we cannot read it — to erase that too, use Settings › History & Storage › Clear all stored data. Clips already synced to your other Macs stay there until you clear them on those machines. If you have a paid subscription, cancel it first: billing runs through our payment provider and is not cancelled by deleting your account.

Privacy requests: privacy@copywarden.com. Security disclosures: security@copywarden.com. See also the threat model and the security architecture.