Every security feature is free. Forever.
Copywarden is a security product, and trust in a security product has to rest on something sturdier than marketing. This page is our permanent, public commitment about what is free, what we charge for, what you can verify without trusting us — and why none of it will quietly change later.
The parts of Copywarden that protect your data are free — not a trial, not a teaser, but the complete security feature set, permanently:
Encryption at rest
Every clipboard item is encrypted with AES-256-GCM before it touches disk.
Per-item key derivation
HKDF-SHA256 per-item keys from a random 256-bit master key (RFC 5869), so no two items share a key.
Secure Enclave key wrapping
On capable Macs the master key is stored wrapped by a non-extractable Secure Enclave key; Macs without one keep it in the Mac's data-protection keychain, device-local and unlock-gated. If macOS refuses that keychain, the key is kept in the login keychain without those limits, and Settings → Security → Key storage says so.
Secret detection and redaction
On-device scanning for credentials, tokens, and keys, with unconditional masking in previews.
The agent chokepoint
AgentAccessGuard — the single gate every automation surface must pass through. It never serves a detected secret, honors a kill-switch, and audits every access.
The tamper-evident audit log
HMAC-chained, so security-relevant events cannot be silently rewritten.
Off switches for sync and agents
Sync stays off until you choose Copywarden Account or iCloud. One switch turns off Shortcuts and AI-agent access. Automatic update checks (direct download), usage data and crash reports each have their own switch too.
Screen-share detection and redaction
Detection of active screen capture and recording, and the preview redaction it triggers.
If a capability decides whether your clipboard data is safe, it belongs on this list, and it is free. You will never pay Copywarden for the security of your own data.
What we charge for
Copywarden is a business, and we'd rather fund it with prices on a public page than with your data. Paid tiers cover the things that go beyond securing the data on your own Mac:
Sync and the Copywarden Account
End-to-end encrypted sync (beta, off by default) across your devices, and the account infrastructure behind it.
Compliance operations
The tooling around regulated deployments. Shipping today: tamper-evident audit-log export (JSON/CSV) for compliance review, and MDM-delivered admin policy. Being designed with our first team deployments, and not yet available: SSO/SAML, SCIM provisioning, and shared team pinboards.
Pro conveniences
On-device AI search and compliance retention profiles, per the published pricing page.
If Pro ends, a compliance mode you turned on keeps deleting clips on its schedule, and you can turn it off at any time. Its badge, Compliance Status, extra detection and automatic logoff pause until Pro is back, and the app tells you once when they do.
The pattern: the security of one person's data on one Mac is free. Multi-device, multi-person, and fleet operations are the business.
No bait and switch
The last few years taught software users a specific lesson about promises: communities were built on a generous deal, and then the deal changed. HashiCorp relicensed Terraform in 2023, Redis changed its license in 2024, Elastic did it in 2021 — and each time, the backlash wasn't really about legal terms. It was about the retroactive feeling that the generosity had been bait. A proprietary product's version of that failure is quieter but identical in kind: the free tier that erodes, the feature that migrates behind the paywall, the privacy promise that changes without a dated notice. We are writing this down precisely so you do not have to take our word for it later:
1. Security features never move from Free to paid
Every capability on the list above stays in the free tier, and new capabilities that decide whether your data is safe join the free tier when they ship.
Revised 2026-09-25. This list used to include "Local-Only mode", one switch that did several jobs. We replaced it with a separate switch for each job: sync (Copywarden Account, iCloud or Off), Allow Shortcuts and AI agents, and Automatically check for updates on the direct download. All of them are free, and nothing moved to a paid tier. If you used Local-Only mode, the update turned sync, agent access, automatic update checks, usage data and crash reports off for you. The old entry also said sync over your local network kept working. No released version of Copywarden could complete that pairing, so the sentence should not have been there.
2. The free tier is not a funnel with a fuse
No time limits, no item-count caps on the security features, no account requirement to keep using them.
3. Your clipboard is never ours
We never receive what you copy: it is encrypted on your Mac, and synced copies reach us only as ciphertext we cannot read. Usage data — the app version, your macOS version, your Mac's chip, which features you use, and a random identifier that changes every 30 days — is sent only if you turn it on, never includes anything you copy, and is kept for at most 14 days. Crash reports are sent only if you choose to send them, and contain no clipboard content. A message you write in Send Feedback reaches us only when you press Send, with the topic you chose, your email address if you add one and your app and macOS versions. No ads and no data sale, in any tier, free or paid. The product is the business model; your clipboard is not.
Revised 2026-09-18. This clause used to read: "Telemetry-free forever. No analytics, no usage tracking, no ads, no data sale — in any tier, free or paid." We replaced it because an app that cannot see its own crashes cannot fix them for you. Usage data and crash reports are off unless you turn them on, in onboarding or in Settings, and you can turn them off at any time. What did not change: we never receive your clipboard contents, and there are no ads and no data sale.
Revised 2026-09-19. Added the sentence about Send Feedback, a box in the app for ideas and questions. It sends what you type there and your app and macOS versions, and only when you press Send.
Revised 2026-09-23. Send Feedback now also carries the topic you choose. A problem report with the diagnostics report checked opens an unsent draft in your mail app instead of sending anything itself; the direct path still carries no diagnostics.
Revised 2026-09-24. Usage data now names a random identifier that changes every 30 days, which it has always carried and the privacy page already listed. What is sent did not change.
4. If we ever break this pledge, this page is the receipt
Its revisions are dated and published. Quote it against us.
What you can check without trusting us
Copywarden is proprietary software, so we don't ask you to trust the source — we point you at what you can check yourself.
The wire
Local-first and opt-in are network claims, and network claims are testable: point Little Snitch, LuLu, or any network monitor at Copywarden. With sync, usage data and crash reports off, no clipboard data leaves your Mac — what you will see is the signed update check against copywarden.com, unless you turn automatic update checks off, and you can watch that one too. Turn usage data on and you will also see telemetry.copywarden.com; send a crash report and you will see our error-reporting service; send feedback and you will see our backend provider. With sync on, you can confirm that what leaves is opaque ciphertext we cannot read: to Copywarden's servers by default, or to your private iCloud database if you pick that backend.
The signature
Every build is Developer ID-signed and notarized by Apple, so the binary you run is the binary we shipped, unmodified.
The threat model
We publish it — including the residual risks we do not claim to solve — so our claims can be checked against our own stated limits.
The disclosure policy
Our single-shot incident-response policy is published in advance, written before it is ever needed.
And what you cannot check yet
Stated plainly: there has been no independent security audit and no bug bounty. When either exists we will say so here, with a date and a link — and not before.
Holding us to it
Published 2026-07-30 · Last revised 2026-09-25
Revisions to this page are dated, and the changelog is published alongside it. If you believe a security feature has been paywalled, a network claim has quietly changed, or this pledge is being walked back, email security@copywarden.com and say so publicly. We intend this document to be quotable against us. This commitment does not expire.