Privacy policy

Public draft and operator

Last revised October 23, 2026. This public draft covers the Pastefrog website, account service, and clipboard apps. Pastefrog is operated by an individual based in the Philippines, not a corporation. That individual is the personal information controller for the account and service processing described here. Contact support@pastefrog.app.

The operator's full legal name and mailing address have not yet been supplied. Provider arrangements, processing locations, and retention periods also need confirmation before launch. This draft is not a statement of completed legal compliance.

The clip handling, plan allowances, export, and deletion rules below are Pastefrog's product commitments. They are not confirmation that every capability is available in a current release. Current sync limits each encrypted operation to 2 MiB. Support for every advertised clip format, on-device text recognition, export, account deletion, and deletion across all devices still require release verification. These current limits do not change the promised plan allowances.

Clip encryption

Pastefrog's encryption commitment covers clip contents, including text, images, files, file names, links, and rich content. Devices encrypt clips before sync and encrypt local history. The relay stores ciphertext and routing metadata rather than readable clip contents. Search and text recognition are intended to run on your device.

Linked devices can read your clips. Protect those devices and your recovery key. If you lose every linked device and the key, you cannot recover your encrypted clips.

Local assistant access

Pastefrog has no built-in AI model and does not automatically upload clips to an AI provider. Optional local read-only assistant access starts disabled each launch and requires your explicit approval. If you enable it, the connected assistant can retrieve sensitive clipboard history and send retrieved text to its provider under that provider's policies.

You can revoke assistant access to stop future retrieval. Revocation cannot recall content the assistant or its provider has already received.

When capture begins

Pastefrog's capture policy requires sign-in, trusted device linking, and the required device permissions before capture begins. Sign-in alone does not unlock encrypted clips. Copies made before setup finishes are not imported. After setup, supported copies sync to linked devices, including passwords and codes. Pastefrog does not detect or filter sensitive copies.

Your phone's operating system controls clipboard access. On iPhone, Pastefrog or its keyboard reads a copy when it next opens. On Android, use the keyboard, app, or other clipboard controls described in the help guide.

Latest clip and history commitments

Free and the one-time Sync license keep the latest clip only. Each new copy replaces the previous clip on the server and your devices. The latest clip does not expire.

Pro includes 25 GB of encrypted saved history across 10 devices; Max includes 100 GB of encrypted clipboard storage on unlimited devices. Both subscriptions retain history while active, support restore, and have no per-clip size cap.

If you cancel, paid history stays until the paid period ends. Pastefrog then deletes history and pins from the server and every device. If a trial ends without a paid subscription, history and pins are deleted immediately. Latest-clip sync continues.

A failed payment has up to 7 days of grace, and history keeps saving during that time. If payment is not restored in time, Pastefrog deletes history and pins. Latest-clip sync continues. Read the history guide.

These deletion commitments apply to the service and linked devices. Offline devices apply deletions when they reconnect. They do not promise remote erasure of content already pasted, exported, or otherwise copied outside Pastefrog.

Pro's storage commitment provides archiving and 30 days' notice before quota-related deletion at 25 GB. Detailed archive behavior and the policy when Max reaches 100 GB remain undecided. These quota questions do not change the separate subscription-end rules above.

Account and service data

The account service supports email codes and Google sign-in. Account records can include your email address, verification status, name, profile image, and account identifiers. Authentication records can include provider account identifiers and tokens, sign-in attempts, session tokens and expiry, IP addresses, and browser user-agent details. These records support sign-in, session security, and abuse prevention. They do not provide your clip encryption keys.

Device and delivery records include linked-device identifiers and details, clip sizes and copy times, and the last clip each device received. They support routing, device limits, and delivery status. Purchase records include purchase references, plan, entitlement, and subscription status so Pastefrog can provide the access you purchased.

If you contact support, the operator receives your email address, message, and any information you choose to include. This information is used to answer your request and resolve account or purchase issues. Do not send clip contents, sign-in codes, payment card details, or recovery keys.

Purchase providers process payment and billing information under their own privacy policies. Manage a purchase through its original provider.

Switching accounts clears the previous account's history from that device. It does not transfer those clips to the new account.

Recipients and service providers

The configured hosting integrations use Cloudflare Workers, D1, and Durable Objects to run the website and service and store account, routing, and encrypted service data. RevenueCat is configured to manage purchase entitlements. Billing integrations are configured for Paddle for direct desktop and web purchases, Apple for App Store purchases, and Google for Google Play purchases. Live deployment and the final provider arrangements have not been verified for this draft.

Hosting and entitlement providers process the data needed for their service roles. Purchase providers process billing and payment information and may act as independent controllers for their own legal and payment purposes. Google also receives information when you choose Google sign-in. Email delivery requires a provider to receive the destination address and sign-in message. The email provider and a complete list of provider legal entities and privacy notices still need confirmation before launch.

Linked devices receive your encrypted clips and can decrypt them. An assistant receives content only through the optional access described above. Information may also need to be disclosed to comply with a lawful request or protect legal rights. Any disclosure must have a lawful basis and be limited to what is necessary.

If operation of Pastefrog transfers to a successor, account and service data may need to transfer to continue the service. The successor must inherit Pastefrog's customer commitments. Any transfer must follow applicable privacy law and notice requirements.

Purposes and legal bases

Where applicable law requires a legal basis, account access, clip delivery, and purchased entitlements rely on processing necessary to provide the service you request. Required tax, accounting, or lawful disclosure records rely on applicable legal obligations. Proportionate service security and abuse prevention may rely on legitimate interests where the law permits and after considering your rights.

Optional processing that requires consent must rely on valid consent that you can withdraw. Withdrawing consent does not undo earlier lawful processing. Device permissions and acceptance of terms do not provide blanket consent for unrelated uses of your data.

The Philippine Data Privacy Act applies according to its scope. Additional rules apply to sensitive personal information. If European or other privacy law applies to your use, its conditions and rights also apply. Before launch, the operator must confirm the legal basis for each actual processing activity, including any sensitive information. This draft does not claim that every jurisdiction's requirements have been met.

Export and account deletion

Pastefrog commits to export at any time on every plan. Free and Sync can export the current clip. Pro and Max subscribers can export retained history. Export anything you want to keep before history expires or you delete your account.

The account deletion commitment is one account-wide action in the app that deletes the account and its Pastefrog data and unlinks its devices. Desktop and web checkout subscriptions are cancelled as part of deletion. App Store and Google Play subscriptions require cancellation in the originating store. Until the deletion flow is verified in your release, email support@pastefrog.app to request deletion or help. Read the account guide.

Deleting a clip is intended to delete it across linked devices. Removing only a local copy is a separate action. Offline devices apply deletions when they reconnect. Unlinking blocks service access immediately, but cannot retract content or keys the device already received.

Account, support, security, and transaction records need retention periods tied to their purposes and applicable legal duties. Those periods, backup expiry, and the handling of residual deleted data have not yet been finalized. Deletion is not a promise of immediate physical erasure from backups. Any required retention must be limited to its lawful purpose. Purchase providers may retain their own records under their policies and legal obligations.

Cookies and browser storage

The informational pages use system fonts and include no analytics or advertising scripts. They do not set tracking cookies. Account sign-in uses essential cookies and browser storage for authentication and purchase continuity.

Cookies are small records your browser sends with requests. The account service's __Host-pastefrog-scope cookie binds a browser to its sign-in session. It is configured for 30 days with Secure, HttpOnly, and SameSite=Lax protections. Google sign-in also uses short-lived sign-in cookies, including a five-minute browser-binding cookie.

Session storage holds the pending Google sign-in attempt and purchase return information. Local storage records when browser sign-out has not been confirmed. These records help prevent a cancelled or incomplete sign-in from restoring access unexpectedly.

You can block or clear cookies and site storage in your browser. This can interrupt sign-in or purchase return handling. Clearing browser storage does not delete your Pastefrog account or cancel a subscription. Google and purchase-provider pages have their own cookie and privacy practices.

A page visit sends a normal network request to the website's host. The host may process request information such as your IP address and browser details to deliver the page.

Security and international processing

Clip encryption protects content during sync, but does not hide account and delivery metadata or protect an unlocked linked device. No service can promise absolute security. Keep devices, linking codes, and recovery keys secure, and contact support if you suspect unauthorized access.

The operator is based in the Philippines. Hosting, authentication, payment, and other providers may process data in other countries. The actual processing regions, provider contracts, and any required international-transfer safeguards remain unconfirmed. This draft does not claim that standard contractual clauses or other transfer arrangements are in place. Those details must be resolved and disclosed before launch.

Privacy questions and data requests

Email support@pastefrog.app for a privacy question or data request. Identify your account and describe the request without sending clip contents or recovery keys. The operator may need proportionate identity verification before releasing or changing account data. Requests must be handled within the periods required by applicable law, with an explanation of any lawful limit or refusal.

Subject to applicable conditions and exceptions, Philippine rights include being informed, access, correction, objection, erasure or blocking, data portability, and seeking damages. You can complain to the Philippine National Privacy Commission under its complaint procedures. Other applicable laws may also provide restriction, consent withdrawal, portability, or complaint rights with your local authority. These rights are not limited by this policy.

Pastefrog cannot decrypt server-held clips to answer a request for their readable contents. That limitation does not remove your rights over account information or the product commitment to export through your devices.

Policy updates

Changes to this policy will carry a new revision date. Material changes require a clear notice before they take effect and any consent required by law. A policy update does not withdraw purchased-feature or deletion commitments.