Privacy policy
UniClip – Universal Clipboard sends text between your phones, tablets and computers. This policy says exactly what it stores, who else can see it, how long it is kept, and how to delete it. It describes what the app does today, not what it might do later.
The short version
- The app never reads your clipboard in the background. It only sends the text, photos and files you choose to send.
- You sign in with Google or Apple, and only your own devices can see your clips.
- Usage analytics and crash reports help us fix the app. They never include your clips, and you can turn them off. We do not sell your data.
- Free users see ads from Google AdMob in the phone and tablet app. Pro has no ads, and the web app shows none.
- Free clips disappear after 1 minute. You can delete your account and every clip from inside the app.
What we store
Your account
When you sign in with Google or Apple, Firebase Authentication creates an account. We keep the email address, name and profile photo link that sign-in gives us, when you signed up and last signed in, and your plan.
Linked browsers and the extension
When you link a browser or the Chrome extension by scanning its QR code with the app, we create a separate device account for it. It has no email, carries the name the browser reports (such as "Chrome on Windows") and is tied to your account. Its session stores that name, whether it is a web browser or the Chrome extension, when it was linked and when it was last active. While a QR code waits to be scanned, for at most 2 minutes, we also keep that name and one-way hashes of the code's secrets. If you turn on notifications in a linked browser on Pro, its session also keeps the push token Firebase Cloud Messaging gives that browser, so new clips can reach it. The token is deleted with the session.
Your clips
For each clip: its text, when it was sent, when it expires on Free, its category, the account it belongs to, and the device it came from. That means the device type (Android, iPhone, iPad, web browser or Chrome extension), a description of it (the model and system version on Android, "iPhone" or "iPad" on Apple devices, the browser and system on a computer), and an identifier for the device. The app uses these details to show where a clip came from, and to avoid sending a clip back to the device that sent it. Our servers sort each clip into a category (link, code, phone number, email address or text) from its text.
Photos and files
You can send photos and files of up to 1 MB each on Free, and up to 10 MB each on Pro. We store the file itself, and with its clip its name, type and size, a picture's width and height, and a small preview of a picture. A photo is kept as it was sent, with any details the camera wrote into it, such as where it was taken. A picture some devices cannot show, such as HEIC, is converted to JPEG before it is sent, and one too large is made smaller. We count the bytes your photos and files take up, so they stay within your plan's storage (100 MB on Free, 2 GB on Pro). Our servers sort each into a category (photo, screenshot, graphic, animation, document, archive, key, media or other) from its type, size and name.
Notifications and subscription
If you allow notifications, each phone or tablet's notification token and platform are stored on your account so clips can reach your other devices. If you subscribe to Pro, RevenueCat tells our servers whether it is active, the plan, the store and when it renews or ends, and we store that on your account.
On your devices
Your settings, and clips, photos and files waiting to be sent, stay in the app's own storage on the device; on iPhone and iPad, what you share from another app waits in storage the app shares with its share extension. Photos and files you open are kept in the app's cache, which the device may clear. A linked browser or the Chrome extension keeps its sign-in, and may keep your recent clips and the photos and files you opened, in the browser's own storage until it signs out or you remove it.
Camera
The phone and tablet app uses the camera only to read the QR code of a browser you are linking. Nothing from the camera is stored or sent.
Your clipboard
- The app never reads your clipboard in the background. Text, photos and files only reach it when you send them: with Copy to Universal Clipboard in the text menu on Android, the share sheet on Android, iPhone and iPad, the app's paperclip, or the web app and extension on a computer.
- While the app is open, it puts the newest clip from your other devices on your device's clipboard, ready to paste. On Android and in the Chrome extension, Copy new clips automatically (off unless you turn it on) does the same for text clips the moment they arrive, even while the app is closed.
- On iPhone and iPad, when you tap Copy Now on a notification, the app reads the clipboard back once to check the copy worked.
Who can see your clips
- You: on your own devices, meaning the phones and tablets you sign in on and the browsers and extension you link. Nobody else using the app can see them.
- Signed out: the text menu and the share sheet send nothing until you sign in.
- Us: clips are stored as plain text, and photos and files as they were sent, protected by Google Cloud's standard encryption in transit and at rest. They are not end-to-end encrypted, so people with access to our Google Cloud project can read them. We only look at stored data to run and fix the service.
Usage analytics and crash reports
To see how UniClip is used and where it breaks, the phone and tablet app sends usage events to Google Analytics for Firebase and crash reports to Firebase Crashlytics. The web app and the Chrome extension send usage events to Google Analytics.
- What is sent: what you do and how it turns out, such as a clip saved, copied, deleted or searched, a browser linked, notifications allowed or Pro bought; the screens you open; sizes in ranges, such as a clip's length, a photo's or file's size, or how many clips a search found; whether a clip is text, a picture or a file; a clip's category; your plan and settings; and the app version, device model, system version and the approximate location Google Analytics works out itself. A crash report holds the error and the state of the app and device when it happened.
- What is never sent: the text of your clips, the names and contents of your photos and files, what you search for, the links in your clips, your email, your name or the names of your devices.
- Who it is tied to: each app, browser and extension has its own random analytics ID. While you are signed in, or a browser is linked, your account ID is sent too, so your devices count as one person.
- Your choice: in the European Economic Area, the United Kingdom and Switzerland, the app asks "Share usage and crash reports?" and sends nothing until you choose Share. Elsewhere it is on. Settings › Privacy › Share usage and crash reports turns it off or on for your account, and your linked browsers and the extension follow it.
- Before a browser is linked: the Chrome extension sends usage events under a random ID that it forgets when the browser closes. In the European Economic Area, the United Kingdom and Switzerland, the web app's Google Analytics runs without cookies until your account's answer allows them.
- How long: Google Analytics keeps usage events for at most 14 months, and Crashlytics keeps crash reports for 90 days. Deleting your account does not delete past reports; email us to have them deleted.
Who else handles it
We use these service providers. Each handles data only to provide its part of the service.
- Google Firebase: accounts, the clip database, storage for photos and files, and the functions that save clips, link browsers, clean up clips and send notifications. Clips and account records are stored in Google Cloud in Toronto, Canada. Photos and files are stored, and the functions run, in Google Cloud in Iowa, United States.
- Google Sign-In and Sign in with Apple: to sign you in.
- Firebase Cloud Messaging and the Apple Push Notification service: deliver Pro notifications to your devices. A notification carries the clip's text, or the start of a long clip, and on Android the notification shows it.
- RevenueCat: manages Pro subscriptions and tells our servers when your plan changes. It receives your account ID and your purchase history, not your email or your clips. While usage analytics is on, it also receives your device's analytics ID, so it can report purchases to Google Analytics.
- Google Play and the App Store: take payment for Pro.
- Google AdMob: shows a banner to Free users in the phone and tablet app. AdMob may use your device's advertising ID on Android, your IP address and device information to choose, personalise and measure ads, under Google's advertising policies. You can reset your advertising ID or turn off ad personalisation in your Android settings. On iPhone and iPad the app does not ask to track you, so Apple's advertising identifier is not used. In the European Economic Area, the United Kingdom and Switzerland, Google's consent message asks first, and Settings › Privacy › Ad privacy choices changes your answer.
- Google Analytics for Firebase and Firebase Crashlytics: usage analytics and crash reports, as described above. Google Signals and ad personalisation are off for them, so they are not used for ads.
- Cloudflare: hosts this website and the web app.
That is the complete list. We do not sell your data or share it with anyone else.
How long we keep it
- Free clips: every device hides them 1 minute after they are sent, and our servers delete them within about 2 minutes.
- Pro clips: until you delete them or your account. If Pro ends, clips you saved stay, and new clips follow the Free rules.
- Photos and files: as long as their clip. Deleting a clip deletes its file. A file that was uploaded but never became a clip, as when sending stopped half way, is deleted within a day.
- Your account and notification tokens: until you delete your account. Signing out removes that device's token.
- Linked browsers and the extension: until you remove them in the app, they sign out, or you delete your account.
- QR codes: deleted as soon as the browser finishes linking, or within about 1 minute after the code expires.
- Abuse limits: to stop people guessing QR codes, we count link attempts per network address for 10 minutes. The address is stored only as a one-way hash, and the count is removed automatically after that.
- Server logs: Google Cloud keeps logs from our functions, which include account IDs, for its standard retention period.
Deleting everything
Settings › Delete account signs out every browser and extension you linked, then deletes every clip you sent with its photos and files, your account record with its notification tokens, and your sign-in, straight away. You confirm with your Google or Apple sign-in first, and it cannot be undone. It does not cancel Pro: Google Play and the App Store bill that, so cancel with them first. RevenueCat and the stores keep their records of your purchases. If you signed in with Apple, you can also remove the app under Settings › your name › Sign in with Apple. Step-by-step instructions, including how to ask us to delete an account without the app.
This website and the web app
The pages of uniclip.app set no cookies of their own and run no analytics or advertising scripts. The web app keeps its sign-in in your browser's storage and talks only to Firebase and to Google Analytics, which may keep its own cookie there, as described under usage analytics above. The page the Chrome extension opens when you remove it sends only the answer you tap, if you tap one, under a random ID. Cloudflare hosts all of it and keeps standard server logs (IP address, page, time) for security, as any web host does. Store links may carry a tag naming the button you used, so the stores can tell us which buttons bring installs.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data, and to object to some processing. Delete account covers deletion. For anything else, email us and we will reply within 30 days.
Children
UniClip is not meant for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has used it, contact us and we will delete their data.
Changes
If this policy changes, we will post the new version here with a new date before it takes effect. The rules for using the app are in the terms of service.
Contact
UniClip is made by KharagEdition. Questions, requests or anything that looks wrong: support@uniclip.app.