Privacy Policy

Last updated: October 9, 2026

StashPaste is built around a simple privacy principle:

Your clipboard content belongs on your Mac, not on our servers.

This Privacy Policy explains what information StashPaste processes, what stays entirely on your device, what limited information may be processed when you register a free license, activate or update StashPaste, interact with the website or contact us, and what choices and rights you have.

This Policy applies to the StashPaste website, StashPaste Light, and related license-registration and contact communications. StashPaste Pro is in development and is not publicly available; this Policy does not describe unreleased products or features.

StashPaste Light is available as a session-history edition for macOS 13 or later on Apple Silicon and Intel Macs, with an English interface.

1. Who Is Responsible for Your Personal Data

For personal data for which StashPaste determines the purposes and means of processing, the operator of the StashPaste brand acts as the data controller.

Contact:

contact@stashpaste.com

Lemon Squeezy, our third-party license-registration and licensing provider, separately processes information associated with its service under its own applicable privacy terms.

2. The Most Important Part: Your Clipboard Content

StashPaste Light: session history

StashPaste Light does not intentionally persist clipboard history to disk. It maintains history in process memory for the running application session and discards it when the App exits. Light does not have a persistent clipboard-history database.

Ordinary application preferences and licensing state may be saved. This statement concerns intentional clipboard-history persistence; it is not a guarantee about macOS paging, temporary files, backups, other applications or the system clipboard. Quitting Light does not promise to clear the macOS system clipboard. Light captures text, images, links, colors and file references. Search, filters, pins, notes, Hidden access controls and Simple/Advanced views operate within the current session. Closing the panel, sleep and screen lock preserve history while the process runs; quitting, a crash, an update or another process restart discards it. The next launch begins with empty history.

Clipboard content and local metadata

The following content and metadata description applies to StashPaste Light, which retains history only for the running session.

Your clipboard content is not designed to be uploaded, synchronized, or backed up to StashPaste-operated cloud servers.

This includes content such as:

  • copied text, including text copied from rich-text applications (formatting may not be retained);
  • URLs;
  • colors;
  • images;
  • file references copied from Finder;
  • other supported clipboard content.

Depending on the item, StashPaste may also store local metadata such as the source application’s name and identifier, the URL domain, the copy date and time, a file name and local path, an approximate size, and notes you add. For ordinary files copied from Finder, StashPaste stores a local file reference rather than a copy of the file itself. For clipboard images and image files, image data may also be stored locally by StashPaste.

Because this clipboard history remains local to your device, we do not receive or have access to it through normal operation of the App.

The App does not send your clipboard history to us for:

  • analytics;
  • advertising;
  • profiling;
  • AI training;
  • behavioral tracking; or
  • cloud synchronization.

You can delete locally stored clipboard history using the controls available within StashPaste.

Local clipboard data remains subject to the security of your Mac, your macOS account, your backups, and any other software with access to your device.

StashPaste should not be treated as your sole permanent archive or backup system.

3. Hidden Items, Authentication, and Application Exclusions

Light supports Hidden records in its session history. Touch ID or macOS password authentication protects reveal, copy and paste access. Temporary authenticated access ends on panel close, sleep, screen lock or restart. Unhide removes the flag for the rest of the session unless you hide the item again. Optional authentication to open the clipboard is off by default. Hidden protects display and access in the App; it does not encrypt clipboard history in RAM or guarantee secure memory erasure.

These security mechanisms operate locally on your device.

Light includes mechanisms designed to exclude clipboard capture from supported applications such as password managers. Light also supports user-defined application exclusions.

Application exclusions are designed to reduce accidental capture of sensitive content but should not be treated as infallible.

Changes to macOS, third-party applications, application identifiers, clipboard behavior, configuration, or other technical factors may affect exclusion behavior.

You remain responsible for deciding which sensitive information you copy or retain.

We recommend storing passwords, recovery codes, cryptographic keys, and similar credentials in a dedicated password manager or secure credential-management system.

StashPaste does not record keystrokes outside the App.

4. Information We May Process

Although your clipboard history remains local, limited personal information may be processed when you interact with free license registration, the website, updates or contact communications.

Depending on how you use StashPaste, this may include:

License information

  • license key or license identifier;
  • license activation status;
  • device or installation instance identifier;
  • activation and deactivation information;
  • App version; and
  • information necessary to enforce the permitted device limit.

Free license-registration information

Information made available to us by Lemon Squeezy may include:

  • the email address used to register the license;
  • a registration or order identifier;
  • the registered product and license;
  • registration and license status;
  • country or region, where collected by the provider; and
  • associated registration metadata necessary to administer the license.

StashPaste Light Version 1 (1.x.x) has a $0, perpetual license for one individual on one Mac at a time, with a seven-day registration grace period starting at the first launch of Light. Continued use after that period requires activation of the free license. It requires no payment method or subscription.

Contact information

If you contact us, we may receive:

  • your email address;
  • your name, if you choose to provide it;
  • the selected message topic and your message;
  • macOS or App version information and other diagnostic information that you voluntarily provide;
  • license information you provide; and
  • attachments you voluntarily send by email.

The website form does not offer an attachment upload. Do not send passwords, authentication codes, private keys or sensitive clipboard content in contact messages. Sending a message does not create a technical-support entitlement or guarantee a response to requests for voluntary technical assistance. We will handle privacy requests, consumer claims and other communications as required by applicable law, including any statutory response deadlines.

Website and network information

When you access the StashPaste website or when the App makes a network request, the relevant server or service provider may necessarily receive technical information such as:

  • IP address;
  • date and time of the request;
  • browser or application user agent;
  • operating-system or application version information;
  • requested URL or resource; and
  • basic server or security logs.

We do not use this technical information to build behavioral advertising profiles.

5. Why We Process Personal Data

Where applicable data-protection law requires a legal basis for processing, we rely on the following bases depending on the context.

Providing and administering your license

We process licensing and registration-related information where necessary to:

  • issue and activate your applicable free Version 1 license;
  • verify license validity;
  • manage the one-device activation limit;
  • allow device deactivation and transfer;
  • administer the use rights granted by your license; and
  • handle license-registration inquiries.

Where GDPR applies, this processing is generally necessary for the performance of our contract with you.

Security and abuse prevention

We may process limited technical, activation and registration information to:

  • prevent license-key abuse;
  • detect fraudulent activations;
  • protect the App and website;
  • investigate security incidents; and
  • maintain service integrity.

Where GDPR applies, we rely on our legitimate interests in protecting StashPaste, our users, and our licensing system, provided those interests are not overridden by your rights and freedoms.

Contact communications

We process information you voluntarily send so that we can consider your message, respond where appropriate, administer your license, assess a security report or handle a privacy or legal request. Contact communications do not form a contractual technical-support service.

Depending on the request, the legal basis may be performance of our contract, steps taken at your request, compliance with a legal obligation or our legitimate interest in handling communications.

We may retain or disclose information where necessary to establish, exercise or defend legal claims or resolve disputes. Where GDPR applies, this may be based on our legitimate interests in protecting and enforcing legal rights, provided those interests are not overridden by your rights and freedoms. Processing required by a specific legal obligation, including an applicable court order, is addressed below.

We may retain or disclose information where reasonably necessary to comply with:

  • tax or accounting requirements;
  • regulatory requirements;
  • court orders; or
  • other obligations imposed by applicable law.

Where GDPR applies, such processing may be necessary for compliance with a legal obligation.

6. Licensing and Lemon Squeezy

StashPaste uses Lemon Squeezy for issuing, activating, validating and deactivating free Version 1 licenses for Light.

The Version 1 license-registration flow is $0, with no payment method or subscription required. Lemon Squeezy may process information necessary to issue and administer the license, including contact details, registration or order identifiers, product and license details, activation information and standard technical connection information.

Lemon Squeezy may provide StashPaste with limited registration and license information necessary to administer the license. It processes information under its own applicable Privacy Policy and service terms. This Policy does not describe free Version 1 registration as payment-card processing or a paid transaction.

7. License Activation

License activation and validation may require the App to communicate with licensing infrastructure operated by or through Lemon Squeezy.

These requests may include information necessary to validate and administer the license, such as:

  • license key or license identifier;
  • device or installation instance information;
  • activation status; and
  • standard technical connection information.

Clipboard contents and clipboard history are not part of license-validation data.

For the current Light release, activation sends the license key and a generic installation label, “StashPaste Light v1 Mac”, rather than your Mac’s actual name. Validation and deactivation send the license key and the activation instance identifier. The licensing service also receives standard connection information when these requests are made.

Reasonable licensing information may be retained for as long as necessary to administer your active perpetual license, prevent abuse, resolve disputes, and comply with applicable legal obligations.

8. Software Updates

StashPaste may make network requests to check for:

  • new software releases;
  • security updates;
  • update metadata;
  • compatibility information; or
  • other documented update information for the applicable edition.

Downloading an update also requires a network connection to the relevant distribution infrastructure.

These requests may necessarily expose standard technical connection information, such as your IP address and software user agent, to the relevant server or hosting provider.

These update requests do not include your clipboard history or clipboard contents.

Light reads registration configuration from bundled configuration files; it does not fetch registration configuration from the website. Licensing requests and software updates are separate from local clipboard processing.

You may also create network requests when you explicitly open a StashPaste website or contact page from within the App.

9. Website Services

The StashPaste website uses a limited number of external service providers.

Website hosting

Our hosting infrastructure may process technical connection and security information such as IP addresses, request times, requested resources, and user-agent information in order to serve the website and protect it against abuse.

Lemon Squeezy free license registration

The website provides an outbound Get Free License link to Lemon Squeezy. It does not embed the provider’s registration script or load registration resources before you follow that link.

When you follow the link, Lemon Squeezy and its delivery providers may receive standard connection information such as your IP address, browser and device information, requested resource and referring page.

Selecting the link opens the provider’s registration page. Lemon Squeezy processes information needed to display the form and issue and administer the $0 license, under its own privacy practices and terms. Following the link does not itself register a license. See Lemon Squeezy’s Privacy Policy for its processing, cookies and related technologies.

Contact form

The StashPaste contact form uses Web3Forms to transmit submissions to us. It sends your email address, selected topic and message, and any optional name or system/version information you enter.

Web3Forms is operated by Web3Creative and processes submissions on our behalf for delivery, security and abuse prevention. Its Privacy Policy describes AWS, Cloudflare and Hetzner as infrastructure providers and says submitters’ IP and email addresses may be sent to CleanTalk or Akismet for spam prevention. Its Data Processing Agreement describes its processor role and arrangements for processing submissions.

StashPaste uses Web3Forms’ Free plan. The provider’s plan information lists 30 days of submission history visible in the Free dashboard, with data retained for longer. Its Privacy Policy states that submissions may be retained for up to three years, unless a shorter period applies or they are deleted earlier. Dashboard visibility is separate from permanent deletion. These are the provider’s published retention terms, not a promise that this form has a custom shorter retention period.

Web3Forms lists optional integrations such as Google Sheets, Telegram, Discord, Slack and webhooks as paid features; they are not included in the Free plan used for this site. The form submits to https://api.web3forms.com/submit; submitting a message does not create a technical-support obligation or limit any legally required response.

Do not submit passwords, private keys, authentication codes or sensitive clipboard contents through the contact form.

Optional Ko-fi tips

If you follow an optional Ko-fi tip link, you leave the StashPaste website and interact with Ko-fi under its own privacy practices. StashPaste does not embed a Ko-fi widget, script, image or tracking resource and does not send your form or license information to Ko-fi. The outbound link does not initiate a Ko-fi request before you choose to follow it.

Ko-fi and the payment providers you use there may process contact, contribution, payment and technical connection information under their own policies. Any information made available to us in connection with a tip is separate from license registration. No StashPaste license, feature, update, service, device limit or technical assistance depends on a tip.

Product-news email

The website does not currently offer a product-news email signup or newsletter opt-in. Free-license registration is not presented as consent to marketing. Any future product-news opt-in must be optional and separate from downloading, activation and continued Version 1 use.

Fonts and external resources

The website currently uses system fonts and serves its images and other presentation assets from its own origin. It does not request fonts from Google Fonts.

If you follow an external link, the destination provider may receive standard technical connection information under its own privacy practices.

10. Cookies, Analytics, Advertising, and Tracking

The StashPaste App does not use your clipboard contents for advertising or behavioral profiling.

StashPaste does not operate a cloud service that analyzes your clipboard history.

This version of the StashPaste website does not embed advertising trackers or cross-site behavioral advertising scripts.

If you follow a free-license registration link, Lemon Squeezy and its providers may use cookies, local storage or similar technologies on their own pages under their own privacy policies. We do not control those providers’ technologies or processing. See Lemon Squeezy’s Privacy Policy.

The website stores your light/dark theme preference in browser local storage. No Ko-fi resource is loaded as part of viewing this website.

Where applicable law requires consent before non-essential tracking technologies may be used, we will obtain that consent before activating those technologies.

11. How Long We Keep Personal Data

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to legal requirements.

Clipboard history

Light: session history, including pins, notes and Hidden flags, is discarded when the running application exits. It does not intentionally persist a clipboard-history database. Panel close, sleep and screen lock retain history while the process runs. The default history memory limit is 128 MB, with 64 MB and 256 MB options. Older eligible items can be removed as this limit is reached; pinned and Hidden items are protected from automatic removal but are still discarded on process exit. This history-data limit is not a limit on the entire App’s memory use.

Because we do not normally receive that history, we do not control its retention.

Licensing records

Information required to administer a perpetual StashPaste license may be retained for as long as the license remains valid and for a reasonable period afterward where necessary to:

  • administer the license and registration history;
  • prevent fraud or license abuse;
  • resolve disputes; or
  • comply with legal obligations.

Contact communications

Contact messages may be retained for as long as reasonably necessary to consider or respond to your request, maintain an appropriate communication history, administer a license, handle a privacy or security matter or resolve a dispute.

This describes our retention of contact correspondence. Web3Forms’ separate retention of submitted form data is described in Section 9.

Information that is no longer necessary will be deleted or anonymized where reasonably practicable, subject to legal obligations.

Legal or optional-contribution records may need to be retained where required for legal, accounting, tax, abuse-prevention or dispute-resolution purposes. These records are separate from the free Version 1 license fee.

Lemon Squeezy and Ko-fi separately determine retention periods for information they process under their own policies.

12. Service Providers and Recipients

We may disclose limited personal information to service providers only where reasonably necessary to operate StashPaste and related services.

These may include providers of:

  • free license registration;
  • license activation and validation;
  • website hosting;
  • software-update distribution;
  • email delivery;
  • contact-form delivery;
  • security and abuse prevention; and
  • infrastructure services.

Service providers may process information under their own terms, our contractual arrangements with them, or both, depending on their role.

We may also disclose information where required by law, legal process, or a valid governmental or judicial request.

We do not disclose your locally stored clipboard history to service providers because StashPaste is not designed to receive that history.

13. International Data Transfers

Some service providers used by StashPaste may process information in countries other than the country in which you live.

For example, providers involved in licensing, website infrastructure, contact delivery or optional tips may operate infrastructure in the United States, India or other jurisdictions.

For contact-form submissions, Web3Forms states that Web3Creative operates from India and uses infrastructure in multiple regions. Its published Data Processing Agreement incorporates Standard Contractual Clauses, with the UK Addendum where applicable, for transfers requiring those safeguards. This describes the provider’s published transfer arrangements; it does not promise that contact-form data remains in the EU or EEA.

Before arranging an international transfer that requires safeguards under applicable data-protection law, we will ensure that a legally recognized transfer mechanism is in place, such as:

  • an applicable adequacy decision;
  • approved contractual safeguards; or
  • another lawful transfer mechanism.

The applicable mechanism depends on the provider, destination and processing involved. Lemon Squeezy and Ko-fi describe their own international processing and safeguards in their privacy documentation. You may contact us for information about safeguards applicable to transfers we arrange and how to obtain a copy where applicable law provides that right.

14. Data Security

We use reasonable technical and organizational measures appropriate to the limited personal data we process.

These measures are intended to protect information against:

  • unauthorized access;
  • accidental loss;
  • misuse;
  • alteration; and
  • unauthorized disclosure.

No computer system, storage medium, network connection, encryption system, or authentication mechanism can be guaranteed to be completely secure.

You are responsible for maintaining the security of your own Mac, macOS account, backups, and credentials.

15. Your Privacy Rights

Depending on where you live and which laws apply, you may have rights concerning your personal data.

These may include the right to:

  • request access to personal information we hold about you;
  • request correction of inaccurate information;
  • request deletion of information;
  • request restriction of processing;
  • object to certain processing based on legitimate interests;
  • receive certain information in a portable format;
  • withdraw consent where processing is based on consent; and
  • lodge a complaint with an appropriate data-protection authority.

These rights may be subject to legal exceptions.

To make a privacy request, contact:

contact@stashpaste.com

We may need to verify your identity before fulfilling certain requests.

Where GDPR applies, we will respond to requests to exercise your rights without undue delay and within one month of receipt. Where permitted because of the complexity and number of requests, that period may be extended by up to two further months; we will inform you of the extension and its reasons within the initial month. If we do not act on a request, we will explain the reasons and the available complaint and judicial-remedy options within the period required by applicable law. Other applicable statutory response deadlines remain unaffected.

We will not discriminate against you for exercising a privacy right provided by applicable law.

16. European Union and EEA Users

If the General Data Protection Regulation (“GDPR”) applies to you, you have the rights provided by the GDPR, subject to its conditions and exceptions.

You also have the right to lodge a complaint with the supervisory authority responsible for data protection in your country.

Where StashPaste is established in Bulgaria and the Bulgarian supervisory authority is competent, the relevant authority is the Commission for Personal Data Protection (CPDP).

You are encouraged to contact us at contact@stashpaste.com if you believe there is a privacy problem so that we can try to resolve it promptly. Contacting us first is optional and does not limit your right to complain directly to a competent supervisory authority.

17. United States Privacy Rights

Residents of certain U.S. states may have additional privacy rights where the relevant state privacy law applies to StashPaste.

Such rights may include access, correction, deletion, portability, or the ability to opt out of certain forms of sale, sharing, or targeted advertising.

StashPaste does not sell your locally stored clipboard history.

StashPaste does not use clipboard content processed locally by the App for cross-context behavioral advertising or targeted advertising.

If an applicable U.S. privacy law grants you a right that is not specifically described in this Policy, you may contact us at:

contact@stashpaste.com

and we will handle the request as required by applicable law.

18. No Sale of Clipboard Content

StashPaste does not sell your clipboard contents.

We do not operate a commercial database of users’ clipboard histories.

We do not monetize clipboard contents through advertising, data brokerage, behavioral profiling, or sale to third parties.

Because clipboard history is designed to remain locally on your Mac, we normally do not possess it in the first place.

19. Children

StashPaste is a general-purpose productivity application and is not directed specifically at children.

We do not knowingly collect personal information from children through the App for advertising or profiling purposes.

If you believe a child has provided personal information to us through a contact message or another online service and you believe that information should be removed, contact:

contact@stashpaste.com

20. Third-Party Websites and Services

StashPaste may contain links to websites or services operated by third parties.

Examples may include:

  • Lemon Squeezy;
  • Apple;
  • documentation sites;
  • Ko-fi; and
  • other external resources.

Their privacy practices are governed by their own policies.

This Privacy Policy does not control how independent third parties process information once you interact directly with their services.

21. Changes to This Privacy Policy

We may update this Privacy Policy when necessary to reflect:

  • changes to StashPaste;
  • changes to service providers;
  • changes in data-processing practices;
  • security or infrastructure changes; or
  • changes in applicable law.

The current version will be published with an updated revision date.

We will provide notice of changes to personal-data processing where and when applicable law requires it, including before changed processing begins where required. For other material changes, we may provide additional notice where appropriate.

We will not use an updated Privacy Policy as a basis to begin uploading or monetizing your existing local clipboard history without providing any notice or consent required by applicable law.

22. Language and Translations

This Privacy Policy was originally prepared in English.

Translations may be provided to make the Policy easier to understand.

The English version is the authoritative reference version in the event of an inconsistency between translations, to the extent permitted by applicable law.

Where applicable law requires privacy information to be provided or interpreted in a particular language, those mandatory requirements apply.

23. Contact

For privacy questions, requests, or concerns, contact:

contact@stashpaste.com