Privacy policy

Effective Date: May 15, 2025
Last Updated: May 15, 2025

Introduction

This Privacy Policy describes how The OWL Company ("we", "us", or "our") collects, uses, stores, and protects information when you use ClipGarage — a macOS clipboard manager application ("the App"). It also describes your rights and choices regarding your data.

We take privacy seriously. ClipGarage is built on a local-first, zero-knowledge architecture: your clipboard contents are stored on your device and, if you choose cloud sync, are encrypted end-to-end before leaving it. We are technically incapable of reading your clipboard data.

By downloading, installing, or using ClipGarage, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

1. Who We Are

The OWL Company
Email: info@theowlcompany.com

For the purposes of applicable data protection laws (including the EU General Data Protection Regulation, "GDPR"), The OWL Company is the data controller for personal data associated with your cloud sync account and feedback submissions.

For your clipboard data stored locally on your device, The OWL Company acts as neither a data controller nor a data processor — that data never reaches us.

2. Information We Collect

2.1 Clipboard Data (Local Only)

ClipGarage automatically monitors your macOS clipboard (NSPasteboard) and stores a history of copied content — including text, images, URLs, code snippets, and other material — in a local SQLite database on your Mac:

~/Library/Application Support/clipgarage_db/clipgarage.sqlite

Clipboard images are stored as PNG files at:

~/Library/Application Support/clipgarage_images/

This data never leaves your device unless you explicitly enable encrypted cloud sync (see Section 5). The OWL Company cannot access, read, or view your clipboard history under any circumstances.

2.2 Account Information (Optional — Required for Cloud Sync)

If you choose to enable encrypted cloud sync, you authenticate via Google OAuth. During this process, Google provides us with:

• Your email address

• A Google-assigned user ID (UID)

• Basic profile information (name, profile picture) as provided by Google — used for display only

We do not receive or store your Google account password. We do not access your Google Drive, Gmail, Contacts, or any other Google service data.

Your email address is stored in our Supabase backend, associated with your account. It is used solely to:

• Identify your account for cloud sync purposes

• Display your signed-in status within the App

• Respond to support or data requests you initiate

We do not use your email for marketing, newsletters, or any unsolicited communications.

2.3 Anonymous Usage Analytics

ClipGarage collects anonymous usage telemetry to help us understand how the App is used and to prioritize improvements. This is implemented via Google Analytics 4 (GA4) Measurement Protocol — direct HTTPS posts from the App, with no Firebase or browser-based tracking.

What we collect:

• Your name and email address

What we never collect:

• Any clipboard content — not a single character of what you copy

• Your Google account UID or Supabase user ID

• Device name, serial number, or hardware identifiers

• IP address (beyond what Google receives from the raw HTTPS connection at the network level)

• Source application names, custom titles, tags, or board names you create

• Any information that could be used to identify you as an individual

The anonymous client_id UUID is generated locally on first launch and persisted in NSUserDefaults. It is not linked to your cloud sync account. If you reinstall the App, a new UUID is generated.

All GA4 events include non_personalized_ads: true.

2.4 Feedback Submissions (Optional)

If you use the in-app Share Feedback dialog, we collect:

• The feedback text you type

• Any screenshots or attachments you choose to upload

• Your account email address (if signed in to cloud sync)

• A timestamp of submission

Feedback data is stored in a private Supabase Storage bucket accessible only to The OWL Company. It is used solely to evaluate and respond to product feedback.

2.5 Crash and Diagnostic Data

ClipGarage does not currently integrate any third-party crash reporting service (e.g., Crashlytics, Sentry). If this changes, this policy will be updated accordingly.

macOS may collect its own diagnostic and crash data through the operating system's native mechanisms (e.g., crash reports in ~/Library/Logs). This is governed by Apple's Privacy Policy, not ours.

3. How We Use Your Information

Clipboard data is stored locally only. Displayed to you within the App, Account email, Account identification; support responses, Anonymous analytics, Product usage analysis; feature prioritizationFeedbackProduct improvement; customer support

We do not:

• Sell, rent, or share your data with advertisers, data brokers, or any third party for commercial purposes

• Use your data to build advertising profiles

• Use your clipboard content for any purpose — it is inaccessible to us

• Make automated decisions about you with legal or significant effect

4. System Permissions

ClipGarage requests the following macOS system permissions. These are requested at feature-use time and are never used beyond their stated purpose.

Accessibility

Why: The Quick Search feature pastes the selected clipboard item into the previously focused application by injecting a CGEvent (keyboard event) targeting that app's process. This requires Accessibility permission.

Scope: Used only at the moment you paste from Quick Search. Not used to monitor, scrape, or read content from other applications at any other time.

Input Monitoring

Why: The global hotkey (default: Cmd+Shift+S) that triggers Quick Search must be detected even when ClipGarage is not the active application. Detecting global key events requires Input Monitoring permission.

Scope: The App listens only for the configured hotkey combination. Individual keystrokes, typed text, or any other keyboard input is never recorded or transmitted.

5. Cloud Sync and End-to-End Encryption

Cloud sync is entirely optional and disabled by default. Your clipboard history remains exclusively local unless you choose to enable it.

How the Encryption Works

When you enable cloud sync:

1. A random 256-bit Data Encryption Key (DEK) is generated on your device.

2. The DEK is stored in your macOS Keychain — it never leaves your device in plaintext.

3. A Recovery Key (32 random bytes, displayed as a 64-character hex string) is generated and shown to you once. You must save it. A cryptographic hash of a wrapping key derived from your Recovery Key is stored on our servers alongside an encrypted copy of the DEK — allowing you to restore access from a new device.

4. Every clipboard item is encrypted with AES-256-GCM on your device before upload.

5. Only the encrypted ciphertext and a nonce (initialization vector) are transmitted to our Supabase backend.

The OWL Company holds no keys. We cannot decrypt your synced clipboard data under any circumstances — not even in response to a legal request. The cryptographic design enforces this technically.

What Is Synced

• Encrypted text-based clipboard items

• Metadata (item type, captured timestamp) — also encrypted

What Is Not Synced

• Images (not yet supported)

• Your Recovery Key in plaintext (never transmitted)

• Your PIN or PIN hash

• Your local-only data (paste history timestamps, board assignments)

Data Location

Encrypted clipboard data is stored on servers operated by Supabase, Inc., which may be located in the United States or other jurisdictions. See Section 11 for international transfer disclosures.

6. Data Storage and Security

Local Data

DataLocationAccessClipboard history~/Library/Application Support/clipgarage_db/You onlyClipboard images~/Library/Application Support/clipgarage_images/You onlyPIN hash (SHA-256)macOS NSUserDefaultsYou onlyData Encryption KeymacOS KeychainYou onlyRecovery Key (wrapped)macOS Keychain + encrypted copy on SupabaseYou onlyAnonymous analytics IDmacOS NSUserDefaultsYou only (anonymous)

Cloud Data

DataProviderEncryptionEncrypted clipboard itemsSupabase (Postgres)AES-256-GCM (zero-knowledge)Account emailSupabase (Postgres)TLS in transit; at-rest encryption by SupabaseFeedback text and attachmentsSupabase StorageTLS in transit; at-rest encryption by Supabase

Security Measures

We implement the following security practices:

• End-to-end encryption for all synced clipboard data

• Zero-knowledge architecture — we cannot access your clipboard content

• AES-256-GCM encryption with unique nonces per item

• PBKDF2-SHA256 key derivation (100,000 iterations) for Recovery Key wrapping

• TLS for all network communication

• Row-level security (RLS) in Supabase — users can only access their own rows

• Scoped OAuth — we request only the minimum Google account scopes necessary

• No clipboard content in analytics — enforced by design, not policy

Despite these measures, no security system is perfect. You are encouraged to enable PIN protection within the App for an additional layer of local access control.

7. Data Retention

DataRetention periodLocal clipboard historyUntil you delete it; Trash auto-purges after 30 daysCloud sync dataUntil you reset cloud sync or request account deletionAccount emailUntil you request deletion or we terminate the serviceAnonymous analyticsPer Google Analytics data retention settings (default 14 months)Feedback submissionsUntil manually deleted by The OWL Company, or upon deletion request

To request deletion of your account data, email info@theowlcompany.com. We will complete deletion within 30 days of a verified request.

8. Your Rights

For All Users

Regardless of where you are located, you have the following rights with respect to your data:

• Access: View all clipboard history stored on your device within the App at any time.

• Delete: Delete individual clips, boards, or your entire history from within the App.

• Export: Use the App's export features or access the SQLite database file directly.

• Disable cloud sync: Turn off cloud sync in Settings at any time without losing local data.

• Delete cloud data: Settings → Reset Cloud Sync permanently deletes all encrypted data from our servers.

• Opt out of analytics: We currently do not provide an in-app toggle; contact us at info@theowlcompany.com to discuss options.

For EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have the following additional rights under the GDPR:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you (account email, feedback data).

• Right to Rectification (Art. 16): Request correction of inaccurate personal data.

• Right to Erasure (Art. 17): Request deletion of your personal data, subject to legal obligations.

• Right to Restriction of Processing (Art. 18): Request that we limit how we use your data in certain circumstances.

• Right to Data Portability (Art. 20): Request your personal data in a structured, machine-readable format.

• Right to Object (Art. 21): Object to processing based on legitimate interests.

• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

• Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority.

Legal bases for processing:

Processing activityLegal basisStoring account email for cloud syncPerformance of contract (Art. 6(1)(b))Anonymous analyticsLegitimate interests (Art. 6(1)(f)) — improving the AppFeedback submissionsConsent (Art. 6(1)(a)) — you voluntarily submit feedback

Your clipboard data is not processed by us and therefore falls outside the scope of GDPR obligations on our part.

To exercise your GDPR rights, contact us at info@theowlcompany.com. We will respond within 30 days.

For California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request information about the categories and specific pieces of personal information we collect, the sources, the purposes, and with whom we share it.

• Right to Delete: Request deletion of your personal information, subject to certain exceptions.

• Right to Correct: Request correction of inaccurate personal information.

• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No opt-out is required.

• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

• Right to Limit Use of Sensitive Personal Information: Your clipboard data is sensitive by nature. It is stored locally on your device and never accessed by us.

To exercise your CCPA rights, contact us at info@theowlcompany.com. We will respond within 45 days (extendable by an additional 45 days with notice).

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. The anonymous analytics data we send to Google Analytics does not constitute "sale" or "sharing" under CCPA because it contains no personal information and cannot identify you.

9. Third-Party Services and Disclosure

We use the following third-party services. Each is subject to its own privacy policy.

ServiceProviderPurposeData SharedSupabaseSupabase, Inc. (USA)Cloud database and authenticationAccount email, UID, encrypted clipboard ciphertext, feedbackGoogle OAuthGoogle LLC (USA)Sign-in authenticationEmail and UID received from GoogleGoogle Analytics 4Google LLC (USA)Anonymous usage analyticsAnonymous UUID, event names, bucketed metrics

We do not share your data with any other third parties. We do not use advertising networks, affiliate trackers, or social media pixels.

Legal disclosures: We may disclose personal information if required to do so by law, regulation, legal process, or governmental request. Because your clipboard data is encrypted and we hold no decryption keys, we cannot provide its contents even if compelled. We will notify you of such requests to the extent permitted by law.

10. Children's Privacy

ClipGarage is not directed at, and is not intended for use by, children under the age of 13 (or under the age of 16 for residents of the EU/EEA, in accordance with applicable law).

We do not knowingly collect personal information from children. If we become aware that a child under the applicable age has provided us with personal information, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at info@theowlcompany.com.

11. International Data Transfers

The OWL Company operates from Bangladesh. If you use cloud sync, your encrypted clipboard data and account information are processed by Supabase, Inc., which operates infrastructure primarily in the United States and may transfer data to other countries.

For users in the EU/EEA: transfers of personal data to countries outside the EU/EEA that do not have an adequate level of data protection (as determined by the European Commission) are made subject to appropriate safeguards, such as Standard Contractual Clauses (SCCs) as provided by Supabase. For more information, refer to Supabase's Data Processing Agreement and Privacy Policy.

Regardless of where your data is processed, we apply the protections described in this Privacy Policy.

12. Data Breach Notification

In the event of a security breach affecting your personal data, we will:

• Investigate and assess the scope and severity of the breach

• Notify affected users and relevant supervisory authorities within the timeframes required by applicable law (72 hours under GDPR where feasible)

• Describe the nature of the breach, the data affected, and the steps taken or proposed to address it

Because your clipboard data is end-to-end encrypted and we hold no decryption keys, a breach of our servers would not expose your clipboard contents — only encrypted ciphertext.

13. Do Not Track

ClipGarage is a native macOS application, not a web browser. "Do Not Track" (DNT) browser signals are not applicable to the App.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this document and, where appropriate, notify you through the App or via the email associated with your cloud sync account.

We encourage you to review this policy periodically. Your continued use of ClipGarage after the effective date of a revised policy constitutes your acceptance of the updated terms.

15. Contact Us

If you have questions, concerns, requests, or complaints regarding this Privacy Policy or our data practices, please contact us:

The OWL Company
Email: info@theowlcompany.com

We aim to respond to all inquiries within 10 business days.

This Privacy Policy was written to accurately reflect the technical architecture of ClipGarage. We believe transparency and technical accuracy go hand in hand.