Privacy Policy

Last updated: November 9, 2026

ctrl-cv ("we") is a clipboard for AI assistants. This policy explains what we collect, why, and the choices you have. Questions go to help@ctrl-cv.io.

What we collect

• Google account information. When you sign in with Google, we receive your Google account identifier and email address. We ask only for these.
• Clips. The text you tell an AI to copy to ctrl-cv, along with its id, length, a short preview, and its order and expiry time.
• Copy count and subscription record. How many copies your account has made, when you first signed in, made a copy, used up your free copies, started checkout, paid, or were refunded, and, if you buy a plan, its status, billing period, renewal or end date, and Paddle's identifiers for your customer record and subscription. This record is linked to a one-way hash of your account identifier. We don't receive or store your card details.
• Connection data. Sign-in sessions, and the tokens that let your AI apps reach your clipboard, including tokens issued by Google.
• Service logs. Request details such as IP address, browser or app type, address requested, and time, plus clip ids, clip lengths, and a one-way hash of your account identifier. Clip text is not written to our logs.
• Website visits. On ctrl-cv.io, Google Analytics records the pages you view, how you arrived, your general location, and your device and browser type. It uses a cookie to recognize repeat visits, except for visitors from the European Economic Area, the United Kingdom, and Switzerland, for whom we don't set analytics cookies. It isn't used on app.ctrl-cv.io, where your clips are.

ctrl-cv does not read your AI conversations. It receives only the text an AI sends when you ask it to copy.

How we use it

We use this information to sign you in, store and return your clips, apply the free-copy limit, manage your plan, keep the service secure, investigate problems, and respond to you. We don't sell your information, show ads, or use your clips to train AI models. We access clip content only when needed to operate the service, to investigate abuse or a problem you report, or when the law requires it.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Who else handles it

• Google Cloud hosts the service and stores clips and connection data, in the United States.
• Google provides sign-in.
• Google Analytics measures visits to ctrl-cv.io. It doesn't receive your clips or your email address, and we don't use it for advertising. See how Google uses information from sites that use its services.
• Cloudflare provides domain name service and forwards email sent to our help address.
• GitHub hosts this website.
• Resend delivers a clip to your own email address when you choose "Send to me". It receives that address and the clip's text. The email then stays in your mailbox, and isn't removed when the clip expires or is deleted.
• Paddle is our online reseller and Merchant of Record. If you open checkout or buy a plan, Paddle collects the details you enter there, such as your email address, country, and payment details, and handles them under its own privacy policy. We send Paddle a one-way hash of your account identifier so that your plan is applied to your account. Paddle doesn't receive your clips.
• Your AI apps. When you ask an AI to paste a clip, its text goes to that AI's provider and is handled under that provider's terms.

We may also disclose information when the law requires it. If you use ctrl-cv from outside the United States, your information is transferred to and processed there.

How long we keep it

• Clips are deleted automatically 30 days after they are saved. An expired clip stops being available immediately, and removal from storage can take a day or more. If you reach your account's storage limit, your oldest clips are removed first.
• Your account record is deleted 30 days after your last copy, or when you delete all your clips.
• Your copy count and subscription record are kept separately, and aren't removed when you delete your clips, so that free copies can't be reset. We keep them until you ask us to delete them, except for anything we need to keep for legal, tax, or fraud-prevention reasons. Paddle keeps its own purchase records under its privacy policy.
• Web sessions expire after 7 days. Expired sign-in and connection records can't be used, and may stay in storage in encrypted form until they are cleaned up.
• Service logs are kept for about 30 days.
• Website visit data is kept in Google Analytics for up to 14 months.

Security

Data is encrypted in transit and at rest. Tokens and session data are additionally encrypted by the application. Each clip is tied to one account and can't be read from another. No service is perfectly secure, so please don't save passwords, keys, or other secrets as clips.

Your choices

• View and delete your clips, one at a time or all at once, at app.ctrl-cv.io/clips.
• Cancel a plan or update your payment details under Billing, at app.ctrl-cv.io/billing.
• Disconnect ctrl-cv in your AI app, or remove its access from your Google account.
• Block Google Analytics with your browser's settings or Google's opt-out add-on.
• Contact help@ctrl-cv.io to ask for access to, correction of, or deletion of your information. You may have further rights where you live.

Children

ctrl-cv is not for anyone under 14, or under the minimum age for using online services without parental consent where they live. If you believe a child has used it, contact us and we will delete the information.

Changes

We may update this policy. When we do, we will change the date above, and for significant changes we will give notice through the service.