# Privacy

ClipTrace is designed as a local-first clipboard manager. This document explains what the app stores, when it talks to the network, and where the privacy boundaries are.

## What ClipTrace Stores

ClipTrace can store clipboard entries for:

- Text, URLs, rich text, images, videos, and files
- Source app name and bundle identifier when available
- Tags, favorite/pinned state, custom titles, trash state, and copy statistics
- OCR text extracted from images
- Local semantic-search vectors generated from clipboard text and OCR text
- User preferences such as retention, filters, and MCP tool toggles

The history database is stored locally through SwiftData in the app's Application Support storage for the bundle identifier `com.wavever.cliptrace`. The exact path can vary by build, signing, and sandbox configuration.

## What ClipTrace Does Not Collect

ClipTrace does not include:

- Analytics
- Telemetry
- Crash reporting SDKs
- Remote clipboard sync
- Cloud semantic search
- Advertising or tracking SDKs

Clipboard history is not uploaded by ClipTrace.

## Network Access

ClipTrace has one intended background network feature:

- Sparkle update checks read the appcast configured by `SUFeedURL`.

Other explicit user actions may open project links, issue pages, or release pages in the browser. The clipboard monitor, semantic search, OCR processing, and MCP server do not require outbound network access.

## Semantic Search

Semantic search uses Apple's on-device Natural Language framework (`NLEmbedding`). Embeddings are generated locally and stored locally. No clipboard text is sent to a hosted embedding API.

## MCP Server

When launched with `--mcp`, the app binary runs a local Model Context Protocol stdio server. MCP clients such as Claude Desktop, Claude Code, or Cursor can query the local clipboard database through the tools you enable.

Important boundaries:

- MCP runs over stdio, not a public network port.
- MCP can expose clipboard contents to the MCP client you configure.
- Write tools can modify local entries, tags, favorites, pins, trash state, and snippets.
- Disable MCP or individual MCP tools in Settings if you do not want AI tools to access or modify clipboard history.

## Sensitive Clipboard Content

Clipboard managers are inherently sensitive. ClipTrace attempts to avoid capturing entries marked by common sensitive/transient pasteboard types, including:

- `org.nspasteboard.ConcealedType`
- `org.nspasteboard.TransientType`
- `org.nspasteboard.AutoGeneratedType`
- `com.apple.is-sensitive`

This depends on source applications marking sensitive content correctly. You should still avoid copying secrets into any clipboard manager unless you understand the risk.

## Local Controls

ClipTrace includes several privacy controls:

- Pause clipboard monitoring
- Exclude specific source apps from capture
- Configure per-type retention
- Trash and permanently delete entries
- Strip tracking parameters from copied URLs
- Hide the window from screen recording and screen sharing
- Disable MCP entirely, or disable individual MCP tools

## Security Reports

If you find a privacy or security issue, please follow [SECURITY.md](SECURITY.md) instead of opening a public issue with sensitive details.
