Moonshot LabsMoonshot Labs

Türkçe sürüm

PrivaPaste Privacy Policy

Last updated: September 5, 2026

PrivaPaste is a clipboard manager for iPhone, iPad and Mac made by Moonshot Labs (“we”, “our”, “us”). This policy explains what data the app handles, where it is stored, and the rights you have over it. The short version: clipboard content is stored on your devices and, when enabled, in your private iCloud database. We do not sell clipboard content or use it for advertising. Optional network features are explained below.

1. Data controller

Moonshot Labs, contact: support@moonshotlabs.app, website: moonshotlabs.app. We are the controller within the meaning of the EU General Data Protection Regulation (GDPR), the UK GDPR and the Turkish Personal Data Protection Law No. 6698 (KVKK).

2. What the app handles

  • Clipboard history. Text, links, code snippets, images and file references that you copy while PrivaPaste is running, together with the time of copying and, on macOS, the name of the app you copied from. This is the core purpose of the app.
  • Secure area. Secure items use a separate store protected by Face ID, Touch ID or device authentication. They stay local when Secure sync is off. If you explicitly enable Secure sync, those items are stored in your private iCloud database. They are excluded from the keyboard extension.
  • Settings. Your preferences (history limit, themes, shortcuts, ignored apps, and so on).
  • Purchase status. If you buy a subscription, Apple processes the payment. Our purchase provider, RevenueCat, receives a pseudonymous app identifier and the transaction information needed to unlock Premium. When iCloud is available, the app derives this identifier from your user record in PrivaPaste’s shared CloudKit container using a one-way hash. This links Premium across iOS and macOS with the same iCloud account, even when clipboard sync is off. Without iCloud, RevenueCat uses a local anonymous identifier. We do not send your raw CloudKit user identifier, name, email or clipboard content to RevenueCat. RevenueCat also provides purchase analytics, such as subscription status, renewals and aggregate revenue, using this identifier and transaction data. Apple handles payment credentials.

PrivaPaste does not require a separate app account. Premium sharing uses your existing iCloud account. We do not collect your name, e-mail address, contacts, location, or device identifiers for advertising. Apart from the purchase analytics described above, we do not use app-usage analytics, crash-reporting or advertising tracking SDKs.

3. Where data is stored

  • On your device. All clipboard history and settings are stored locally in the app’s protected container. Protection at rest depends on your operating system and device security settings. The trial start date is stored in the system Keychain and may survive reinstallation.
  • iCloud (optional). If you enable iCloud sync, non-secure items are synced through Apple’s CloudKit into your own private iCloud database. Apple stores this data under its own privacy terms; we have no access to it and cannot read it. Changes to sync settings may require restarting the app. Turning sync off does not itself delete existing cloud data. Manage cloud data through the app and your Apple account settings. Secure items sync only when the separate Secure sync setting is enabled.
  • Silent push notifications. iCloud sync uses silent notifications delivered by Apple so that devices learn about changes; the app then retrieves changes from CloudKit.

Link previews

When link previews are enabled, PrivaPaste fetches metadata or images from the linked website. That website can receive the requested URL and your IP address, and a one-time link may be activated. You can turn previews off in Settings. Clipboard contents are not sent to an advertising service.

4. Permissions and extensions

  • Keyboard extension (iOS). The PrivaPaste keyboard lets you paste clips from any app. It asks for “Allow Full Access” only because iOS requires it for the keyboard to read the clips stored by the main app in the shared container. The keyboard does not record what you type, does not send anything over the network, and works without Full Access with reduced functionality.
  • Accessibility (macOS). If you enable “paste automatically”, PrivaPaste asks for the Accessibility permission solely to send a Command-V keystroke to the app you are pasting into. It does not read screen contents or monitor other apps.
  • Pasteboard access. Reading the system clipboard is the app’s function. On iOS you may see the system paste banner when the app reads the clipboard.
  • Face ID / Touch ID. Used only to unlock the Secure area; biometric data never leaves the device and is handled by the operating system.

5. Purposes and legal bases (GDPR / UK GDPR)

  • Providing the clipboard history and paste features you asked for — performance of a contract (Art. 6(1)(b)).
  • Optional iCloud sync, keyboard Full Access and macOS auto-paste — your consent, given by enabling the feature (Art. 6(1)(a)); you can withdraw it at any time by turning the feature off.
  • Verifying purchases and preventing fraud — performance of a contract and our legitimate interest in operating the service (Art. 6(1)(b) and (f)).
  • Understanding subscription activity and aggregate purchase performance — our legitimate interest in operating and improving the paid service (Art. 6(1)(f)).
  • Responding to support requests you send us by e-mail — legitimate interest (Art. 6(1)(f)).

Under KVKK, the same processing relies on Article 5(2)(c) (necessary for the performance of a contract), Article 5(2)(f) (legitimate interests) and, for optional features, your explicit consent (Article 5(1)).

6. Sharing and international transfers

We do not sell, rent or share personal data for advertising. Data is shared only with:

  • Apple — iCloud/CloudKit storage, push delivery, App Store purchases. Apple may process data outside your country under its own safeguards.
  • RevenueCat, Inc. (USA) — purchase verification and purchase analytics using an app-generated identifier, transaction information and technical request data.

When link previews are enabled, the destination website also receives network requests. Service providers may process information outside your country. See Apple’s privacy policy and RevenueCat’s privacy policyfor their processing and safeguards. Contact us with questions about transfers.

7. Retention

  • Clipboard history is kept until you delete it or it is removed under the applicable history limit. Pinned and Secure items are handled separately. App removal may leave shared-container or Keychain data; delete items in the app before uninstalling if you want them removed.
  • iCloud data is kept in your iCloud account until you delete it or disable sync and remove the app’s iCloud data.
  • Purchase records are kept by Apple and RevenueCat for as long as needed to honour your subscription and meet legal obligations.
  • Support e-mails are kept for up to 24 months.

8. Security

Data is stored in the app’s sandboxed container with operating-system protections, the system Keychain and device authentication for the Secure area. The macOS app runs inside the App Sandbox. Sync uses Apple’s encrypted CloudKit transport. No method of storage is perfectly secure, so keep your device passcode or login password private.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict the processing of your personal data, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with a supervisory authority (for example your EU data protection authority, the UK ICO, or the Turkish Personal Data Protection Authority, KVKK Article 11). Because your data lives on your devices and in your own iCloud account, most of these rights can be exercised directly in the app: delete individual clips, clear history, disable sync or delete the app. For anything else, e-mail us and we will respond within 30 days.

10. California residents (CCPA/CPRA)

We do not sell or share personal information, and we do not use it for cross-context behavioural advertising. You have the rights to know, delete, correct and to non-discrimination described above.

11. Children

PrivaPaste is not directed to children under 13 (or the age required in your country, e.g. 16 in parts of the EU) and we do not knowingly collect their data.

12. Changes

We will post any changes on this page and update the date above. Material changes will also be announced inside the app.

13. Contact

Questions or requests: support@moonshotlabs.app.Terms of Use. Support page: moonshotlabs.app/privapaste/support.