Privacy Policy for Clipfile

Last updated: September 26, 2026

Clipfile (“the app”) is designed to respect your privacy. This document explains what data the app handles, where it is stored, and how it is used.

Summary

Clipfile does not collect personal information about you. The data it stores is the URLs and page titles you explicitly choose to save, along with read/unread status and timestamps, plus — for articles you save for offline reading — the readable text of those articles. That data is stored on your own devices and synced between them via a small cloud relay operated by the developer, solely so your saved list stays up to date across your iPhone, iPad, and Mac. Offline article text is encrypted on your device before it is synced, so the cloud relay stores it only as ciphertext, and it is never shared with anyone. Because that encryption key is derived from the same sync key that authenticates you to the relay, the relay does receive the key; it never decrypts your articles and never stores them in readable form, but it is capable of doing so. See “How your data is stored” below. Your saved titles and URLs are stored without encryption, because the relay reads them to suggest folder names. To sort your saved links into folders automatically, the title and URL of a saved link — never the article text, and no information about you — are sent to Google’s Gemini API to suggest a folder name. That is the only third party that receives any of your data, it is used solely to categorize your links, and under Google’s paid API terms this data is not used to train Google’s models. Your data is never sold.

Data the app stores

When you save a page, the app stores:

• The URL of the page
• The title of the page (typically the <title> of the HTML document)
• A timestamp for when you saved it
• A timestamp for when you last changed it
• A read/unread flag
• A flag marking whether you've deleted it, so the deletion can sync to your other devices
• Any optional notes / context that you add to the notes field for a URL
• A short folder name used to group the item, suggested automatically (see “AI folder organization” below)
• For any article you save for offline reading: the readable text of that article (extracted from the page and cleaned up for reading), so it stays available without a network connection. This text is kept in a local on-device cache, and — if synced — is encrypted on your device before upload, so the cloud relay stores it only as ciphertext.

That is the entirety of what is stored. The app does not collect or transmit:

• Your name, email address, or any account information
• Device identifiers or advertising identifiers
• IP addresses (any server you connect to necessarily sees yours; the relay does not record it, except briefly to limit pairing-code guesses, as described under “Linking your devices”)
• Your browsing history outside the pages you choose to save
• Location data
• Analytics, telemetry, or crash reports of any kind
• Contacts, calendar, photos, or any other on-device data

Where the data is stored

Saved items are stored in two places:

1. Local storage on each device (an App Group container on iOS; on a Mac, the app’s preferences and its folder in Application Support; or the browser’s local extension storage) so the app and any browser extension can read and write to the list immediately, even offline. The readable text of articles you save for offline reading is kept in a separate on-device cache on the same device.
2. A cloud sync store, hosted on Cloudflare Workers and operated by the developer, used to relay your saved list — and the encrypted text of your offline articles — between your own devices, and to request folder suggestions as described under “AI folder organization” below. Access requires a private sync key that is generated on your device, and the key that encrypts the text of offline articles is derived from that same sync key. The store therefore holds only ciphertext for article text — but because the sync key is sent with every request, the relay necessarily receives the material the key is derived from. It does not decrypt anything and does not retain anything in readable form, and no article text is logged. It is, however, technically able to, which is why this is described as encryption at rest with a key the relay handles rather than as end-to-end encryption. Your saved titles and URLs are held unencrypted, because the relay reads them to request folder suggestions. Aside from that automated categorization, the developer does not separately access, read, or analyze your data.

Apart from two things described below — Apple’s iCloud Keychain carrying your sync key between your devices, and the Mac app’s check for updates — the only network calls the app and extension make are to this cloud sync service, to push and pull your own saved list. The sync service in turn forwards the title and URL of saved links to Google’s Gemini API for folder categorization, as described under “AI folder organization” below; the app and extension never contact Google directly, and the article text of offline saves is never sent.

AI folder organization

To keep your saved list tidy, the app can automatically sort saved links into folders (such as “Tech,” “Recipes,” or “News”). This works as follows:

• The cloud sync service sends the title and URL of links that do not yet have a folder to Google’s Gemini API, which suggests a short folder name for each. The suggested name syncs back to your devices like any other field.
• Only the title and URL are sent. The readable text of your offline articles is never sent to Google — it is encrypted before it leaves your device and is never transmitted to any third party in readable form. No account information, device identifiers, or information about you is sent, because the app does not hold any.
• Google acts only as a processor for this categorization. Under the terms of Google’s paid Gemini API, the data sent is not used to train Google’s models and is not used for advertising.
• Folders are only ever suggested for links that do not already have one; the feature never re-reads or re-categorizes links you have already filed, and a folder you set yourself is never overwritten.

Clipfile for Mac

Clipfile for Mac is a menu-bar app, distributed as a notarised download from outside the Mac App Store. It saves pages from Safari, Chrome, Helium and Brave (and other Chromium browsers that support AppleScript) without a browser extension, as follows:

• Automation (Apple Events) permission. macOS asks you once per browser whether Clipfile may control it. You can withdraw this at any time in System Settings → Privacy & Security → Automation.
• Only when you save. When you press the save shortcut or choose Save Current Tab from the menu, Clipfile asks the browser for the frontmost tab’s URL, title and page content (its source or text), in your own logged-in session. It does not read other tabs, does not read pages you have not chosen to save, and does nothing in the background. In Chromium browsers the page is handed over as a temporary file, which Clipfile deletes straight away, though the browser may list it in its download history. If you have separately turned on your browser’s “Allow JavaScript from Apple Events” setting, Clipfile may instead run its bundled reader script in that tab to extract the article.
• Processed on your Mac. The article text is extracted on your Mac and stored as that item’s offline copy; before it is synced it is encrypted on your Mac exactly as described above, so the relay stores only ciphertext.
• Update check. Once a day the app checks for a new version by fetching an update feed hosted on GitHub, and downloads the update from GitHub if you choose to install it. This is an ordinary web request that identifies the app and its version, as any web request does; it carries no system profile and none of your saved data. GitHub, like any web host, sees your IP address.
• Buying it directly. If you buy Clipfile for Mac on mikeshear.com rather than on the App Store, the checkout is run by Stripe, which acts as the seller: it collects your name, email address, billing address and payment details under Stripe’s privacy policy. The license you receive carries your name and email address so the app can say whose it is; it is kept and checked on your Mac, and nothing about it is sent anywhere. A Mac holding such a license also downloads, once a day, a small public list of refunded licenses from GitHub and compares it with the license on your Mac. That request carries nothing about you, and a Mac without a direct license never makes it.

Linking your devices

• iCloud Keychain. The iPhone, iPad and Mac apps keep your sync key in your keychain, marked to sync, so that if you use iCloud Keychain a new Apple device picks it up by itself. That sync is performed by Apple, not by Clipfile or its relay, and Apple describes iCloud Keychain as end-to-end encrypted. If iCloud Keychain is off, the key stays on the device.
• Pairing codes. For a device iCloud Keychain can’t reach, a device that already has your list can show a pairing code. Doing so sends your sync key to the relay, which holds it under that code for at most five minutes. The code is 8 characters and works once: entering it on the new device returns the key and deletes it from the relay, and an unused code simply expires. To limit guessing, failed attempts to use a code are counted per IP address for about two minutes. Anyone who has a live code can obtain your sync key, so treat it like the key itself.
• You can also copy the sync key between devices by hand.

Browser extensions (being retired)

The browser extensions are being retired and are no longer the way to save on a Mac. For as long as it remains installable, the older optional Chromium browser extension stores the same fields (URL, title, timestamps, read flag, deleted flag, notes) using the browser’s local extension storage, and syncs them with the same cloud sync service described above. When you save an article for offline reading, the extension reads the content of that page — only at the moment you choose to save it — using bundled, on-device reader libraries, to extract the article text for the offline copy. It does not read or monitor pages you have not chosen to save, and it does no background browsing.

Permissions the iOS app requests

• Network access — to sync your saved list with the cloud sync service described above, across your own devices.
• Share Extension activation — when you choose Clipfile from the iOS share sheet, the extension reads the URL being shared so it can save it. It does not read anything else.
• Safari Web Extension permissions — when enabled in Safari, the extension reads the URL and title of the page you are currently looking at, but only when you tap its toolbar icon.
• Siri / Shortcuts intent — when you invoke the app’s save action via Siri or Shortcuts, the URL you provide is saved.

Third parties

Clipfile does not use any third-party analytics, advertising, crash-reporting, attribution, or tracking SDKs. The Mac app includes the open-source Sparkle framework solely to check for and install updates, as described under “Clipfile for Mac” above.

The one third party involved is Google, whose Gemini API is used solely to suggest folder names from the title and URL of your saved links, as described under “AI folder organization” above. This is the only case in which any of your data is shared with a third party, it is limited to titles and URLs (never article text or any information about you), and under Google’s paid API terms it is not used to train Google’s models or for advertising. No other third party has access to your data. (GitHub hosts the Mac app’s update feed and downloads but receives none of your data, and Apple’s iCloud Keychain carries your sync key only between your own devices, as described above.)

Your control over your data

You control your saved list completely:

• Delete an individual saved item from within the app or extension at any time — the deletion syncs to your other devices.
• Uninstall the app, which removes all locally stored data on that device. (On a Mac, moving the app to the Trash leaves its preferences and cached articles in your Library folder until you delete them.)
• To request removal of your data from the cloud sync store, contact the developer at the email address below.

Children’s privacy

The app is not directed to children under 13 and does not knowingly collect any personal information from anyone, regardless of age.

Changes to this policy

If this policy changes in a meaningful way, the updated version will be posted at this URL and the “Last updated” date at the top will be revised.

Contact

Questions or concerns about this privacy policy: shearm@mac.com