Privacy Policy

The short version. ClipScrub processes your notes, screenshots and files entirely on your Mac. The app does not send that content to us or to anyone else. It has no account or telemetry. Optional update checks contact clipscrub.com through the bundled updater. They never include document contents or licence keys. This policy is therefore mainly about the website, which collects your email address if you choose to sign up for updates, and whatever you send us if you use the feedback form. We don’t sell it, we don’t profile you, and we don’t run ads.

1. Who we are

Tugboat Coding Limited (registered in England and Wales, company number 11118743), of 86-90 Paul Street, London EC2A 4NE, is the data controller for this website. Contact us at hello@clipscrub.com.

2. What the app does with your data

Your content never reaches us. Specifically:

• Detection and redaction happen on your device, using Apple’s on-device frameworks (Vision for OCR, faces and barcodes) and, when Apple Intelligence is enabled, Apple’s on-device model.
• The main app remains sandboxed without network.client or network.server. Sparkle’s separate, signed downloader contacts only the update feed and archive routes after you request a check or consent to daily checks.
• Update requests include ordinary HTTP metadata. Cloudflare receives the connecting IP while it serves the request. We do not add these requests to signup records, download attribution or app analytics.
• We receive no telemetry, no analytics, no crash data and no usage data from the app.
• Your originals and redacted copies remain on your Mac. We never see them.
• The app keeps an audit log of what each redaction removed — counts and fingerprints, never the text itself. It also records the name of the file an entry wrote, which app the content came from, and your Mac account name, so an entry can be tied to the work and to the person who did it. It is sealed on disk with AES-GCM under its own key in your Mac’s Keychain, and it remains on your Mac like everything else here. If you download a copy of the log yourself, that copy is readable.

Because your content never reaches us, we cannot access, recover or disclose it — including if we were compelled to.

3. What the website collects

Downloading needs no email and no account, and a download on its own creates no record of you. If you sign up for updates, we store one record. This is all of it:

What	Why
Your email address	To email you about ClipScrub (section 4)
The date you signed up	Retention (section 9)
Which version of these terms you agreed to, and the stage the product was at	To show what you were told at the time
Whether we have already emailed you, and when	So the form can’t be used to email an address repeatedly (section 6)
A one-time token for your unsubscribe link	So the link in your email works, and keeps working
Whether you’ve unsubscribed, and when	So we don’t email you again (section 5a)
A separate token for the download link in your email	So a download can be matched to your record — it does not unlock anything
How many times you’ve downloaded the app, and when you first and last did	So browser downloads provide a coarse measure without app usage telemetry (section 2)

The download count deserves a plain explanation, because it is the one thing here that looks like tracking. ClipScrub sends no launch, usage or redaction telemetry. The only attributed event is the browser download itself. We record that it happened and when — not your IP address, not your browser, not your Mac. If you download twice, that is a count of two against one record, which is why the dates are there: they are what tell “one person, twice” apart from “two people”.

The download itself is open, so most downloads match no record at all. Every download also adds one to a daily tally, and that tally is kept as three numbers a day: downloads that came from the link in your email, downloads that carried a link we could not match, and downloads that carried no link at all. A download from your link therefore does two things — it adds to that day’s tally, and it updates the count and dates described in the table above. Any other download only ever adds to the tally.

When a download link carries an approved campaign label, we also add one to a second daily tally. Its only fields are the date, a source label (such as github or macapps), a campaign label (such as pdf-mac) and a count. We reject other labels. This helps us learn which public page or community referral led to a download. It holds no address, token, IP address, browser or device.

Both tallies hold no identifier: no address, no token, no IP, no browser. They are counts against a date, and they are deliberately too coarse to say anything about any one person. We keep them because the app sends no usage telemetry (section 2). The tallies show whether people find ClipScrub.

After a licence email succeeds, we also add one to a daily purchase tally. Its fields are the date, a source label, campaign label and shared discount code, plus a count. The tally uses none when there was no discount and other for an individual or unlabelled code. It holds no buyer email, order reference or personal data.

That’s the whole record. We do not store your IP address, your browser’s user-agent string or your country. Bot-protection and rate-limiting checks happen at Cloudflare’s edge, before the request reaches us, so your IP is never passed to our database at all.

Buying a licence. Payment is handled by Polar, our merchant of record, on Polar’s own checkout — we never see or store your card details, and no part of this site asks for them. From a completed purchase we receive your email address and which plan you bought, so that we can email your licence key (section 7).

We don’t ask for health information anywhere on this site.

Feedback. The ClipScrub app’s Send Feedback command opens a page on this site. What you send us — your message, the category you pick and anything you include with it (such as contact details, so we can reply) — is stored in the same EU database and emailed to us so we can read, answer and act on it. When the app opens that page it also passes its own version number (for example “1.0 (12)”), which is stored with your message so we know which build a problem came from — it says nothing about you or your Mac, and it is absent if you open the feedback page yourself. That is the only thing the app ever puts in a web address, and it only happens when you choose to send feedback. Contact details are optional; without them we have no way to reply. Please don’t put PHI or PII in a feedback message — unlike the redaction the app does entirely on your Mac (section 2), a feedback message is something you choose to send us.

A file you attach to feedback. The feedback page lets you attach one file, up to 10MB — a screenshot, or a short text file. It is optional, and nothing attaches itself. You pick the file.

We store an attached file in Cloudflare R2 object storage provisioned with EU jurisdiction, the same EU-only arrangement as our database. Our own record of it is a single reference saying which file belongs to which message. We do not keep the name you gave the file.

The file itself goes to nobody outside that storage. Our email provider is told the reference, the file’s type and its size, so that we know a file is waiting and can go and read it — the file does not travel in that email (section 7). We are the only people who ever look at an attached file, and we delete an attached file automatically after 90 days (section 9).

The warning above applies here more than anywhere else on this site. A screenshot of the frame a detector missed still contains what it missed. Crop it, or describe the problem in words instead.

4. How we use it

We use your email address to email you about ClipScrub: to acknowledge your signup, to send you your download link, and to tell you about the product after that. If you buy a licence, we also use the address Polar passes us to send you your key and to help you with it afterwards.

We use it for this and nothing else. We do not sell personal data, and we do not share it for anyone else’s marketing.

You can unsubscribe from any email — see section 5a.

5. Legal basis

We process your email address on the basis of your consent (UK GDPR Art. 6(1)(a), and PECR reg. 22 for the email itself). You give it by ticking the box and submitting the form. You can withdraw it at any time, and withdrawing is as easy as giving it was.

If you buy a licence, we process your email address and your purchase to give you what you paid for — to send you your key and to support it — on the basis of our contract with you (UK GDPR Art. 6(1)(b)). That does not need your consent and withdrawing consent to marketing email does not take it away from you.

We record which version of this notice you agreed to.

5a. Unsubscribing

Every email we send includes an unsubscribe link. Your mail app may also show its own unsubscribe button at the top of the message; both do the same thing.

When you unsubscribe, we mark your record do-not-email and stop sending. We keep the record rather than deleting it, so that we can honour the request and so that the same address is not simply added again. It then holds what is listed in section 3, plus the date you unsubscribed.

If you clicked by mistake, the unsubscribe page has a button that puts you back on the list, for an hour afterwards. It works from the link in your email. After that hour, email hello@clipscrub.com and we’ll do it by hand.

If you would prefer your record to be deleted entirely, email hello@clipscrub.com — see section 11.

6. If you didn’t sign up

Anyone can type someone else’s address into a form. If someone did that with yours, you will have received one acknowledgement email. We record when an address has been mailed, so submitting it again does not send another.

That email includes an unsubscribe link. Use it, or email hello@clipscrub.com, and we will mark the address do-not-email and stop. Once an address is unsubscribed, submitting this form again sends nothing to it at all.

7. Who we share it with

Provider	Purpose	What they get
Cloudflare	Hosting, our database (D1, EU) for signups, feedback and daily aggregate counts, object storage (R2, EU) for a file you attach to feedback, bot protection (Turnstile), and — if you buy — a short-lived fulfilled marker that stops one purchase being fulfilled twice	Request metadata and your IP for bot protection and rate limiting; your email — and any feedback you send — is stored in our D1 database, which is provisioned in the EU, and a file you attach is stored in our R2 bucket, also provisioned in the EU. The purchase tally holds aggregate labels and counts. The fulfilled marker is held for 30 days in Cloudflare’s key-value store, which is not EU-provisioned (section 9, section 10)
Resend	Sending the email we send you about ClipScrub, relaying feedback you send us to our inbox, and emailing your licence key when you buy	Your email address, the contents of any feedback you send, and — when you buy — your licence key, which travels in the body of that email. A file you attach does not go to Resend: that email carries the file’s reference, type and size so we can go and read it, and the file itself remains in the EU
Polar	Taking payment for a licence, as our merchant of record (Polar Software Inc., US)	Your email address and your payment details, entered on Polar’s own checkout — Polar uses Stripe as its payment processor

That’s the entire list. We may also disclose information if required by law.

8. Cookies and analytics

This site sets no cookies of its own, loads no analytics script, and does not track you across sites. There is no beacon on this page. That’s why you’re not reading a cookie banner.

Cloudflare serves the site and records request metadata at its edge as part of doing so (section 7). The aggregate download and purchase tallies in section 3 are our only first-party measurement. The browser stores nothing for them.

The Cloudflare Turnstile widget on the signup form may set strictly necessary storage in order to function. It loads only when you interact with the form — not on page load.

9. Retention

We keep your record while you’re subscribed — until you unsubscribe, until we tell you we have stopped working on ClipScrub or until you ask us to delete it.

If you unsubscribe, we keep the record marked do-not-email (section 5a) so that we can honour the request. You can ask us to delete it at any time — see section 11.

A purchase leaves us almost nothing. We do not store your licence key and we never hold your card details — Polar holds the sale record as merchant of record (section 7).

We keep a fulfilled marker against the payment system’s delivery reference for 30 days. Its only job is to stop a repeat message sending a second key. It contains no buyer email or order data. It sits in a separate Cloudflare key-value store which is not EU-provisioned (section 10). It deletes itself when the 30 days are up. The daily purchase tally is an aggregate in our EU database and contains no buyer data.

We keep feedback you send us for as long as it is useful for fixing and improving ClipScrub. Ask us to delete a message (section 11) and we will.

A file attached to feedback is the exception, and it is on a timer. We delete an attached file automatically 90 days after you send it. A message is a paragraph we can read once and act on for months. An attached screenshot is the likeliest thing on this site to hold something we would rather not be keeping. So it does not get to sit here for as long as it remains useful. Ninety days is long enough to reproduce and fix what it shows. Ask us to delete one sooner (section 11) and we will.

Deletion is otherwise done by hand, not on a timer.

10. International transfers

Your signup record is stored in the EU — our Cloudflare D1 database is provisioned with EU jurisdiction, as is the R2 bucket holding any file you attach to feedback (section 3). However, Resend, our email provider, stores account data including email metadata and logs in the United States, regardless of the sending region. That transfer relies on Standard Contractual Clauses.

If you buy a licence, two more things leave the EU:

• Polar (Polar Software Inc.) is US-based and processes your purchase in the United States.
• The 30-day fulfilled marker described in section 9 is held in Cloudflare’s key-value store, which offers no EU-only setting. It contains no buyer data. Cloudflare writes it to central data stores and caches it in its own data centres wherever it is read.

Both transfers rely on Standard Contractual Clauses.

You can read the clauses. Naming a safeguard is not much use if you cannot see it, so: email hello@clipscrub.com and we will send you a copy of the Standard Contractual Clauses we rely on for any provider named above. The European Commission also publishes the standard text at commission.europa.eu.

11. Your rights

Under UK/EU GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it or port it elsewhere. You can withdraw consent at any time.

To do any of these, email hello@clipscrub.com. We’ll respond within one month.

You can also complain to the Information Commissioner’s Office (ico.org.uk), the UK supervisory authority.

We do not sell or “share” personal information as those terms are defined under US state privacy laws.

12. Children

This site and the app are intended for users 18 and over. We do not knowingly collect personal information from children.

13. Changes

We may update this notice from time to time. The version on this page is always the current one, and the date at the top shows when it last changed — checking here is how you remain current; we don’t email you for every change.

Your consent is recorded against the version of this notice you agreed to. We won’t use personal data we already hold for a materially new purpose without a lawful basis — and where that basis is your consent, that means asking you first.

14. Contact

hello@clipscrub.com, or Tugboat Coding Limited, 86-90 Paul Street, London EC2A 4NE, United Kingdom.