Privacy Policy

The short version. ClipScrub processes your notes, screenshots and files entirely on your Mac. The app does not send that content to us or to anyone else — there is no telemetry, no account, and no network connection to describe. This policy is therefore almost entirely about the website, which collects your email address if you sign up for the download, and whatever you send us if you use the feedback form. We don’t sell it, we don’t profile you, and we don’t run ads.

1. Who we are

Tugboat Coding Limited (registered in England and Wales, company number 11118743), of 86-90 Paul Street, London EC2A 4NE, is the data controller for this website. Contact us at hello@clipscrub.com.

2. What the app does with your data

Nothing reaches us. Specifically:

• Detection and redaction happen on your device, using Apple’s on-device frameworks (Vision for OCR, faces and barcodes) and, when Apple Intelligence is enabled, Apple’s on-device model.
• The app has no network entitlement at all. It is sandboxed without network.client or network.server, so it cannot make a network request even if it tried. You can verify this yourself on the downloaded app with codesign -d --entitlements - /Applications/ClipScrub.app.
• We receive no telemetry, no analytics, no crash data and no usage data from the app.
• Your originals and redacted copies stay on your Mac. We never see them.
• The app keeps an audit log of what each redaction removed — counts and fingerprints, never the text itself. It also records the name of the file an entry wrote, which app the content came from, and your Mac account name, so an entry can be tied to the work and to the person who did it. It is sealed on disk with AES-GCM under its own key in your Mac’s Keychain, and it stays on your Mac like everything else here. If you download a copy of the log yourself, that copy is readable.

Because your content never reaches us, we cannot access, recover or disclose it — including if we were compelled to.

3. What the website collects

When you sign up for the download we store one record. This is all of it:

What	Why
Your email address	To email you about ClipScrub (section 4)
The date you signed up	Retention (section 9)
Which version of these terms you agreed to, and the stage the product was at	To show what you were told at the time
Whether we have already emailed you, and when	So the form can’t be used to email an address repeatedly (section 6)
A one-time token for your unsubscribe link	So the link in your email works, and keeps working
Whether you’ve unsubscribed, and when	So we don’t email you again (section 5a)
A separate token for your download link	So your download link works, and only yours
How many times you’ve downloaded the app, and when you first and last did	So we know how many people use ClipScrub — the app itself tells us nothing (section 2)

The download count deserves a plain explanation, because it is the one thing here that looks like tracking. The app has no network access at all, so it never reports that it was launched, installed, or used. The only moment we can observe is the download itself, on our own server. We record that it happened and when — not your IP address, not your browser, not your Mac. If you download twice, that is a count of two against one record, which is why the dates are there: they are what tell “one person, twice” apart from “two people”.

That’s the whole record. We do not store your IP address, your browser’s user-agent string or your country. Bot-protection and rate-limiting checks happen at Cloudflare’s edge, before the request reaches us, so your IP is never passed to our database at all.

Buying a licence. Payment is handled by Polar, our merchant of record, on Polar’s own checkout — we never see or store your card details, and no part of this site asks for them. From a completed purchase we receive only your email address and which plan you bought, so that we can email you your licence key (section 7).

We don’t ask for health information anywhere on this site.

Feedback. The ClipScrub app’s Send Feedback command opens a page on this site. What you send us — your message, the category you pick and anything you include with it (such as contact details, so we can reply) — is stored in the same EU database and emailed to us so we can read, answer and act on it. When the app opens that page it also passes its own version number (for example “1.0 (12)”), which is stored with your message so we know which build a problem came from — it says nothing about you or your Mac, and it is absent if you open the feedback page yourself. That is the only thing the app ever puts in a web address, and it only happens when you choose to send feedback. Contact details are optional; without them we have no way to reply. Please don’t put PHI or PII in a feedback message — unlike the redaction the app does entirely on your Mac (section 2), a feedback message is something you choose to send us.

4. How we use it

We use your email address to email you about ClipScrub: to acknowledge your signup, to send you your download link, and to tell you about the product after that. If you buy a licence, we also use the address Polar passes us to send you your key and to help you with it afterwards.

We use it for this and nothing else. We do not sell personal data, and we do not share it for anyone else’s marketing.

You can unsubscribe from any email — see section 5a.

5. Legal basis

We process your email address on the basis of your consent (UK GDPR Art. 6(1)(a), and PECR reg. 22 for the email itself). You give it by ticking the box and submitting the form. You can withdraw it at any time, and withdrawing is as easy as giving it was.

If you buy a licence, we process your email address and your purchase to give you what you paid for — to send you your key and to support it — on the basis of our contract with you (UK GDPR Art. 6(1)(b)). That does not need your consent and withdrawing consent to marketing email does not take it away from you.

We record which version of this notice you agreed to.

5a. Unsubscribing

Every email we send includes an unsubscribe link. Your mail app may also show its own unsubscribe button at the top of the message; both do the same thing.

When you unsubscribe, we mark your record do-not-email and stop sending. We keep the record rather than deleting it, so that we can honour the request and so that the same address is not simply added again. It then holds what is listed in section 3, plus the date you unsubscribed.

If you clicked by mistake, the unsubscribe page has a button that puts you back on the list, for an hour afterwards. It works from the link in your email. After that hour, email hello@clipscrub.com and we’ll do it by hand.

If you would prefer your record to be deleted entirely, email hello@clipscrub.com — see section 11.

6. If you didn’t sign up

Anyone can type someone else’s address into a form. If someone did that with yours, you will have received one acknowledgement email. We record when an address has been mailed, so submitting it again does not send another.

That email includes an unsubscribe link. Use it, or email hello@clipscrub.com, and we will mark the address do-not-email and stop. Once an address is unsubscribed, submitting this form again sends nothing to it at all.

7. Who we share it with

Provider	Purpose	What they get
Cloudflare	Hosting, our database (D1, EU) for signups and feedback, bot protection (Turnstile), and — if you buy — a short-lived key-value record that stops one purchase being fulfilled twice	Request metadata and your IP for bot protection and rate limiting; your email — and any feedback you send — is stored in our D1 database, which is provisioned in the EU. A buyer’s email is also held for 30 days in Cloudflare’s key-value store, which is not EU-provisioned (section 9, section 10)
Resend	Sending the email we send you about ClipScrub, relaying feedback you send us to our inbox, and emailing your licence key when you buy	Your email address, the contents of any feedback you send, and — when you buy — your licence key, which travels in the body of that email
Polar	Taking payment for a licence, as our merchant of record (Polar Software Inc., US)	Your email address and your payment details, entered on Polar’s own checkout — Polar uses Stripe as its payment processor

That’s the entire list. We may also disclose information if required by law.

8. Cookies and analytics

This site sets no cookies of its own, loads no analytics script, and does not track you across sites. There is no beacon on this page. That’s why you’re not reading a cookie banner.

Cloudflare serves the site and records request metadata at its edge as part of doing so (section 7). We do not add any analytics of our own on top of that.

The Cloudflare Turnstile widget on the signup form may set strictly necessary storage in order to function. It loads only when you interact with the form — not on page load.

9. Retention

We keep your record while you’re subscribed — until you unsubscribe, until we tell you we have stopped working on ClipScrub or until you ask us to delete it.

If you unsubscribe, we keep the record marked do-not-email (section 5a) so that we can honour the request. You can ask us to delete it at any time — see section 11.

A purchase leaves us almost nothing. We do not store your licence key and we never hold your card details — Polar holds the sale record as merchant of record (section 7).

The one thing we keep is your email address, stored against the reference the payment system stamps on its message to us, for 30 days. Its only job is to stop a repeat of that message sending you a second key. It is not in our signup database: it sits in a separate Cloudflare key-value store which, unlike that database, is not EU-provisioned (section 10). It deletes itself when the 30 days are up — that one is on a timer, unlike everything else below.

We keep feedback you send us for as long as it is useful for fixing and improving ClipScrub. Ask us to delete a message (section 11) and we will.

Deletion is done by hand, not on a timer.

10. International transfers

Your signup record is stored in the EU — our Cloudflare D1 database is provisioned with EU jurisdiction. However, Resend, our email provider, stores account data including email metadata and logs in the United States, regardless of the sending region. That transfer relies on Standard Contractual Clauses.

If you buy a licence, two more things leave the EU:

• Polar (Polar Software Inc.) is US-based and processes your purchase in the United States.
• The 30-day record described in section 9 is held in Cloudflare’s key-value store, which offers no EU-only setting: Cloudflare writes it to central data stores and caches it in its own data centres wherever it is read. We are not able to pin it to the EU the way we pinned the database.

Both transfers rely on Standard Contractual Clauses.

You can read the clauses. Naming a safeguard is not much use if you cannot see it, so: email hello@clipscrub.com and we will send you a copy of the Standard Contractual Clauses we rely on for any provider named above. The European Commission also publishes the standard text at commission.europa.eu.

11. Your rights

Under UK/EU GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it or port it elsewhere. You can withdraw consent at any time.

To do any of these, email hello@clipscrub.com. We’ll respond within one month.

You can also complain to the Information Commissioner’s Office (ico.org.uk), the UK supervisory authority.

We do not sell or “share” personal information as those terms are defined under US state privacy laws.

12. Children

This site and the app are intended for users 18 and over. We do not knowingly collect personal information from children.

13. Changes

We may update this notice from time to time. The version on this page is always the current one, and the date at the top shows when it last changed — checking here is how you stay current; we don’t email you for every change.

Your consent is recorded against the version of this notice you agreed to. We won’t use personal data we already hold for a materially new purpose without a lawful basis — and where that basis is your consent, that means asking you first.

14. Contact

hello@clipscrub.com, or Tugboat Coding Limited, 86-90 Paul Street, London EC2A 4NE, United Kingdom.