Privacy Policy

FileClipSync is built on a simple principle: your data is yours. We run no servers that store your content, we do not require an account, and we cannot read what you capture. This policy explains, in plain language and in line with the EU General Data Protection Regulation (GDPR) and the Dutch implementing law (UAVG), exactly what that means - and the small amount of personal data we do handle when you contact us or buy the app.

1. Who is responsible (Data Controller)

The controller responsible for personal data processed in connection with FileClipSync and this website is:

A Plus Apps (KVK 42096454)
Netherlands
Email: [email protected]

We are established in the European Union, so an Article 27 representative is not required. We have not appointed a Data Protection Officer, as the scale and nature of our processing does not require one under Article 37 GDPR; privacy questions reach a real person at the address above. Our full company details are on the Legal Notice page.

2. Privacy by design - what never reaches us

FileClipSync has no backend that receives your files, clipboard, or vault items. Your captured content is processed entirely on your own devices and, when you sync, inside your own iCloud. We have no technical ability to access, read, or recover it.

3. What we do not collect

• No accounts, sign-ups, names, or profiles to use the app.
• No usage telemetry, crash tracking, advertising identifiers, or device fingerprinting in the app.
• No collection of the contents of anything you capture, copy, or store.
• We never sell or share your personal data, and we do not use it for advertising or profiling.

4. Where your data lives

Shelf items, clipboard history, and vault entries are stored locally on your device. Items placed in the Private Vault are encrypted with keys generated in your device's Secure Enclave and protected by Touch ID. Nothing in the vault leaves your device unless you explicitly sync it.

5. How sync works

FileClipSync offers two sync paths, both end-to-end encrypted with AES-256-GCM using keys exchanged directly between your devices (P-256 ECDH):

• Local (same network): devices on the same network communicate directly - between Apple devices over Multipeer Connectivity, and with Android, Windows and Linux companions over the local network. Data never leaves your local network and never touches a server.
• Relay (iCloud / CloudKit): when devices are apart, encrypted payloads pass through your own private iCloud database. Apple cannot read them, and neither can we - we operate no relay servers. This relay is available between Apple devices only; non-Apple devices sync solely over the local network. This processing is governed by Apple's Privacy Policy.

6. The limited personal data we do process

We only process personal data in these specific situations. For each, the table sets out the data, the purpose, and the legal basis under Article 6(1) GDPR.

Context	Data	Purpose	Legal basis	Retention
Support / contact email	Your email address and the contents of your message	To answer your question and provide support	Legitimate interests, Art. 6(1)(f) - responding to enquiries	Until resolved, then deleted within 24 months
Launch / update notifications	The email address you send us	To notify you when the app or an update is available	Consent, Art. 6(1)(a) - withdrawable at any time	Until you unsubscribe or the notice is sent, whichever is first
App Store purchases	Handled entirely by Apple as merchant of record; we never receive your payment details	Purchase, billing, and refunds via the App Store	Apple is the controller for this data	Per Apple's policies
Direct purchases (if/when offered)	Name, email, billing details - processed by Paddle.com, acting as merchant of record. We receive only order and receipt information.	To complete your purchase, deliver the licence, and handle refunds	Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) for invoices	As required by Dutch tax law (7 years)
Website hosting	Standard server logs (IP address, browser/user-agent, timestamp, page requested)	Securely deliver the site and prevent abuse	Legitimate interests, Art. 6(1)(f) - security and delivery	Short-lived; rotated by Cloudflare and our host

7. Cookies, analytics & tracking

FileClipSync's own website code sets no cookies and loads no analytics, tags, or third-party trackers. Fonts are self-hosted and no external scripts run.

Our website is delivered through Cloudflare (in front of our hosting provider), which acts as a security proxy and content-delivery network. To protect the site and route traffic, Cloudflare processes your IP address and standard request data, and may set strictly-necessary cookies (for example __cf_bm for bot management and cf_clearance for security challenges). Under the ePrivacy Directive (Art. 5(3)) these are exempt from consent, as they are essential to deliver the service you requested; the legal basis for the related IP processing is our legitimate interest in security (Art. 6(1)(f) GDPR). See Cloudflare's privacy policy.

Cloudflare also gives us aggregate, server-side traffic statistics as part of its CDN. This is derived from server logs, is cookieless, does not track you across sites, and is not used to build a profile of you. We run no advertising trackers and no other analytics. Because only strictly-necessary cookies are in use, a consent banner is not legally required - so this site shows none. Should we ever add optional analytics, nothing non-essential will run without your prior opt-in consent, collected before any such technology loads.

Name	Set by	Purpose	Type
__cf_bm	Cloudflare	Tells humans from bots; abuse protection	Strictly necessary (≈30 min)
cf_clearance	Cloudflare	Stores the result of a security challenge	Strictly necessary

Full details, including how to manage cookies in your browser, are on our Cookie Policy page.

8. Recipients & processors

We share personal data only with service providers acting as our processors or independent controllers, strictly to provide the service:

• Apple - App Store sales (merchant of record) and the iCloud/CloudKit relay (your own iCloud).
• Paddle.com - direct (non-App-Store) purchases, if and when we offer them, as merchant of record.
• Cloudflare (CDN/security) and our hosting provider, whose data centre is in Frankfurt, Germany (EU) - website delivery, security, and hosting.
• Google (Google Workspace) - our email service, used to receive and answer your messages.

There are no ad networks, data brokers, or sale of data. Where required, we have data-processing agreements (Art. 28 GDPR) in place with these providers.

9. International data transfers

Some providers above (for example Apple, Google, Cloudflare, and Paddle) may process data outside the European Economic Area, including in the United States. Where that happens, the transfer is protected by an appropriate safeguard under Chapter V GDPR - typically the European Commission's Standard Contractual Clauses and/or an adequacy decision (such as the EU–US Data Privacy Framework). You can request details using the contact above.

10. Your rights

Under the GDPR you have the right to: access your data; have it rectified or erased; restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing). To exercise any of these, email [email protected]; we respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Postbus 93374, 2509 AJ Den Haag - autoriteitpersoonsgegevens.nl. You may also complain to the authority in your own EU country.

11. US, India & other regional privacy rights

United States: if you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined, and we do not process sensitive personal information to infer characteristics. We will not discriminate against you for exercising these rights. Residents of other US states with comparable laws (e.g. Virginia, Colorado, Connecticut, Utah) may exercise equivalent rights. To make a request, email [email protected].

India: we handle personal data of individuals in India in line with the Digital Personal Data Protection Act, 2023 (DPDP Act). You have the right to access, correct, and erase your personal data and to grievance redressal. To raise a grievance, email us with "DPDP grievance" in the subject; if you are not satisfied with our response, you may escalate to the Data Protection Board of India.

Everywhere else: we apply the GDPR-level protections described in this policy to everyone, wherever you are.

12. Children

FileClipSync is not directed to children. We do not knowingly collect personal data from children under 16 (the digital-consent age in the Netherlands). If you believe a child has provided us personal data, contact us and we will delete it.

13. Security

We apply appropriate technical and organisational measures (Art. 32 GDPR), including end-to-end encryption of synced content, hardware-backed key storage, and data minimisation by design. No method of transmission or storage is perfectly secure, but our architecture is built so that the most sensitive data never leaves your control.

14. Changes

If this policy changes, we will update the date above and post the revised version here; material changes will be highlighted.

15. Contact

Questions about privacy or your rights? Email [email protected]. Our full legal details are on the Legal Notice / Imprint page.