Privacy Policy

Nexa Clip · Effective 2026-10-19 · Last updated 2026-10-12

Notice of revision — announced 2026-10-12 · effective 2026-10-19

This revision brings the Policy fully in line with what the Software actually does. The main changes are:

  • New section on file sharing (Section 3-4): with sync enabled, the paths of files you copy are propagated to your approved devices, and file contents are transferred from the source device when you paste on the receiving device (files of 50 MB or less are fetched in advance in the background). This corrects the earlier statement that file contents and file paths were not propagated.
  • Where received files are stored (Section 2): received files are saved by default in a Nexa Clip folder under your Downloads folder, as ordinary, unencrypted files.
  • New section on licensing (Section 2-3): from v0.2.0, licenses are checked offline only; the Company receives the name, email address, and device code you send by email when you request a license.
  • Autostart corrected (Section 2-2): starting at login is on by default and is registered at first launch.

About our advance-notice commitment: Section 9 of this Policy promises at least 7 days’ notice before the kinds of items propagated by sync are expanded. However, the file-sharing feature shipped first in v0.1.4, released on 2026-09-14, and this Policy was not updated in time. From that date until this revision was posted, the Policy’s description therefore differed from the Software’s actual behaviour. Throughout that period, files travelled only between devices you had approved after turning sync on yourself, over an end-to-end encrypted channel, and neither the Company nor the relay server could see file names, paths, or contents. If you do not want file sharing, you can turn it off now in Settings › Sync, regardless of the effective date (Section 3-4). This page describes how the Software has actually behaved since v0.1.4; the revised terms take effect on 2026-10-19.

Nexa Clip (the “Software”) is a clipboard manager for Windows, macOS, and Linux distributed by SosomLab (the “Company”). This Privacy Policy explains what data the Software handles, where it is stored, what leaves your device over the network, what the relay server operated by the Company can and cannot see, and what the Company receives when you request a license.

1. Summary

  • By default the Software works entirely on your device. Unless you turn on sync, it makes no network connections at all, and the Company receives no data from the Software. License checks are also performed offline only (Section 2-3).
  • The Software contains no analytics, telemetry, advertising, or tracking. There is no account sign-up.
  • Your clipboard history is stored encrypted on your device (on by default) and can be deleted by you at any time.
  • Sync works only if you explicitly enable it (Sections 3 and 4), and even then the Software exchanges clipboard items and files only with devices you have approved, end-to-end encrypted (Noise). Whatever path the data takes, only the two devices can read it.
  • When you turn sync on, file sharing is on by default. The paths of files you copy are propagated to your approved devices, and file contents are transferred from the source device when you paste on another device (Section 3-4). Received files are stored in the receiving device’s Downloads folder as ordinary, unencrypted files.
  • If you choose a relay server to reach devices on other networks, the Software contacts the Company-operated server beepd.sosomlab.com. That server cannot read your clipboard or your files and stores nothing to disk.
  • The only time the Company receives your personal information is when you yourself send an email to request a license or ask a question (Section 2-3).

2. Data Stored on Your Device

The Software’s data folder is the data/ folder next to the executable (portable), data\ next to the install folder (Windows installer), ~/Library/Application Support/nexa-clip (macOS), or ~/.config/nexa-clip (Linux package). When started with --profile, a separate profiles/<name> subfolder is used. The only things created outside the data folder are the received-files folder and the machine-wide license folder, both listed separately in the table below.

ItemContentsStorage
Clipboard historyText, rich formats (HTML/RTF), native formats, images, and file paths you copied, plus each item’s source app, time, copy count, and pin state. Items received from other devices also record the source device name and file sizes and modification timesEncrypted (append-only segments + content-addressed blobs · ChaCha20-Poly1305 · per-file-type domain-separated keys)
Image thumbnailsReduced images shown in the listEncrypted (blob)
Device keyA 32-byte random secret that wraps the history master keyPlain (device.key — it is the root that encrypts the other files and cannot wrap itself; Unix mode 0600)
SettingsCapture, storage, paste, shortcut, appearance, search, and sync (including file sharing) options. If sync is enabled this includes your handle and pairing passphrasePlain (settings.cfg · Unix mode 0600)
Sync identity keyAn X25519 key pair identifying this device, created only when sync is enabledPlain (identity.key · Unix mode 0600)
Device listPublic-key fingerprint, name, OS, first/last seen time, and approval state of devices met through syncPlain (devices.txt)
Server pinThe relay server’s public key, pinned on first connectionPlain (server.pin)
Portal restore token (Linux)The desktop-portal approval token used for paste injectionPlain (user configuration folder · Unix mode 0600)
Received files (from v0.1.4 · when sync is enabled)Files received from your other approved devices, exactly as they were. While a download is in progress, a resumable .part file existsPlain — ordinary, unencrypted files. Default location is outside the data folder: <OS Downloads folder>/Nexa Clip/ (or cache/files in the data folder if no Downloads folder is found). Can be changed with the save-folder option in Settings › Sync
License file (from v0.2.0 · only if you install one)A license file signed and issued by the Company. It contains the licensee’s name, tier and type, issue date, update-until and expiry dates, and, if device-bound, device codesPlain (license/ in the data folder, or the machine-wide folder — Windows %ProgramData%\nexa\nexa-clip, macOS /Library/Application Support/nexa/nexa-clip, Linux /etc/nexa/nexa-clip)

Encrypted storage is on by default, with keys derived from device.key. Consequently, if your entire data folder is exposed, the device.key in the same folder can open the encrypted history — this design protects against segment/blob files leaking on their own and against residual bytes after deletion, not against an attacker who has your whole device. The Software documents this limitation in its repository.

Unlike your history, received files are not encrypted, and anyone or any program with access to that device can open them. Received files are deleted automatically, oldest first, once the save folder exceeds its size limit (2,000 MB by default), but they are not removed by deleting history items, “Clear history on exit”, or “Delete all records”. Delete any files you do not want to keep from the save folder yourself.

None of these files leave your device except as described in Sections 3 and 4, even when sync is enabled. You can delete individual history items from the list, wipe everything with “Clear history on exit” or “Delete all records” in settings, and permanently remove history, settings, and keys by deleting the data folder (the received-files folder and the machine-wide license folder must be deleted separately). If the device key changes, the old history is set aside as index.locked rather than deleted automatically. Old data may nevertheless survive in SSD wear-levelling areas or in backups you have made; the Software does not guarantee physical erasure.

2-1. What is not captured

  • Content carrying the operating system’s conceal marker used by password managers (Windows ExcludeClipboardContentFromMonitorProcessing, macOS org.nspasteboard.ConcealedType, KDE x-kde-passwordManagerHint) is not recorded by default.
  • Content copied from apps on your excluded-apps list, and anything copied while capture is paused, is not recorded.
  • Items larger than the configured size limit are not recorded.

Passwords, authentication tokens, and personal identifiers can pass through the clipboard. Sensitive content copied from apps that do not send the marker may end up in your history, so you should manage it with the excluded-apps list, retention period, and clear-on-exit settings.

2-2. System registration and permissions

Starting at login is on by default. On first launch the Software registers a user-level autostart entry (Windows HKCU\…\Run, macOS LaunchAgent, Linux XDG autostart); you can turn it off in Settings › General, which removes the entry. If you remove the entry outside the app, the Software does not re-register it and switches the setting off instead. Instances started with --profile never register autostart.

On macOS the Software asks for Accessibility permission to inject the paste keystroke and, when sync is enabled, for Local Network access to find your other devices on the same network. On Linux (GNOME/Wayland) it asks for desktop-portal approval for global shortcuts and key injection. It writes nothing else to the registry or system areas; the machine-wide license folder (Section 2) is used only if you install a license there.

2-3. Licensing (from v0.2.0)

  • Checks are offline only. The Software verifies the signature of a license file on your device and sends no data to the Company or any other server to check or activate a license. Noncommercial use needs no license file.
  • Device code: to bind a commercial license to a particular device, the Software computes, when needed, a device code that is a one-way hash (SHA-256) of the operating system’s machine identifier (Windows MachineGuid, macOS IOPlatformUUID, Linux /etc/machine-id). The original identifier is never exported, and the device code is not saved to a file.
  • Request code: the request code created on the license screen in Settings › Advanced › About (or with --license request) contains the device code, the OS type, the app version, the date it was created, and — if you enter them — your name and email address. A request code is encoded, not encrypted, so anyone holding it can read this information. The Software only copies the request code to your clipboard; it never transmits it anywhere.
  • What the Company receives: if you email a request code to [email protected], the Company receives the information in the code together with the email itself (sender address, message body, and so on). The Company uses this information only to issue, verify, and renew licenses and to correspond with you about them, keeps it for as long as needed to manage the licenses it has issued and to answer enquiries, and for any longer period required by applicable law. You may request access, correction, or deletion at any time (Section 7). Emails pass through the email services used by you and by the Company, whose own policies apply.

3. Data Sent on the Local Network (LAN) — when sync is enabled

3-1. Discovery beacons

With sync enabled, the Software broadcasts a UDP beacon (port 47301) every 5 seconds (30 seconds once a peer is connected) to find your other devices on the same network. These packets are not encrypted and contain only:

  • a hash tag derived from your handle and pairing passphrase — the handle and passphrase themselves are never sent, and the tag cannot be reversed;
  • the device public key;
  • the TCP port on which sessions are accepted.

Clipboard contents, files, settings, and device names are never placed in beacons. Because anyone on the same network can observe these packets, the fact that you are running the Software with sync enabled, and your device public key, are not hidden within the LAN.

3-2. Sessions

When one of your devices is found, the Software performs a Noise handshake over TCP; device-name exchange, approval information, clipboard items, file paths, and file contents then travel only through that encrypted session. The same end-to-end encrypted session is used whether the devices connect directly on the same network or through a relay server (Section 4). A network observer can see packet sizes and timing but not contents; when files are exchanged, the fact that a large transfer took place, and its volume, may be observable.

3-3. Nothing is sent before approval

Even for a connected device, the Software exchanges no clipboard items or files until you approve that device in the device list. Approval is done once per device after visually comparing the 6-digit code shown on both screens, and can be revoked or the device deleted at any time.

Approved devices receive:

  • plain text you copy;
  • images you copy (converted to PNG; scaled down if the longer side exceeds 4,096 pixels);
  • the list of paths of files you copy, with each file’s size and modification time (from v0.1.4 · Section 3-4). File names and folder structure are part of the paths;
  • the contents of those files — only when the receiving device requests them (from v0.1.4 · Section 3-4).

The following are not propagated: rich-text formats such as HTML/RTF formatting; file cut operations (items cut in Windows Explorer or a Linux file manager stay only in this device’s history); and items above the size limit (32 MB). Received items are stored in your history together with the source device name and are never sent back to the sender.

3-4. File sharing (from v0.1.4)

The Propagate file paths (sync.files) and Receive file contents (sync.file_contents) options in Settings › Sync are on by default. Because sync itself is off by default, however, no file moves anywhere until you turn sync on and approve a device. Each option can be turned off separately.

  1. On copy — only paths are sent. When you copy files, their paths, sizes, and modification times (up to 1,000 files by default) are propagated to your approved devices. No file contents are sent at this point.
  2. On paste — contents are fetched from the source device. When you paste that item as files on a receiving device, the receiving device requests the contents from the source device, receives them block by block, and then pastes real files. The source device answers only requests from approved devices and only for paths it has itself propagated. If the source device is off or not connected, the contents cannot be retrieved and only the path text is pasted.
  3. Small files are fetched in advance. Files of 50 MB or less (default) are fetched slowly in the background (by default at no more than 1,024 KB/s) even before you paste. In other words, while sync and file sharing are on, small files copied on one device may be stored, contents included, on your other approved devices even if you never paste them. You can set the prefetch limit to 0 (no prefetch) in settings.
  4. Size limit: files fetched on paste are limited to 1,000 MB by default; above that, only the path text is provided.
  5. Transport and encryption: file paths and contents travel only through the same Noise end-to-end encrypted session as clipboard items. Even through a relay server, the server only forwards ciphertext and can neither see nor store file names, paths, or contents (Section 4-2); all it can learn is the number of bytes exchanged.
  6. Storage of received files: received files are saved as is, unencrypted, at the “Received files” location in the table in Section 2, and reused when you paste the same file again. The Software does not quarantine or scan received files for malware and saves executable files unchanged.

4. Relay Server (Optional Feature)

Syncing with a device that is not on the same network requires a relay server. If you set the relay server in Settings › Sync to None, the Software makes no Internet connections at all. A relay connection is kept only after you select a server and press [Test] successfully.

4-1. The official default server

The default server address in the app is beepd.sosomlab.com:47300 (TCP+UDP), operated by the Company. The server program, nexa-beepd, is not part of the Software; it is a separate open-source program published from the Company’s Nexa Beep repository. You may point the app at a server you host yourself or at any other server. The official server runs on a virtual machine provided by a cloud provider (Oracle Cloud Infrastructure). It is shared with Nexa Beep users, but the two applications cannot see each other on the server (their rendezvous domains and handshake prologues differ).

4-2. What the server receives

When connected, the Software establishes a Noise-encrypted channel with the server and sends the following:

InformationContentsHow the server treats it
Rotating rendezvous IDsA 16-byte hash of your device public key and the UTC date, and a 16-byte value derived from your handle and pairing passphrase by PBKDF2 key stretching (yesterday, today, tomorrow for each). The public key, handle, and passphrase themselves are never sent, and the hashes cannot be reversedHeld in memory only while you are connected; gone when the connection closes
Public IP address and portAs observed by the server on your connection; forwarded to your other device so that a direct connection (hole punching) can be attemptedHeld in memory only while connected
Channel open/close events and byte countsWhich two rendezvous IDs were connected, when, and how much they exchanged (including file transfer volume)Handled in memory during relaying only
Ciphertext fragmentsOnly when a direct connection fails and the server must carry the data itself (clipboard items, file paths, file contents). This is end-to-end ciphertext between your two devices; the server cannot open itForwarded immediately; never stored

The server stores nothing to disk. It is a pipe, not a buffer: data flows only while both parties are connected, and even when operational logging is turned on, only connection numbers, the first 4 bytes of rendezvous IDs, channel numbers, and byte counts are recorded. Clipboard contents, file names, file paths, file contents, device names, settings, your handle, and your passphrase never reach the server.

Using the relay does mean, however, that the server learns the metadata “which rendezvous ID connected with which, when, and how much was exchanged”, along with your public IP address. It cannot see the contents, but this fact cannot be concealed, and the Software documents it openly.

4-3. Server identity verification

On first connection the Software pins the server’s public key; if that key ever changes, the Software refuses to connect and warns you. The official server’s pin is published in the project wiki so that you can compare it.

5. Third-Party Services

The Software uses no third-party analytics, advertising, or crash-reporting services. It uses the operating system’s clipboard, tray, autostart, accessibility (key injection), local-network, and desktop-portal facilities, which are governed by each OS’s own policies. If you use a relay server hosted by yourself or by someone else, that operator can see the information described in Section 4-2; the Company is not a party to that relationship. License-request and enquiry emails pass through the email services used by you and by the Company.

6. Children

The Software is a general-purpose productivity tool and is not directed at children. The Company does not knowingly collect personal information from anyone, including children.

7. Your Rights

The Company never receives your personal information through the Software. The only information about you that the Company holds is the emails you yourself send to request a license or ask a question, and the information in them (Section 2-3), together with records of licenses it has issued. You may request access to, correction or deletion of, or suspension of processing of that information using the contact below. Note that deleting records needed to verify a valid commercial license may make later reissue or verification difficult.

All other data described in this Policy stays on your devices under your control and can be removed as described in Section 2. Items and files propagated to your other approved devices are stored there and must be deleted on those devices. Information the official relay server holds in memory while you are connected (Section 4) disappears as soon as you disconnect or turn sync off. If you have any questions, please contact us at the address below.

8. Contact

9. Changes to This Policy

If this Privacy Policy changes, the revised text and its effective date will be posted on this page. Material changes — in particular any addition to the kinds of items propagated by sync, or any broadening of what the relay server handles — will be announced at least 7 days before they take effect. The Company has explained in the notice at the top of this page how it failed to keep this commitment, and from now on will revise and announce this Policy before releasing a version that includes such a change.

Revision history

  • 2026-10-12 (announced · effective 2026-10-19): Corrected descriptions that differed from actual behaviour, as of v0.2.1.
    • New file-sharing section (Section 3-4): propagation of file paths, sizes, and modification times; transfer of contents from the source device on paste; background prefetch of files of 50 MB or less; default values of the related settings (on once sync is enabled); end-to-end encryption and what the relay server cannot see
    • Propagated items corrected (Section 3-3): removed “file contents and file paths are not propagated” and listed what is still not propagated (formatting, file cut)
    • Stored data added (Section 2): received files (Nexa Clip under the Downloads folder · unencrypted · not removed by deleting history) and the license file
    • New licensing section (Section 2-3): offline checks, device code, contents of the request code, and what the Company receives when you request a license by email and why
    • Autostart corrected (Section 2-2): on by default and registered at first launch; macOS Local Network permission added
    • Your rights updated (Section 7); explanation of the missed advance-notice commitment (top of page)
  • 2026-09-07: First published