Privacy Policy
Effective date: October 25, 2026
ClipVault lets you save text snippets in a vault that you access with a code in the format ABC-123. Existing five-digit codes continue to work. You may also connect your Google Account to attach images and PDFs stored in your own Google Drive. This policy explains what ClipVault processes when you use the service.
Information ClipVault stores
- Vault and snippet data: your vault code, snippets and their titles, and timestamps needed to provide the service.
- Drive file information: when you connect Drive, ClipVault stores your Google account email, the identifier of the app-created Drive folder and files, and each attached file's name, type, size, and timestamp. The file contents are stored in your Google Drive, not ClipVault's database.
- Google authorization: ClipVault stores an encrypted Google refresh token so it can access the files created for ClipVault after you leave the site. The token is encrypted at rest. Short-lived Google access tokens are held in server memory when needed.
- Chat data: if you set up chat, ClipVault stores public encryption keys, vault-code-encrypted private key bundles, chat requests, and encrypted message contents with signatures and timestamps. Chat keys are derived from your vault code; anyone who knows or guesses the code can access the vault's chat identity and decrypt its conversations. Your recovery phrase and message plaintext are not sent to ClipVault; older chat identities can use the phrase once in your browser to migrate.
- Technical information: ClipVault processes your IP address for abuse prevention and rate limiting. Rate-limit counters are temporary. Your browser may store your vault code locally when you select “Remember me on this device.” While connecting Google Drive, ClipVault temporarily stores a hashed, single-use return ticket linked to the vault in its database. The ticket expires after five minutes and is deleted when used.
How Google data is used
ClipVault requests the Google Drive drive.file scope and permission to see your email address. Drive access is used only to create a ClipVault folder, upload, list, display, download, and move to trash the files you attach through ClipVault, and to show which Google account is connected. When you disconnect, ClipVault moves its tracked attachments to Google Drive Trash before removing its access and stored file references. Files elsewhere in your Drive are not affected. ClipVault does not request general access to your entire Drive, sell Google user data, or use it for advertising.
Google handles sign-in and provides Google Drive. Use of Google services is also subject to Google's own terms and privacy policy. ClipVault's hosting and database providers process data on the service's behalf.
Website analytics
ClipVault uses Vercel Web Analytics to understand aggregate page views and site usage. Vercel states that Web Analytics does not use third-party cookies or collect personal identifiers to track people across sites. Analytics data may include the page path, referrer, timestamp, approximate location, and browser, operating system, and device type. Vercel uses a short-lived visitor hash for aggregated statistics and discards it after 24 hours. See Vercel's Web Analytics privacy information.
Sharing and security
ClipVault does not sell your personal information. Snippets and attached file references are provided to people who enter the corresponding vault code. Anyone who knows the code can access that vault, so do not store sensitive information there. Drive file contents remain in your Google Drive and are accessed by ClipVault through Google's API.
Chat messages are encrypted in your browser using ECDH, HKDF, and AES-GCM, then signed with a client-held signing key. ClipVault stores encrypted message bodies, public keys, signatures, and delivery metadata. Private chat keys are encrypted using a key derived from the vault code, which has low entropy. Anyone who knows or guesses the code can access the vault's chat identity and decrypt its conversations. Compare a contact's safety code through another trusted channel to help detect a replaced key. A compromised device can expose stored chats, and chat does not provide forward secrecy for previously stored messages.
ClipVault uses access controls, rate limits, HTTPS in production, and encryption for stored Google refresh tokens and chat private-key bundles. No method of storage or transmission can be guaranteed completely secure.
Retention and deletion
You can delete individual snippets and attachments from a vault. Deleting an attachment in ClipVault moves that file to the trash in your Google Drive. Disconnecting Google Drive first moves all tracked ClipVault attachments for that vault to Google Drive Trash, then removes ClipVault's stored token and file references. Files outside ClipVault are not affected. If any attachment cannot be moved to Trash, the connection remains active so you can retry.
Either chat participant can delete a conversation, which removes its encrypted message history for both participants. A vault and its associated chat data are purged after one year without activity.
Vaults that have not been used for one year are purged from ClipVault. This removes the vault, its snippets, stored Drive token, and file references from the app database. It does not delete files from your Google Drive. Temporary rate-limit records are also periodically removed.
You can clear a remembered vault code by signing out in the app or clearing this site's local storage in your browser.
Changes and contact
This policy may be updated as ClipVault changes. The current version will be published on this page with its effective date.
Questions about privacy? Contact contact.mohite@gmail.com.