Universal Clipboard AI Manager — Windows privacy

Universal Clipboard AI Manager — privacy notice

Version 1.0.2, 2026-09-08. Publisher: Vellora Studio One. Support: https://vellorastudio.one/support/index.html.

CLIPBOARD ACCESS AND LOCAL HISTORY
In normal mode, when capture is enabled and the app is running, the app listens for Windows clipboard changes. It can save copied plain text and, if OCR is enabled and a supported Windows OCR language is available, text recognized from copied bitmap images. It saves recognized text, not the original bitmap, in history. Content above the configured text-length limit is skipped.

The app reads the foreground application's process name to apply exclusions and label an entry. If that process name cannot be read, it can fall back to the foreground window title, which may contain a document name or other sensitive information. Entries include the time, content type, size, pin state, a content hash, the embedding model identifier and a numeric search embedding.

Normal mode starts with history closed, capture off, OCR off and optional enhanced search off until you make an informed choice. Enable capture grants access to saved history and automatic capture of new copied text, which may include personal or highly sensitive information such as health or financial information. OCR requires the separate unchecked option. Open history only grants access to this app's saved history, not clipboard capture or OCR. Not now grants no new access. Before a saved history grant, the app does not initialize/read/purge the history database or start the clipboard listener, foreground lookup or OCR. It reads only local app settings to restore a previously saved, versioned choice; older enabled flags without that consent are not accepted as a grant.

History defaults are a 30-day unpinned retention setting, a 5,000-item target and a 100,000-character per-item limit. Pinned entries are protected from automatic age/count cleanup and can cause storage to exceed the target. The visible/searchable set is limited to 5,000 entries, with pinned entries prioritized. These are defaults, not unlimited storage or continuous recording when the app is closed.

PROTECTION AND ITS LIMITS
Saved content and the saved text preview are protected using Windows DPAPI for the current Windows user. The SQLite database is not wholly encrypted: content hashes, embeddings, source application/window-title metadata, timestamps, content type, size, pin state and model identifiers remain unencrypted. Embeddings and hashes are derived data and should not be treated as anonymous or harmless merely because they are not plain text.

The app is not a password vault. Sensitive-content filtering uses patterns for some secrets, private keys and card-like numbers; it cannot identify every password, token or private text and can make mistakes. Default process-name exclusion patterns are 1password*, bitwarden* and keepass*. Browser extensions are not reliably identified by those desktop process names. Pause capture before copying anything you do not want stored.

Copying a saved entry places it on the Windows clipboard. Windows and other applications may read or synchronize it according to their own settings and policies. Local DPAPI protection does not encrypt the Windows clipboard or control other applications. Protected history is not guaranteed readable under another Windows account or on another PC.

LOCAL SEARCH AND OPTIONAL DOWNLOADS
Lightweight local search is included. Enhanced semantic search is initially off. Only your explicit Download & enable or Retry download choice in Enhanced search authorizes a download attempt. A legacy automatic-download setting does not authorize network requests. When previously enabled, startup may verify and load existing cached files, but never downloads missing or invalid files automatically. Turn off cancels an ongoing operation and returns to lightweight search; it does not delete files or silently reindex existing entries.

Turn off cancels model work and switches to lightweight search before attempting to save the preference. If saving fails, the model stays off for that session and the app warns that the previously saved model choice may return on next launch. Already-started Windows operations may finish internally; cancelled results are discarded.

The optional sentence-transformers/all-MiniLM-L6-v2 model and vocabulary are pinned to revision 1110a243fdf4706b3f48f1d95db1a4f5529b4d41. The files total 90,636,722 bytes and are downloaded from Hugging Face, with possible hosting/CDN redirects. The app checks pinned size and SHA-256 before use. Servers receive normal connection information such as an IP address. Requests contain fixed component URLs, not clipboard text or search queries.

The model computes embeddings locally through Windows machine-learning APIs. It is English-oriented and not generative. Search results are approximate; enhanced input is limited to 128 tokens. Incompatible models/dimensions are not compared. The interface reports when entries need explicit Reindex; that operation updates a local index without uploading history.

The reviewed application source has no publisher analytics, advertising SDK, account login, cloud-history synchronization or clipboard-content upload endpoint. This is not a traffic audit or a promise that Windows/.NET/Windows App SDK/Store components are network-silent. Microsoft components may process diagnostics under Microsoft's terms and privacy settings: https://privacy.microsoft.com/privacystatement. If you contact support, information you choose to send is governed by the support website; do not include secrets or private clipboard history.

CONTROLS, STORAGE AND REMOVAL
Turning Capture off detaches the clipboard listener and cancels pending capture work. Revoked capture generations cannot commit a late stored entry. Already-running Windows operations may finish internally, but their cancelled results are discarded. Privacy settings controls OCR, sensitive capture and application exclusions. Revoke consent stops capture, cancels model/history work, hides the visible history and clears grants without deleting stored entries or model files. Reopening history or enabling capture requires a new choice. If saving a pause/revocation fails, the app remains stopped for that session and warns that the previous saved choice may return on next launch; retry before closing. Pin/Unpin, Delete and Clear unpinned history are available after history consent. Age cleanup runs when consented history is initialized, not through an independent always-running deletion service. Clearing unpinned entries leaves pinned entries intact.

Normal storage is beneath %LOCALAPPDATA%\Vellora Studio\Universal Clipboard AI Manager, subject to Windows package filesystem behavior. Optional portable mode stores data beside the executable in Data. Settings and optional model files are local. Uninstall behavior varies with packaging and filesystem redirection; do not assume uninstall removes portable copies, manually copied data, backups or every user-created file. Delete entries before removal if that is your intention. Deletion is not a guarantee of forensic erasure from backups, SSD storage or copies elsewhere.

ISOLATED PREVIEW
Supported preview creates a new temporary synthetic history per session. It does not load existing user history/settings, subscribe to global clipboard changes, perform foreground application lookup, initialize OCR or enable Copy. Normal preview also disables optional downloads and its model control cannot enable them. The separately explicit component self-test can download pinned components and index its own synthetic entries. Preview is not an OS sandbox: do not manually paste private material into ordinary text controls.