This policy explains what ClipPigeon ("we", "us") stores and why. It takes effect on October 18, 2026.
The short version
- We can’t read your texts. They are encrypted in your browser before they are sent, with a key that stays in the link (the part after
#). Browsers never send that part to a website, so we never receive it. - No account, no name, no email address is needed or collected to use ClipPigeon.
- No advertising, analytics or tracking scripts run on pages that hold your text, and we don’t sell or share data for advertising.
- Everything expires. Texts are deleted at the time you choose; the records that manage them go with them.
What we store
Your texts, encrypted. Each saved text is stored as encrypted data we can’t read, with its size, when it was saved and when it expires, and a value derived from its key that lets us check someone has the full link (it can’t be used to read the text). If you tick “Delete after it’s opened once”, we also store when it was opened, and a one-way hash of a random value from the opener’s browser, so that browser can try again if its connection drops.
Your history, encrypted. Your list of saved texts (Recent) is kept in your browser. A copy is stored on our server so your other devices can sync it. That copy is encrypted with a key that never leaves your browsers. To deliver it, the server does know, unencrypted, which history each text belongs to and which browsers are in that history, but not what any of it says.
Your browsers. Each browser that shares a history has a random access token. We store only a fingerprint (a hash) of it, when the browser joined, and when it was last active. The browser’s name (like "Chrome on Mac" or one you choose) is stored encrypted. When you connect a device with a code, we store a record of that invitation: when it was made, used, declined or cancelled.
Abuse limits. To stop abuse, we count requests per network over short periods, and new histories per network per day. Network addresses are stored only as keyed, one-way identifiers, and these counts expire within two days.
Usage statistics. We keep daily totals, such as how many texts are saved and opened, their sizes, the expiry chosen, and the browser language and country they come from. These totals contain no text, no network addresses and no record of who saved or opened what. Working them out uses a count of each history’s saves for the current day, which is deleted the next day.
Removed links. After a text is removed, we keep a random identifier showing that its link existed, so the link can never point to a different text. It contains no text and isn’t linked to you or your history.
What we don’t store
- The readable content of your texts, or the keys to read them.
- Your name, email address, phone number or any account.
- Request logs: our hosting provider’s request logging is turned off for this service.
What our hosting provider sees
ClipPigeon runs on Cloudflare. Like any website, it receives your network (IP) address, the time and size of each request, and your browser’s basic details while it delivers the service. Cloudflare processes this on our behalf to run and protect the service. Encryption can’t protect a device or browser that is itself compromised.
Connecting your devices
When you connect a device with a code, your two browsers exchange messages through our relay for a few seconds. The code is checked with a method that never sends it in a readable form, and the history key travels encrypted with a secret only those two browsers share. The relay keeps only what it needs to limit attempts: keyed network identifiers and counts, which are cleared as later activity replaces them.
Your browser’s storage
ClipPigeon keeps your history, its key and your settings in your browser’s own storage. This is needed for the service to work; it isn’t used for tracking. Clearing your browser’s data for this site removes it. We use no cookies.
How long we keep data
- Texts: until the expiry you choose (1 hour to 30 days), or until opened once if you chose that. An opened text’s stored copy is deleted once the text is shown in the opener’s browser; otherwise (a dropped connection, a page closed or left) it is kept up to about half an hour so that browser can try again. Removal of expired texts from storage can take a little longer.
- Browser access: a browser that hasn’t been used for 90 days loses its access. The record that it was in a history (its encrypted name and when it joined, was last active and was disconnected) stays while that history still has texts, so your other browsers can see who left; it is removed with the history once its texts have expired.
- Abuse limits: within two days. Daily statistics: kept as totals. Removed-link identifiers: kept permanently, as above. Takedown records: kept permanently, as below.
Reports and blocked texts
If someone reports a link to us, they give us the full link, including its key, so we can read that one text to check the report. If it breaks our terms, we remove it, and keep a record of the removal: the text’s identifier, when, and why. We can’t read any other text.
Your choices and rights
You can stop using ClipPigeon at any time, clear your browser’s data, disconnect a browser from your history, or start a fresh history with a new key. Because we don’t know who you are, we usually can’t link stored data to you. Where data protection law gives you rights (such as access or deletion), contact us and we will help as far as we can identify the data you mean.
Do Not Track
ClipPigeon doesn’t track you across websites, and runs no advertising or analytics scripts, so we treat every visitor the same way whether or not their browser sends a "Do Not Track" signal.
Children
ClipPigeon is not meant for children under 13, and we don’t knowingly collect data from them.
Changes
If this policy changes, we will update this page and its date. Important changes will be noted on the site.
Contact
ClipPigeon, California, United States. Email: contact@clippigeon.com.