Privacy Policy

Last updated: July 1, 2026

SuperPaste is built to see as little as possible and keep nothing. This page describes exactly what happens to your data, in plain language. The source code is public if you'd like to verify any of it.

What happens when you press the hotkey

When you press ⌥V, SuperPaste captures one screenshot of your active window — nothing else on your screen, and never without the hotkey press. That screenshot is sent over HTTPS to the SuperPaste API (a Cloudflare Worker) and forwarded to Anthropic's Claude API to generate the response, which is then pasted at your cursor.

SuperPaste does not store, log, or train on your screenshots or responses. They pass through our API and are discarded. Anthropic processes them under its API data policies, which currently include retention of up to 30 days for abuse monitoring; Anthropic does not train on API data. See Anthropic's privacy documentation for details.

Bring-your-own-key mode

If you enable Settings → "Use your own Anthropic API key," screenshots are sent directly from your Mac to Anthropic. Our servers never see them at all.

What we do process

• Device ID — a random UUID generated on your Mac, used to run the free trial and apply rate limits. It is not tied to your name, email, or Apple ID.
• License key — sent with requests to validate an active subscription.
• IP address — used transiently for rate limiting on our API.

No analytics, no telemetry

The app contains no analytics, telemetry, or crash reporting. It does not phone home in the background. Its only network activity is the generation request you trigger with the hotkey, subscription/trial validation, and checking GitHub releases for app updates when you ask it to.

Payments

Subscriptions are handled by Polar, our merchant of record. Polar sees your billing details (name, email, payment method); we never see your card number. Polar's own privacy policy applies to payment data.

Your rights

If you are in the EU/EEA, UK, or another jurisdiction with data-protection law (such as the GDPR), you have the right to access, correct, delete, or export the personal data we hold about you, and to object to or restrict its processing. Because we hold almost nothing — a device UUID, a license key, and transient rate-limiting records — most requests are simple. Email us and we'll handle it.

Contact

Questions, requests, or concerns: [email protected].