PasteAnywhere Logo PasteAnywhere v1.0.0

Security Transparency

Privacy & Local Security Model

An honest, plain-language disclosure of how PasteAnywhere handles your data, verified directly against the application source code.

Plain-Language Network Security Notice: Not Encrypted in Transit

PasteAnywhere uses authenticated Bearer tokens to protect pairing endpoints, but clipboard text is not encrypted in transit across your local network. Payloads travel over plain HTTP REST endpoints and WebSockets on port 8765 without Transport Layer Security (TLS/HTTPS).

Trusted Networks Only: You should only run and pair PasteAnywhere on private, trusted home or office Wi-Fi networks secured with WPA2 or WPA3. Do not run PasteAnywhere on open, shared, or public Wi-Fi networks (such as coffee shops or airports) where other devices on the subnet could inspect local network packets.

1. Zero Cloud Architecture

PasteAnywhere does not operate, contact, or maintain any cloud servers, central relay servers, analytics backends, or third-party databases.

When you copy text on your Windows PC or tap Quick Sync on your Android phone, your clipboard payload is transmitted directly between your paired devices over your local Wi-Fi subnet or LAN. If your internet connection goes offline entirely, PasteAnywhere continues to function without interruption as long as both devices remain connected to the same local router.

2. Local Network Transmission & Authentication

Here is exactly how communication occurs under the hood:

  • Bearer Token Authentication: Every HTTP and WebSocket request must present a 32-byte cryptographically random Bearer token issued during initial pairing. Unpaired devices on your network cannot read or write to your clipboard.
  • Local Transport: On your local network subnet, requests travel over standard TCP socket connections (HTTP REST endpoints and WebSockets on port 8765). Because this is a lightweight local utility without an internal Certificate Authority (CA) management system, clipboard content travels unencrypted across the local Wi-Fi subnet.
  • Network Hygiene: Always ensure your Wi-Fi router uses WPA2-AES or WPA3 encryption with a strong passphrase. Client isolation (AP isolation) on some guest networks may prevent devices from communicating with each other.

3. Android Permissions & Platform Compliance

Modern Android versions strictly regulate background clipboard access to protect user privacy. PasteAnywhere adheres fully to Android's platform security policies:

  • Notification Tap Required: When your PC pushes text to Android, the app does not silently overwrite your mobile clipboard in the background. It generates a notification preview. You must explicitly tap the notification to accept and copy the text.
  • Quick Sync Overlay (Display Over Other Apps): To dispatch text from Android to your PC, the optional Quick Sync floating button requires overlay permission. Tapping this button constitutes an active user gesture, allowing the app to read your current clipboard and transmit it to your PC.
  • Persistent Foreground Service: Android requires a visible status bar notification while the background service is active to ensure you are always aware that the app is listening on your local network.
  • Camera Permission (Optional): The camera is only accessed if you choose to scan the pairing QR code displayed on your PC screen during first-time pairing. No images, video streams, or photos are ever saved or transmitted.

4. Automated Log Sanitization

To allow troubleshooting without compromising your privacy, PasteAnywhere includes an automated regex sanitizer in its logging pipeline:

  • Clipboard Payloads: Clipboard text contents are strictly excluded from all log records.
  • Authentication Tokens & PINs: Bearer tokens, temporary 6-digit pairing PINs, and query parameters are automatically scrubbed before log lines are written to disk.
  • Sanitized Diagnostics Export: The "Export Diagnostics" feature in the Windows Dashboard produces a scrubbed system report containing only operating system version, network interface status, and connection states—safe to share when reporting an issue.

5. Credential Storage & Immediate Revocation

On your Windows PC, paired device tokens are never stored in plaintext. They are hashed using SHA-256 and stored locally in %APPDATA%\PasteAnywhere\config.json with an atomic .bak backup file.

If you remove a device from the Windows Dashboard, its SHA-256 token hash is deleted immediately. Subsequent requests using that token are rejected with a 401 Unauthorized response, and the phone reverts to an unpaired state.

6. No Analytics, Telemetry, or Web Cookies

Neither the PasteAnywhere software applications nor this official website utilize analytics tracking scripts, behavioral profiling tools, third-party advertising SDKs, or persistent tracking cookies. Your usage remains your private business.

7. Contact & Privacy Inquiries

If you have questions about this privacy statement, need to report a vulnerability, or wish to submit feedback: