Privacy Policy

What CtrlCV Does

CtrlCV lets users share text and files between devices without creating an account. Sessions are temporary.

Messages and Files

Messages and files are encrypted in your browser before upload. The server stores encrypted message content, encrypted file blobs, and minimal metadata such as session id, file id, file size, MIME type, creation time, and expiration time.

In the default private-key mode, the encryption key is not stored on the server. If you lose the session code or encryption key, the service cannot recover your messages or files.

In optional code-only sessions, the encryption key is derived from the session code. Anyone with that code, including the server, can derive the key and read messages and files.

A random device identifier and your chosen device name are saved in this browser to distinguish senders. They are included inside the encrypted message content, not stored as separate server metadata.

Retention

Sessions, messages, and uploaded files are intended to expire 2 hours after a session is created. Sending a message resets the session and attachment expiration time to 2 hours from that message. Expired uploads are removed during cleanup when the service handles related API requests. Orphaned encrypted upload files may also be removed after they become old enough.

Usage Statistics

CtrlCV may store anonymous usage events and daily aggregate counts, such as sessions created, messages sent, files uploaded, uploaded byte totals, and API errors. Message content, file contents, raw session codes, IP addresses, and user-agent strings are not stored for analytics.

Security Notes

Do not upload sensitive, illegal, or private information unless you understand the risks. Use the QR link or share both the session code and encryption key only with people you trust.