Privacy Policy
Executive Summary: CopyBack is built to be exactly as private as it sounds. All text you copy is stored locally on your device inside Google Chrome's secure sandboxed database. No remote servers exist, no sync calls are scheduled, no accounts are required, and no third-party tracking is present. What you copy stays entirely on your computer.
1. Overview
CopyBack is a standalone utility extension for the Google Chrome web browser, developed by Akshat Pandey. The extension is designed to run locally, providing a history stack of text snippets copied during browsing sessions to protect users from clipboard data loss. We maintain a strict zero-telemetry policy.
2. Information Collected & Stored
CopyBack only captures data when you explicitly perform a "Copy" command (such as pressing Ctrl+C / Cmd+C or selecting "Save to CopyBack" from the context menu) on standard websites. The following parameters are generated and written to Chrome's local database:
- Copied Text: The text payload of your copy event. This is capped at a maximum of 20,000 characters per item to preserve space.
- Webpage URL: The web address (URL) of the active tab where the text copy took place.
- Page Title: The HTML document title of the page where the content was copied.
- Website Hostname: The domain name (e.g.,
en.wikipedia.org) of the source webpage. - Favicon URL: The website icon associated with the source webpage.
- Temporal Metadata: The exact date and timestamp of the copy event.
- Quantitative Statistics: A character count and word count calculated locally from the text payload.
- Item States: Toggle fields indicating whether you have marked the clip as a Favorite or Pinned item.
- Extension Preferences: Your selected history cleanup duration (30, 90, 180 days, or "never") and toast notification preferences.
3. How Your Data is Used & Storage Architecture
Stored data is exclusively used by the extension to render your copy history list in the popup frame and search through past items. We do not use this data for any secondary purposes.
- Storage Backend: All elements are saved in Chrome's sandboxed local filesystem using the
chrome.storage.localAPI. - No Remote Processing: There is no remote database server. Stored data is never synced to any server, transmitted over the internet, or made available to the developer, Google, or any third-party providers.
- Data Deletion: Removing/Uninstalling the CopyBack extension from your browser automatically deletes Chrome's sandboxed filesystem directory, wiping 100% of your clipboard history files from your hard drive immediately.
4. Required Permissions Explained
In accordance with Google Chrome Web Store Developer Policies, CopyBack requests only the narrowest possible permissions necessary to execute its functions. Each permission is mapped directly to actual features:
| Permission ID | Usage Scope & Necessity |
|---|---|
| storage | Required to write, read, and delete clipboard history items and settings locally in the browser profile database (chrome.storage.local). |
| contextMenus | Enables adding the "Save to CopyBack" item to the browser right-click menu, allowing you to highlight text and manually save it. |
| alarms | Launches a background timer that runs once every 4 hours to verify if history items are older than your auto-cleanup retention window. |
| notifications | Displays native browser notifications to warn you one day in advance before unpinned/unfavorited clips are permanently cleared by automatic cleanup. |
| tabs | Used to access website titles, URLs, and favicon icons during copy events to attach metadata. It is also used to query and inject copy hooks into open tabs when you install or reload the extension. |
| scripting | Used during extension install or update to insert the light content observer script (content.js) dynamically into existing tabs without forcing a page refresh. |
host_permissions (http://*/*, https://*/*) |
Allows the content observer script to load on web pages to listen for the copy event and display the visual "Saved to CopyBack" confirm toast dynamically. |
5. Exclusions & Scope Limits
CopyBack's scope is strictly defined by Chrome API boundaries and browser sandbox constraints:
- Incognito Mode: CopyBack does not observe copy events in incognito/private windows unless the user explicitly grants the extension permission to run in Incognito via Chrome settings.
- Restricted Pages: Chrome blocks script execution on system pages. CopyBack cannot observe or save copies made on
chrome://pages, the Chrome Web Store, local PDF files opened in Chrome, or browser address/UI bars. - External System Copies: CopyBack is a browser extension. It has no access to copies made inside desktop applications, text editors, folders, or other applications outside of standard Chrome tabs.
6. Automatic Cleanup & Hard Storage Limits
CopyBack provides settings to control database size and data retention:
- Automated Deletion: Items older than your selected threshold (30, 90, or 180 days) are automatically deleted by the background service worker. This clean-up check is triggered every 4 hours via Chrome alarms and on every popup reload.
- Pins and Favorites Exemption: Pinned and Favorited clips are excluded from the retention timer and will remain in storage indefinitely until you manually delete them.
- Storage Limit Overflow Handling: Chrome local storage operates with a size quota. If this quota limit is reached, CopyBack's helper script will search for the oldest unpinned and unfavorited clipboard item, delete it to clear buffer space, and save the incoming clip to avoid service disruption.
7. User Controls & Choice
You maintain full control over all database elements:
- Individual Deletion: You can click the Trash icon on any card inside the history popup to permanently delete a specific clipboard item instantly.
- Silencing Notifications: You can toggle off browser notifications and toast alerts inside the settings panel.
- Changing Retention: You can choose "Never" as the cleanup duration to preserve history indefinitely.
8. Security Auditing
- No Remote Code: CopyBack complies with Manifest V3 restrictions. All program execution logic is packaged locally within the extension. It does not call external resources or load dynamic scripts.
- Zero Third-Party Libraries: The landing page, privacy policy, extension worker, and content hooks are written strictly in pure vanilla JavaScript, CSS, and HTML. No tracking dependencies, Webpack bundlers, or remote framework scripts are included.
9. Contact & Questions
If you have any questions or concerns regarding CopyBack or this privacy policy, you can contact the developer, Akshat Pandey, via ashbuildsinpublic@gmail.com.