CrossPaste Mobile Privacy Policy

Dear User:

Shenzhen Compile Future Technology Co., Ltd. (hereinafter "SCF," "we," "us," or "our") respects your privacy and will do our best to protect your personal information. This CrossPaste Mobile Privacy Policy (the "Policy") governs the collection, processing, storage, transmission, and protection of user information in connection with the CrossPaste mobile builds distributed for Android and iOS (collectively with all related content, the "Service"). Before using the Service, please read and make sure you understand and agree to this Policy. Pay special attention to the content shown in bold.

You represent that you are an adult when you begin to use this product. If you are a minor, you must use this product only with the consent of your guardian, who must accept this Policy and the related terms of service on your behalf. By using the Service, you confirm that you have read, acknowledged, and accepted the terms of this Policy. We will use and protect your information strictly in accordance with this Policy and only to the extent necessary and efficient for providing the Service.

Please note that, due to differences across distribution channels (iOS App Store, Google Play worldwide build, and Mainland-China Android stores), service features and integrated third-party SDKs may differ. The information we collect and the way you exercise your rights depend on the version and channel you actually use.

For the desktop edition, please refer to the CrossPaste Privacy Policy.

Effective Date: May 1, 2026

1. Local Recording and Synchronization of Clipboard Contents

(1) You acknowledge that the Service is designed to record clipboard history on your device and to synchronize clipboard contents between devices you have actively paired on your local network (collectively, "User Content").

(2) The first time you use a clipboard feature (for example, the first time you sync clipboard data to another device, or the first time you enable photo-library sync), we will request your prior authorization for the necessary permissions.

(3) Some User Content may be displayed within the Service interface as summaries, thumbnails, or other tangible forms. The actual display is randomly generated and updated based on the User Content stored on your device.

(4) User Content can only be transmitted to specific devices authorized to receive it within a single pairing session. For any User Content, we only provide the service of helping the same user synchronize among their paired devices; we do not collect it from you, nor do we upload it to SCF servers, obtain, process, or use it in any form.

(5) When you use cross-device sync, QR-code pairing, LAN search, or similar features, we need to read the device identifier on your device to distinguish among different devices during pairing and synchronization. When you use LAN-based sync, we additionally read the local IP address and gateway IP address for device discovery, connection, and file transfer. The information above is only used on your device or among your paired devices, and is not uploaded to SCF servers.

2. Multi-Device Pairing

(1) When you actively enable multi-device pairing, we need to read on your device your device identifier (Android ID on Android; identifierForVendor on iOS), device model, and device name, in order to identify "which phone or computer is which" during pairing. The information above is kept only in the local on-device database and is not uploaded to SCF servers.

(2) Through this feature, you may establish a connection with another device to synchronize clipboard contents, photos, files, and other supported content types across devices. To achieve this, we read the User Content you have selected for synchronization. With your consent, the App caches such content locally and transmits it to your paired device through an encrypted channel.

(3) Synchronization uses asymmetric cryptography. Encryption keys are kept on the devices themselves, and SCF servers hold no key that can decrypt User Content. The synchronization channel is established only within the same local network and does not relay through public internet servers.

3. Pro Subscriptions

(1) When you purchase, restore, or query a Pro subscription, we need to validate the subscription. We upload the purchase receipt issued by the relevant app store or payment platform (the IAP receipt, the Google Play receipt, or the order number issued by a Mainland-China payment platform) to SCF servers for validation.

(2) SCF servers store only "whether the subscription bound to this receipt is active" and the expiration timestamp. No name, phone number, email, or other personal identifier is bound to the record.

(3) Payments on Mainland-China Android channels are completed by invoking the Alipay and WeChat Pay SDKs. Those payment SDKs handle the device and network information required for payment-risk control in accordance with their own privacy policies (see Section 7 for the inventory).

4. Information We Collect

(a) Your Device Information: When you use the Service on a given device, we read certain information from that device, including device identifier, device model, device name, OS version, and network state (local IP address, gateway IP address), to recognize the version, quickly diagnose errors, troubleshoot, provide compatibility checks, and accordingly improve the product and prompt you for updates. The information above stays on your device by default; subscription-validation requests carry only the minimum device model and OS version needed to help us troubleshoot.

(b) Your Log Information: While you are using the Service, the App records runtime logs locally (including crash stacks, exception information, operation timestamps, transmission states, connection states, etc.). Log information is kept only inside the on-device sandbox by default; unless you actively send the logs to us via the in-app "Feedback" feature, the logs are not uploaded to SCF servers and are not associated with your personal identity.

(c) Network and Location Information: When devices pair and sync, the Service performs LAN device discovery and connection based on the local IP address, gateway IP address, and similar information, to deliver the features you requested. Network information is only used on your device or among your paired devices, and is not uploaded to SCF servers or used for any other unauthorized purpose. The Service does not obtain your precise geolocation in the background.

(d) User Transmission Data: When you use cross-device sync, we cache the clipboard contents, images, videos, text, files, and similar content you have selected, along with the corresponding transmission state, on your device to help you complete the synchronization. The data is used solely to complete synchronization. We do not perform content recognition or intent inference, nor do we use it for any other purpose.

(e) Advertising Identifiers (Free Tier Only): Read by the advertising SDK only when ads are displayed in the Free tier. iOS reads IDFA; Android reads the Android Advertising ID (AAID) or OAID. If you do not want the advertising SDK to use the advertising identifier for ad delivery and attribution, you can disable tracking in your system settings, or subscribe to the Pro tier to remove ads entirely.

5. Permissions

The Service requires certain device permissions to deliver its features. The permissions and the purposes for granting them are as follows:

(1) Local Network / LAN permission: Used to discover and connect to other paired devices on your local network and to transmit clipboard contents.

(2) Notifications permission: Used to inform you of synchronization status, pairing requests, or subscription changes.

(3) Camera permission: When you complete device pairing by scanning a QR code, or choose to set your avatar by taking a photo, the camera permission is required to scan the pairing QR code or take the photo.

(4) Photos / Photo Library permission: Used when you choose to synchronize images to other devices, or to upload an avatar from your photo library.

(5) Storage permission (Android): Used to support local caching and export of User Content, providing file synchronization and saving.

(6) Tracking permission (iOS ATT): Requested only by the advertising SDK in the Free tier. You may decline it on the system prompt.

The above permissions are requested only when the corresponding features are used. Rest assured that the Service will not invoke your permissions arbitrarily when the corresponding features are not in use. You may revoke any permission at any time in your system settings.

6. Media File Monitoring Mechanism

To deliver the "instant clipboard sync" feature, after you grant media access permissions (photos, videos, audio), CrossPaste subscribes to change notifications from the system media library (MediaStore) through the standard Android API (ContentObserver). The exact behavior is disclosed below:

(1) Trigger Conditions

• The observer fires only when you actively add or modify a media file (e.g., taking a photo, saving a screenshot, downloading an image, saving an audio or video file);
• There is no periodic polling.

(2) Collection Frequency

• Event-driven (each addition triggers a single callback);
• Each callback reads only the single most recent record;
• The time window is restricted to files added within the last 24 hours; older files are not read.

(3) Runtime Scenarios

• The observer is active while the App runs in both the foreground and the background (this is required for the auto-sync feature to work);
• Once the App process is terminated by the system, the observer stops automatically.

(4) Data Scope

• Only the media file's metadata (path, type, date added) and the file content itself are read;
• The data is used solely as a clipboard candidate to be synchronized to your authorized paired devices on the local network;
• Nothing is uploaded to any server. All data is exchanged only between your devices on your local network.

(5) User Control

Photos, videos, and audio can be configured independently, each with one of three modes:

Mode	Behavior	Default
Ask	A prompt asks for your consent each time new media is detected; sync only proceeds on confirm.	✅ Default
Auto-sync	Detected new media is automatically synced to paired devices without further prompts.
Disable	Monitoring of this media type is fully disabled; the App reads no files of this type.

Entry point: Settings → Permission Center

You may switch between modes at any time; changes take effect immediately.

7. Third-Party SDK Inventory

The SDKs below are grouped by distribution channel. Where Chinese authorities require verbatim text registered with the National SDK Management Service Platform (sdk.caict.ac.cn), the original Chinese wording is preserved.

7.1 iOS (single ipa, App Store)

The iOS app ships as a single ipa. The advertising SDK that activates is selected at runtime based on your region.

SDK	Developer	Information Collected	Purpose	Privacy Policy
Google Mobile Ads SDK	Google LLC	Advertising identifier (IDFA), device model, OS version, network state, coarse location (IP-derived)	Display banner ads to Free-tier users outside Mainland China	policies.google.com/privacy
Pangle Ads-CN (CSJAdSDK)	Beijing Volcano Engine Network Technology Co., Ltd. (a ByteDance company)	Device identifiers, device model, OS version, network state, installed-app list (in some scenarios), coarse location	Display banner ads to Free-tier users inside Mainland China	csjplatform.com/privacy/partner

7.2 Android — Google Play (Worldwide)

SDK	Developer	Information Collected	Purpose	Privacy Policy
Google Mobile Ads SDK	Google LLC	Advertising identifier (AAID), device model, OS version, network state, coarse location (IP-derived)	Display banner ads to Free-tier users	policies.google.com/privacy
Google Play Billing	Google LLC	Purchase receipts, package name, Google account billing state	Process Pro subscription purchases and renewals	policies.google.com/privacy

7.3 Android — Mainland-China Channels (Xiaomi, Huawei, etc.)

The Mainland-China channels integrate the advertising and payment SDKs below. The Alipay and WeChat fields are reproduced verbatim from the registrations on the National SDK Management Service Platform; the original Chinese wording is required by regulators and is preserved here:

• SDK Name: Pangle Ads-CN (CSJAdSDK)

  • Developer: Beijing Volcano Engine Network Technology Co., Ltd. (a ByteDance company)
  • Information Collected: Device identifiers (OAID / Android ID), device model, OS version, network state, installed-app list (in some scenarios), coarse location
  • Purpose: Display banner ads to Free-tier users inside Mainland China
  • Privacy Policy: csjplatform.com/privacy/partner

• SDK Name: APP支付客户端SDK (Alipay Mobile Payment Client SDK)

  • Package: com.alipay.sdk
  • Developer: 支付宝（杭州）信息技术有限公司 (Alipay (Hangzhou) Information Technology Co., Ltd.)
  • Information Collected: 设备标识符、网络状态、设备型号、操作系统版本（用于支付安全风控与防欺诈） (Device identifiers, network state, device model, OS version — used for payment-risk control and fraud prevention)
  • Purpose: Process Alipay payments for Pro subscriptions
  • Privacy Policy: opendocs.alipay.com/open/54/01g6qm

• SDK Name: 微信OpenSDK Android (WeChat OpenSDK for Android)

  • Package: com.tencent.mm.opensdk
  • Developer: 深圳市腾讯计算机系统有限公司 (Shenzhen Tencent Computer Systems Co., Ltd.)
  • Information Collected: 设备标识符、网络状态、设备型号、操作系统版本（用于支付安全风控与防欺诈） (Device identifiers, network state, device model, OS version — used for payment-risk control and fraud prevention)
  • Purpose: Process WeChat Pay payments for Pro subscriptions and bring up the WeChat client to complete payment
  • Privacy Policy: support.weixin.qq.com/cgi-bin/mmsupportacctnodeweb-bin/pages/RYiYJkLOrQwu0nb8

7.4 Third-party SDK Personal Information Sharing List

To enable subscription payment, CrossPaste (China-region build only) integrates the following third-party SDKs. We invoke each SDK only when the user actively initiates the corresponding action — never on app launch, never in background, never while the app is idle in the foreground.

1. Alipay Mobile Payment SDK

• SDK name: alipaysdk-android (Alipay Mobile Payment SDK)
• Provider: Alipay (China) Network Technology Co., Ltd. / Ant Group Co., Ltd.
• Personal information collected: device identifiers (IMEI, IMSI, MAC address, Android ID, OAID, device serial number), device model, OS version, network type, IP address, app package name and version
• Purpose: complete order payment, identity verification, transaction risk control, fraud prevention
• Trigger: only at the moment the user actively taps "Alipay" on the subscription page to invoke the SDK
• Frequency: one-shot, triggered by user action; no background or periodic collection
• Data flow: transmitted directly to Alipay servers; CrossPaste does not collect, store, or retain the above identifiers
• Privacy policy: opendocs.alipay.com/open/54/01g6qm

2. WeChat Open SDK (incl. WeChat Pay)

• SDK name: wechat-sdk-android (WeChat Open Platform SDK)
• Provider: Shenzhen Tencent Computer Systems Co., Ltd.
• Personal information collected: whether WeChat is installed on the device, device model, app package name/signature; for payment, the order identifier and payment result status
• Purpose: hand off to WeChat to complete payment; verify the device's ability to invoke the SDK
• Trigger: only when the user actively taps "WeChat Pay", or upon returning from WeChat to the result page
• Frequency: one-shot, triggered by user action; no background or periodic collection
• Data flow: payment is completed via the WeChat app installed on the device; CrossPaste does not collect the above information
• Privacy policy: support.weixin.qq.com/cgi-bin/mmsupportacctnodeweb-bin/pages/RYiYJkLOrQwu0nb8

3. CrossPaste's Own Commitment

The CrossPaste app itself does not read any of the following: IMEI, IMSI, MAC address, SUPI, SUCI, installed app list, geolocation, contacts, call logs, calendar, SMS, or the device's phone number. The app reads only the system-provided Android ID as a device pairing identifier, used solely to establish a LAN clipboard sync connection between the user's already-paired personal devices.

8. How We Share, Transfer, and Publicly Disclose Your Personal Information

(1) Sharing: Sharing means providing your personal information to other personal-information controllers, where each side has independent control. Subject to the requirements of laws and regulations, the information collected from you may be shared in the following circumstances:

• Sharing with authorized partners: With your express consent, where it is necessary to deliver the Service, we transmit certain information (such as advertising identifiers, device models, network state, and purchase receipts) to authorized advertising-SDK and payment-SDK partners under strict security and confidentiality measures. The full inventory and partner privacy policies are listed in Section 7.

(2) Transfer: We will not transfer your personal information to any company, organization, or individual unless we obtain your separate, express consent.

(3) Public Disclosure: Personal information should not, in principle, be publicly disclosed. We will publicly disclose your personal information only with your express consent, or as required by laws, regulations, or competent public authorities.

(4) No Sale: We do not sell your personal information for any commercial purpose.

9. Cross-Border Transfers

(1) Worldwide builds (Google Play / iOS outside China): Advertising and payment data collected by Google AdMob and Google Play Billing may be processed by Google LLC on its servers located in the United States, the European Union, and other regions.

(2) iOS in Mainland China and Android Mainland-China channels: Device and ad-related information read by Pangle is processed within China by its operator. Payment-risk data reported by the Alipay and WeChat Pay SDKs is likewise processed within China by their respective operators, and does not involve cross-border transfers.

(3) SCF servers store only the minimum information needed for subscription validation; the storage location is disclosed in the App.

10. Storage and Protection of Personal Information

(1) Retention Period and Disposal Beyond Retention: Unless otherwise required by laws and regulations, we retain your personal information only for the minimum period necessary to achieve the purposes set out in this Policy. When your personal information exceeds our retention period, we delete or anonymize it.

(2) Information Security and Protection Measures: We will adopt the following safeguards (and others) to protect your personal information and do our best to keep your information secure:

• End-to-end encryption: Synchronization uses asymmetric cryptography. Keys are kept on the devices themselves; SCF servers hold no key that can decrypt User Content.
• Physical isolation: User Content is exchanged only between devices you have actively paired on the same local network and does not traverse public internet servers.
• On-device isolation: App data is stored inside the OS-provided app sandbox, following the storage isolation models of Android and iOS.
• Server minimalism: SCF servers store only the minimum information needed to validate subscription status, with no personal-identity fields.

(3) When we cease to operate the Service, or when you cease to use the Service, we will stop collecting and using your information and will anonymize or delete the information we have stored.

11. Managing Your Personal Information

(1) You may submit requests to access, correct, or delete your personal information by using the contact methods listed in Section 14. To better protect the security of personal information, we may verify your identity before responding, to confirm that the request is initiated by the data subject or their authorized representative, and to ensure that the request is specific and actionable. If we accept your request, we will use our best efforts to fulfill it within 15 business days. During that period, your information will be securely stored and isolated.

(2) You may also exercise your rights yourself in the following ways:

• Access and review: View clipboard contents stored locally, the list of paired devices, and your subscription state inside the App at any time.
• Correction: Edit or delete your local data inside the App at any time.
• Deletion: Uninstalling the App permanently deletes all local data. To delete server-side subscription-validation records, contact us at the email below.
• Withdraw consent: Revoke any system permission (advertising tracking, notifications, photo library, etc.) at any time in your system settings.
• Disable personalized ads:
  • iOS: Settings → Privacy & Security → Tracking, or decline the ATT prompt.
  • Android: Settings → Google → Ads to reset the advertising ID or turn off "Ads personalization." Subscribing to Pro removes ads entirely.

(3) You may change the scope of, or withdraw, your authorization for our continued collection of your personal information by turning off the relevant feature or revoking the relevant permission. Please understand that some business features require certain basic personal information to function. After you withdraw consent or authorization, we cannot continue to provide the corresponding services and will stop processing the relevant personal information. However, your withdrawal does not affect the lawfulness of personal-information processing that has already taken place under your prior authorization.

12. Disclaimer

This Policy describes the standards SCF follows in safeguarding privacy data. SCF will strictly adhere to those standards and will take all reasonably feasible measures to protect your personal information and data. Please understand, however, that SCF cannot control all factors or how third parties collect or use your information, and no measure can be flawless. We cannot guarantee that your data and information will never be disclosed under any circumstances. This Policy applies only to the rules for collection, use, and sharing in CrossPaste mobile, and does not apply to services provided by any third party or to the rules of any third party for collection, use, or sharing of information.

13. About This Policy

SCF reserves the right to update or modify this Policy from time to time. Once the Policy is amended, SCF will publish the updates on the relevant page. Where the change materially affects your rights, we will notify you in a prominent manner or obtain your consent again. Your use and continued use of the Service indicate that you accept this Policy and its updates. If you do not agree with this Policy, please do not use the Service or disable it on your device. The latest version of this Policy can be found on this page or in the App's "Settings" page.

14. Contact Us

If you have questions, comments, or suggestions, please contact us:

• Operator: Shenzhen Compile Future Technology Co., Ltd.
• Email: compile.future@gmail.com

If you are not satisfied with our response or handling, you may seek resolution through external channels by submitting the matter to a people's court with jurisdiction over SCF's place of registration.

15. Other

For matters not specified in this Policy (including, without limitation, "processing of minors' data," "security of information and data and corresponding measures," and "integrity of information and data"), please refer to and be governed by the CrossPaste desktop privacy policy: CrossPaste Privacy Policy.

Important Notice: In the event of any discrepancy between language versions, the Chinese version of this Policy shall prevail. By using our Service, you agree to our Privacy Policy.

Copyright ©2025-present Shenzhen Compile Future Technology Co., Ltd. All Rights Reserved

Registered Address: Shenzhen, Guangdong Province, China

Last Updated: May 1, 2026