Your content stays on your device. The boundaries deserve equal clarity.

1. Scope and processing

This policy covers the scrap desktop app, command-line interface (CLI), and local scrapd daemon. They work together on the current operating-system user's device. The developers operate no backend that receives records, searches, or usage data from these components.

This does not mean that scrap never processes personal data. If you store a name, access token, or other identifiable information in a record, the app processes it locally to store, retrieve, display, copy, and delete it. You should store only content you have the right to process.

2. Data stored on your device

Primary data and runtime state live under ~/.scrap in the current user's home directory. The platform uses the equivalent user path; on Windows this is normally %USERPROFILE%\.scrap.

• ~/.scrap/data/scrap.db: the SQLite database. Record values are stored as ciphertext produced by authenticated encryption (AEAD).
• Unencrypted metadata: scope names, record keys, creation and update timestamps, revisions, plain/masked display policies, and internal database identifiers. Someone who can read the database file may see this information.
• ~/.scrap/data/key-reference: a reference to the operating-system-protected key; the database itself does not contain a directly usable plaintext master key.
• ~/.scrap/run and config.json: runtime information such as local inter-process communication (IPC), locks, and configuration. Contents of run are ordinarily reproducible.
• ~/.scrap/log/scrap.log: daemon diagnostics. The implementation does not intentionally log record values or IPC request payloads, but the log does retain operational information such as times, event types, and error categories.
• The GUI stores theme and language preferences in the operating system's Local Application Data/MoeSegFault/Scrap/preferences.json. Searches and record content are not written there. The website separately stores its theme choice in browser localStorage.

3. Collection, transmission, and sharing

The scrap app contains no account system, advertising, analytics telemetry, or cloud sync. It does not send records, search terms, preferences, or runtime logs to the project developers. The developers cannot sell or share app data they do not receive.

If you intentionally pass content through terminal redirection, a pipe, the clipboard, backup software, or another application, it enters the external component you selected. That transfer is controlled by your action and that component; it is not a transmission to the scrap developers.

4. Display and clipboard behavior

Masked is a display and clipboard policy, not a different encryption strength. Every record value uses the same at-rest encryption model; plain/masked metadata controls only its default presentation.

After the GUI copies a masked record, scrap waits 30 seconds and attempts to clear the clipboard only if it still contains the exact value from that copy. Clearing is best-effort: a clipboard manager, sync feature, or other process may already have retained a copy. Copying a plain record is not cleared automatically.

CLI get writes the value to standard output by default; --clipboard writes it to the system clipboard only at your explicit request. The CLI does not automatically clear its output or clipboard content. A terminal, shell history, pipeline recipient, or clipboard tool may retain it separately.

5. Retention, deletion, and uninstall

Deleting a record or scope makes it logically inaccessible through scrap, but does not promise physical secure erasure. SQLite free pages, its write-ahead log (WAL), filesystem snapshots, SSD behavior, or backups may retain historical copies temporarily or indefinitely.

Ordinary upgrades and uninstall remove only program files and integrations owned by the package; they preserve data under ~/.scrap. To remove local data, you must explicitly delete ~/.scrap after confirming you no longer need its backups. GUI preferences live under platform Local Application Data and may need separate removal. Even then, scrap cannot guarantee erasure from the operating-system key store, backups, snapshots, or storage media.

6. Operating-system and external boundaries

scrap relies on the operating system for user-account isolation, file permissions, key protection, inter-process communication, and the clipboard. Administrator access, a compromised account or device, malware, debuggers, memory dumps, hibernation, and swap files can cross protections the app can provide. Encryption at rest is not a substitute for device security.

Backups must account for both the encrypted database and operating-system-protected key material. Restoring only the database may leave values undecryptable. Cloud backup, enterprise management, antivirus software, file indexing, virtual-machine snapshots, and clipboard sync may process local files or plaintext under their own policies. They are not services controlled by scrap or its developers.

7. Product website and downloads

This website has no accounts, advertising, analytics scripts, or contact forms, and sets no tracking cookies. Its light/dark theme choice is stored only in your browser's localStorage.

GitHub Pages hosts the site, style.moesegfault.dev supplies its stylesheet, and download links lead to GitHub Releases. When you request those resources, the relevant host or network provider processes ordinary network data such as your IP address, User-Agent, and request time under its own policies. The project developers have added no separate collection endpoint to the site.

8. Changes and contact

If the product's data flow, storage format, or external services change materially, this policy will be updated with a revised effective date. Its history remains inspectable in the public repository.

For questions about this policy or the implementation, open an issue in the GitHub repository. GitHub processes anything you submit under its own policy; never paste a secret or other sensitive content into an issue.