Titto Privacy Policy
Effective date: 2026-11-04 · Last updated: 2026-11-04
1. Who this policy covers
This policy applies to Titto (the "App"), a macOS clipboard
manager distributed by the project maintainer (@iletai)
via the Mac App Store.
The App's bundle identifier is com.titto.clipboardmanager.
2. Data we collect
None. Titto has no backend, no analytics, no crash reporter, and no account system.
The table below maps Apple's Privacy Nutrition Label categories to Titto. Every category is "Not Collected".
| Category | Status | Why |
|---|---|---|
| Contact Info | Not collected | App has no account or sign-in. |
| Health & Fitness | Not collected | Out of scope. |
| Financial Info | Not collected | App is free; no payment flow. |
| Location | Not collected | Location services are not used. |
| Sensitive Info | Not collected | No transmission off-device. |
| Contacts | Not collected | Address Book is not accessed. |
| User Content | Not collected (stored locally) | Clipboard items are stored on-device only — see §3. |
| Browsing History | Not collected | Browser history APIs are not used. |
| Search History | Not collected | Search terms typed into the panel never leave the device. |
| Identifiers | Not collected | No IDFA, no IDFV, no install ID, no UUID is generated for tracking. |
| Purchases | Not collected | No in-app purchases. |
| Usage Data | Not collected | No analytics framework is linked. |
| Diagnostics | Not collected | No crash reporter is linked. macOS may surface system crash logs via the standard OS dialog; those go to Apple, not to us. |
| Other Data | Not collected | — |
3. Data stored locally on your Mac
Titto's whole job is to remember what you copied so you can paste it again. To do that it keeps a local SQLite database at:
~/Library/Application Support/com.titto.clipboardmanager/clipboard.sqlite
This file:
- Lives only on your Mac, in your user account.
- Is never uploaded, synced, or transmitted by Titto.
- Inherits filesystem-level encryption from FileVault when you have FileVault enabled. Titto does not add an additional application-layer encryption pass in this release.
- Can be deleted at any time. Quit Titto, remove the file (or the parent folder), and relaunch — Titto will start with an empty history. You can also use Settings → Privacy → Clear history.
- Can be exported by you via Settings → Export (SQLite snapshot or JSON Lines). Exported files go wherever you save them; we have no copy.
4. Sensitive-data filtering
Titto's SensitivityDetector runs heuristic checks before persisting clipboard items, and excludes likely passwords, API tokens, and credit-card numbers from search results and from the quick-copy hotkeys. It also honors Apple's "concealed" pasteboard type used by password managers (e.g. items copied from 1Password are dropped).
5. URL preview (optional, opt-in)
When you copy a URL, Titto can fetch a small preview (title + favicon) by issuing an
HTTP HEAD or limited GET request to the URL. This feature:
- Is off by default — you must enable it in Settings → Privacy → URL preview.
- Refuses to fetch private-network and link-local addresses (RFC 1918, loopback, IPv6 ULA / link-local) — a private-IP guard runs before any network call.
- Sends only the request your browser would already send when you visit the URL. No identifiers are added.
- Can be disabled at any time, immediately and globally.
If you keep URL preview off, Titto performs no network requests at all aside from anything macOS itself does (e.g. Gatekeeper, OCSP).
6. Permissions Titto asks for, and why
| Permission | Why | What we do not do |
|---|---|---|
| Accessibility | To synthesize a ⌘V keystroke via CGEvent when you choose to paste a clip back. This is the only way a non-sandboxed agent can paste into the app you were just using. |
We do not record keystrokes, capture screen content, or read other apps' UI. |
| Input Monitoring (optional) | Used only if you opt into "panel-key-only mode" so a single key (e.g. number-row) can dismiss the panel without a global hotkey. | We do not log keystrokes or send them anywhere. |
| AppleEvents | Not used. Titto does not script other apps. | — |
| Network | Used only when you enable URL preview (§5). Otherwise no network access. | No analytics, no telemetry, no remote config, no update ping (updates are delivered by the Mac App Store). |
7. Required Reason APIs
Apple requires apps to declare a reason for using certain platform APIs. Titto declares
these reasons in its bundled PrivacyInfo.xcprivacy manifest. The current
declarations cover UserDefaults (CA92.1 — to read and write the app's own
preferences), and where applicable file timestamp, system boot time, and free disk
space APIs used by the storage layer for housekeeping.
For Apple's reference list see Apple's Required Reason API documentation.
8. Children's privacy
Titto is not directed at children under 13 and does not knowingly collect any information from anyone, including children. Apple's age rating for the App is 4+.
9. Your rights (GDPR / CCPA / similar)
Because Titto stores all clipboard data locally on your device and we operate no servers, there is no remote dataset for us to access, export, correct, or delete on your behalf.
- Access / portability: use Settings → Export.
- Correction: edit or delete individual items inside the App.
- Deletion: use Settings → Privacy → Clear history or remove the database file (§3).
- Objection / withdrawal of consent: quit and uninstall the App.
10. Third-party services
Titto bundles the open-source GRDB.swift library to talk to SQLite. GRDB runs entirely in-process and makes no network calls of its own. No advertising SDKs, no analytics SDKs, no crash-reporting SDKs are linked.
11. Security
Titto is distributed under Apple's Hardened Runtime, signed with a Developer ID certificate, and notarized by Apple before release. The app sandbox is intentionally disabled because the paste flow needs to inject keystrokes into the previously focused app — see the project's for our threat model and disclosure process.
12. Changes to this policy
If we ever change this policy, the new version will replace this page and the "Last updated" date at the top will change. Material changes (anything that would enable network transmission of your clipboard, add analytics, or weaken the sensitive-data filter) will additionally be called out in the release notes for the version that introduces them.
13. Contact
The maintainer accepts privacy questions and reports through the project's public issue tracker: iletai@hotmail.com. For coordinated security disclosure, follow the process in .