Ortu
Privacy Policy
Ortu is a clipboard manager, so it necessarily sees everything you copy. This page explains exactly where that data goes — and where it doesn't.
Last updated: 24 July 2026
Ortu does not collect, transmit, or store your data on any server. There is no account, no cloud sync, and no telemetry or analytics of any kind. Your clipboard history never leaves your device unless you explicitly export it.
The application
What Ortu stores, and where
Ortu records the clipboard items you copy — text, images, and file references — in a local SQLite database in your operating system's application data directory. This database lives on your machine and is never uploaded anywhere.
Alongside it, Ortu stores your settings (shortcuts, retention preferences, snippets) and an encryption key file used for the feature described below.
Sensitive items
Ortu's classifier flags items that look like secrets — API keys, tokens, SSH keys, JWTs, environment variables. With Auto-mask detected secrets enabled (Settings → Privacy), those items are masked in the interface and encrypted at rest using AES-256-GCM.
Encryption is field-level: only the sensitive values are encrypted, not the whole
database. The 256-bit key is generated on first use and stored in a
.sensitive_key file with 0600 permissions in the app-data
directory.
What this protects, honestly. Encryption at rest protects masked secrets from casual inspection of the database file. It does not protect against malware or another process running as your own user account — the key sits on the same machine as the data. Non-sensitive history is stored in plaintext by design, so that search and previews work. Backups and text exports are not encrypted; treat exported files as sensitive.
Network connections
The only outbound network requests Ortu makes are update checks against GitHub, which fetch the published release metadata and, if you choose to update, the installer itself. No clipboard content, identifiers, or usage data are included in these requests.
The application's Content-Security-Policy restricts outbound connections to local inter-process communication and the GitHub update endpoints, so the app cannot reach anywhere else even if a dependency tried to.
System permissions
- macOS Accessibility — required for Ortu to paste into other applications, which it does by synthesising a paste keystroke. Ortu prompts you and links to the right settings pane when this is needed.
- Global keyboard shortcuts — registered so you can summon Ortu from any app. All shortcuts are rebindable in Settings.
- Launch at login — off by default, and enabled only if you turn it on.
Controlling what is kept
- History retention (Settings → History) — the default On reboot mode clears ungrouped and unpinned items every reboot. You can instead set an age or count limit.
- Pause capture — click the status pill in the header to stop recording entirely, for example while handling sensitive data. Nothing is captured until you resume, and the paused state survives restarts.
- Delete any individual item at any time.
Uninstalling and deleting your data
Remove Ortu using the standard uninstaller for your platform — Apps & features on
Windows, deleting Ortu.app on macOS, or your package manager on Linux.
Deleting the application data directory removes the database, your settings, and the
encryption key, which erases all stored history permanently.
This website
ortu.abhijithpsubash.com runs no analytics, no tracking scripts, and sets no cookies.
| What happens | Why |
|---|---|
Requests to api.github.com |
To display the current version, release date, and star count. Made by your browser directly to GitHub and subject to GitHub's privacy policy. |
Requests to fonts.googleapis.com |
To load the site's typefaces, subject to Google's privacy policy. |
| Standard server logs | The site is hosted on Netlify, which keeps ordinary access logs (IP address, user agent, requested page) for delivery and abuse prevention. We do not analyse or export them. |
| Downloads | Installers are served from GitHub Releases. GitHub counts downloads per release asset; that count is aggregate and contains no personal data. |
Third parties
We do not sell, share, or transfer personal data, because we do not collect any. The services above (GitHub, Netlify, Google Fonts) act only as infrastructure and are governed by their own privacy policies.
Children
Ortu is a general-purpose productivity tool and is not directed at children. Since no personal data is collected, none is collected from children either.
Changes to this policy
If this policy changes, the updated version will be published here with a new date, and the change will be recorded in the project's changelog. Material changes to what the application does with your data will also be noted in the release notes.
Contact
Questions about this policy: open an issue. Security vulnerabilities should be reported privately — see SECURITY.md.
The technical version of this document lives in the repository at docs/PRIVACY_AND_SECURITY.md. See also the code signing policy for how releases are built and verified.