Security & Data Handling

How we safeguard one-time shares

We designed OnlinClipboard to keep data footprints small. This page explains the storage systems we use, what the Worker does with your data, and the expectations you should have before relying on the service. These practices reduce exposure but do not guarantee absolute security, uninterrupted availability, or protection after a recipient saves the content.

Infrastructure Overview

  • D1 (Cloudflare’s managed SQLite) stores share metadata and text content.
  • R2 (Cloudflare object storage) keeps uploaded files until they are deleted.
  • KV cache stores review statistics to avoid repeated database scans.
  • A Cloudflare Worker orchestrates uploads, retrievals, and scheduled cleanup jobs.

Browser-to-service requests use HTTPS, which protects data in transit from ordinary network interception. HTTPS does not protect a share from someone who obtains its valid link or passcode, a compromised endpoint, malicious browser software, or a recipient who deliberately copies the result.

Data Lifecycle

  1. The sender submits text or uploads an image or file over HTTPS.
  2. The Worker creates the share metadata in D1 and places uploaded objects in R2.
  3. The sender receives a locator as a link, QR code, and passcode for the intended recipient.
  4. A valid first retrieval marks the share as accessed and begins the relevant deletion flow.
  5. Scheduled cleanup removes items that expire before retrieval and any eligible lingering objects.

The service has no user-facing share history, restore button, or repeat-download setting. That limitation is part of the temporary design, so senders should keep an original and recipients should save important content during the first retrieval.

Retention Windows

Every share is created with a 24-hour expiration timestamp. A successful retrieval marks the share as accessed. Text records can be removed as part of retrieval, while uploaded-file cleanup completes through the protected download endpoint or the scheduled cleanup flow.

An hourly scheduled job runs cleanupExpiredShares to delete any remaining records whose expiration time has passed. This job also removes lingering files from R2 so the storage does not accumulate unused data.

Deletion from application storage is not a promise that every transient network cache, browser history entry, or provider security log disappears at exactly the same moment. Those systems can have separate limited retention controlled by browser behavior, Cloudflare, and service configuration. A generated link may also remain in the sender's or recipient's history even after its content is unavailable.

What We Do Not Keep

  • No user-facing version history or recovery function for deleted shares.
  • Direct ?s= share links do not initialize Google Analytics or AdSense; Cloudflare can still process request and security logs.
  • The core clipboard needs only a passcode or slug link. Optional accounts and payments use separate persistent records.

Threat Model and Boundaries

The controls are intended to limit how long a casual transfer remains retrievable and to avoid permanent public storage. They can help when moving a note or ordinary file between devices, but they are not equivalent to end-to-end encrypted messaging, a password manager, a regulated data room, or identity-based access control.

The main risks are disclosure of a link or passcode, guessing of a short passcode, access from an infected device, interception after the recipient opens the item, and unsafe content inside a downloaded file. Rate limiting, transport encryption, one-use retrieval, and expiration reduce some of these risks; they cannot eliminate them. OnlinClipboard also cannot verify that the person opening a link is the person the sender intended.

Cache, Logs, and Public-Page Services

Cloudflare may process request, network, and security information needed to serve traffic and respond to abuse. The application may retain limited technical events and rate-limit identifiers separately from clipboard content. KV is used for public review aggregates, not as a user-facing archive of private shares.

Direct private links containing an s parameter do not initialize Google Analytics or AdSense. Other eligible public pages may use consent-managed analytics or advertising. These public-page services are described in the Privacy Policy and are separate from the one-time retrieval workflow.

Your Responsibilities

  • Do not use OnlinClipboard to store medical, financial, or other highly sensitive personal data.
  • Treat the generated link or passcode like any other secret—anyone with it can retrieve the content exactly once.
  • Use six digits when practical, send access details through a suitable private channel, and do not post QR codes publicly.
  • Keep devices and browsers updated, verify unexpected downloads, and scan files before opening them.
  • Use separate shares for separate recipients rather than forwarding one set of access details.
  • Remember that recipients can still save or forward the content outside the platform after retrieval. Automatic deletion does not prevent manual copying.
  • Contact us promptly at support@onlinclipboard.com if you detect abuse or need a share removed before its expiry—we will attempt to assist when technically possible.