This page describes how Kopigo actually protects your content — and where the protection ends. It is written to match the implementation, not to market it.
End-to-end encryption
Each of your devices generates an X25519 key pair locally when it registers. The private key is stored in the platform’s secure storage (such as Keychain on Apple platforms) and never leaves the device. Only the public key is registered with the Kopigo service.
When you send text, the sending device performs a fresh X25519 ephemeral-static key agreement against each destination device’s public key and encrypts the content with ChaCha20-Poly1305 authenticated encryption. Every destination device receives its own independently encrypted envelope: ciphertext with its authentication tag, a nonce, and the sender’s one-time ephemeral public key.
These are standard, widely reviewed primitives from a maintained cryptography library. Kopigo does not invent its own cryptographic algorithms.
What the relay service stores
- Your account identity, authenticated through Firebase Authentication.
- Device records: public key, platform, registration and last-seen timestamps, online status.
- Encrypted transfer envelopes, only while in transit: they are deleted once the receiving device confirms decryption and storage, and undelivered envelopes expire and are erased after 30 minutes.
- Routing and receipt metadata — which of your devices sent an item to which of your devices, and delivery/copy acknowledgement timestamps — retained for up to 7 days so your devices can synchronize their sent histories.
- Device names and hostnames only as encrypted envelopes produced on your devices. The service stores and returns them but cannot decrypt them.
- For Android notifications, a Firebase installation identifier, encrypted at rest.
The service never accepts plaintext clipboard text, never receives OCR images or recognized text, and never stores your clipboard history.
On-device processing
- OCR (text from images) runs entirely on the device using an on-device recognition engine. Images are not uploaded; camera captures used for recognition are deleted afterwards; gallery originals are never modified.
- QR scanning is decoded locally. Decoded values only fill the editable text field — they are never opened, copied, or sent automatically.
- Clipboard history is stored only on the device. Each entry is individually encrypted with ChaCha20-Poly1305 under a random 256-bit key held in the device’s secure storage, and each direction (sent/received) keeps at most the 50 newest entries.
Notifications
Android background notifications use Firebase Cloud Messaging. The push payload contains a generic clipboard-arrival event and the random delivery identifier needed to act on exactly that delivery — never clipboard content, ciphertext, device names, hostnames, or account identifiers. The notification handler never fetches or decrypts content in the background.
Service and operations
- Every API operation requires a verified Firebase ID token; devices and transfers are strictly scoped to the authenticated account.
- Attempts to access another account’s devices or transfers return "not found" rather than confirming their existence.
- Transfer sizes, stored pending transfers, active devices per account, and request rates are all bounded to keep the service available for everyone.
- Application logs never contain clipboard text, OCR text, device names, tokens, ciphertext, nonces, or private keys.
Honest limitations
No product is "perfectly secure", and we would rather you know exactly where Kopigo’s boundaries are:
- Kopigo is not an anonymity tool. The service authenticates your account and knows which of your devices exchanged encrypted envelopes and when. Metadata exists and is described above.
- Kopigo does not claim "zero knowledge". The design protects content from a curious operator or a leaked database: stored content is either encrypted to your device keys or already deleted.
- The design does not protect against an actively malicious relay service. A malicious operator could substitute device public keys during registration and intercept future transfers. Defending against that requires separately authenticated device pairing or key transparency, which Kopigo does not currently implement.
- Your devices are the trust boundary. Anyone who can unlock a signed-in device can read its clipboard history; the history blur setting is a viewing convenience, not an additional cryptographic barrier.
- Firebase Authentication (Google) processes sign-in, and Firebase Cloud Messaging processes the generic Android push event. These are third-party processors and are documented in the privacy policy.
Reporting a security issue
If you believe you have found a security vulnerability in Kopigo or this website, email support@kajodex.com with the details. Please give us a reasonable opportunity to fix the issue before public disclosure. We do not currently operate a paid bug-bounty program.