- 你发的文字、照片、视频和文件，在你的手机和电脑之间直接传，不经过我们的服务器。
- 不需要注册账号；我们不收集、不出售、不分享你的个人数据。
- 没有广告，没有统计分析，没有追踪。
- 记录只存在你自己的设备上，随时可以清空；卸载插件就全部删除。
我们会处理哪些内容
Tapaste 只处理你主动发送的东西：
- 文字、照片、视频和文件：你在手机或电脑上点「发送」或选择的内容，以及电脑网页上你右键选择「发到手机」的文字或图片。
- 剪贴板：只有在你点「发刚复制的」、按快捷键，或者自己打开「复制就发」开关（默认关闭）时，插件才读取剪贴板里的文字或图片。「复制就发」打开后，插件每 0.7 秒看一次剪贴板，只在内容变了、并且手机连着的时候发送；看起来像密码的内容不会发送。手机发来的文字会放进电脑剪贴板，方便你直接粘贴。
- 收到的照片和文件：电脑上自动存进「下载\Tapaste」文件夹；手机上先留在网页里（只留最近 20 条），你点「存到相册」或「存到手机」时才保存到手机。
内容怎么传过去
手机和电脑配对后，用浏览器自带的 WebRTC 技术直接连接，传输全程加密（DTLS）。文字、照片、视频和文件不经过我们或任何第三方的服务器。
两台设备第一次互相找到对方时，需要交换一小段连接信息（比如设备在网络里的地址）。这段信息用你们配对时生成的密钥（AES-GCM）加密后，经过一个「介绍人」服务器转交。目前介绍人使用 EMQX 提供的公共服务（broker-cn.emqx.io，连不上时用 broker.emqx.io）。它看不到你的文字和照片，也解不开连接信息，只能看到一个随机的频道名，以及连接它的网络地址（IP）。
为了在不同网络环境下也能连上，设备会询问公共 STUN 服务器「我在外网看起来是哪个地址」（小米 stun.miwifi.com、Cloudflare、Google）。这些服务器只会看到你的网络地址，看不到任何内容。
存在你设备上的数据
- 配对密钥：用来认出你自己的手机，只存在电脑插件和手机浏览器里。
- 收发记录：最近发过、收到的文字、照片、视频和文件，方便你再次复制或保存。超长文字只保留前 2 万字。每一条都可以单独删除，两边也都有「清空记录」。
- 待发送的内容：对方暂时不在线时先存在本机，连上后自动补发；24 小时没送到就自动丢弃，也可以手动取消。
- 连过的手机：用来在有新手机连上时提醒你。
这些数据都不会上传。卸载插件、清除手机浏览器的网站数据，就会全部删除。
插件权限的用途
- 读取 / 写入剪贴板：发送你刚复制的内容，把手机发来的文字放进剪贴板。
- 下载：把手机发来的照片和文件存进「下载\Tapaste」文件夹。
- 右键菜单、当前标签页、脚本注入：网页上右键「发到手机」时，读取你选中的文字（保留换行）。
- 访问网页上的图片（可选，用到时才询问）：右键发网页上的图片、或把侧边栏照片拖进网页时才需要。只用来取那一张图或放进那张照片，不读取你的浏览记录和网页内容。
- 通知：收到照片或文件、发送失败时提醒你。
- 后台页面、本地存储：保持和手机的连接，保存上面说的本机数据。
手机网页
手机网页目前放在 GitHub Pages（github.io）上，GitHub 作为网站服务商会按它自己的隐私政策记录访问日志。手机网页只在你点「扫码配对」时使用摄像头，画面只在手机上识别二维码，不保存也不上传。
儿童
Tapaste 不面向 13 岁以下儿童，也不会有意收集任何人的个人信息。
变更
如果做法有变化（比如以后提供服务器中转），我们会先更新这一页，并修改上面的日期。
联系我们
有任何问题，可以在 GitHub 上留言。
- Text, photos, videos and files you send go directly between your phone and your computer. They never pass through our servers.
- No account needed. We don't collect, sell or share your personal data.
- No ads, no analytics, no tracking.
- Your history stays on your own devices. You can clear it at any time, and uninstalling the extension deletes everything.
What Tapaste handles
Tapaste only handles what you choose to send:
- Text, photos, videos and files you send from your phone or computer, and text or images on a web page that you right-click and choose “Send to phone”.
- Clipboard. The extension reads your clipboard only when you click “Send what I just copied”, press the keyboard shortcut, or turn on “Send on copy” (off by default). With “Send on copy” on, it checks the clipboard every 0.7 seconds and sends only when the content has changed and your phone is connected. Anything that looks like a password is not sent. Text from your phone is placed on your computer's clipboard so you can paste it.
- Received photos and files are saved to the
Downloads\Tapaste folder on your computer. On the phone they stay in the page (only the latest 20 items) until you choose to save them to your phone.
How your content travels
Once paired, your phone and computer connect directly using WebRTC, which is built into the browser. The connection is encrypted end to end (DTLS). Text, photos, videos and files never pass through our servers or anyone else's.
To find each other, the two devices exchange a small piece of connection information, such as their network addresses. It is encrypted with a key created when you pair (AES-GCM) and passed along by a “signaling” relay. Today that relay is a public service run by EMQX (broker-cn.emqx.io, falling back to broker.emqx.io). It can't see your text or photos and can't decrypt the connection information. It only sees a random channel name and the IP address that connects to it.
To connect across different networks, your devices ask public STUN servers (Xiaomi stun.miwifi.com, Cloudflare and Google) what their public address is. These servers only see your IP address, never any content.
Data stored on your devices
- Pairing key, used to recognise your own phone. It is stored only in the extension and in your phone's browser.
- History of recently sent and received text, photos, videos and files, so you can copy or save them again. Very long text keeps only its first 20,000 characters. You can delete any single item, and both sides have a “Clear history” button.
- Pending items. If the other device is offline, items wait on your device and are sent automatically once it reconnects. Anything not delivered within 24 hours is dropped, and you can cancel items yourself.
- Known phones, so Tapaste can tell you when a new phone connects.
None of this is uploaded. Uninstalling the extension, or clearing the site data in your phone's browser, deletes it.
Why the extension asks for each permission
- Clipboard read / write: to send what you just copied, and to put text from your phone on the clipboard.
- Downloads: to save photos and files from your phone into
Downloads\Tapaste.
- Context menus, active tab, scripting: to read the text you selected (keeping line breaks) when you right-click “Send to phone”.
- Access to web pages (optional, asked only when needed): only for sending an image from a web page, or dropping a photo from the side panel into a page. It is used just for that one image or photo. It never reads your browsing history or page content.
- Notifications: to tell you when a photo or file arrives or a send fails.
- Offscreen document, storage: to keep the connection to your phone alive and store the on-device data described above.
Phone web page
The phone web page is currently hosted on GitHub Pages (github.io). As the host, GitHub keeps access logs under its own privacy policy. The page uses your camera only when you tap “Scan to pair”. The QR code is read on your phone, and the image is never saved or uploaded.
Children
Tapaste is not directed at children under 13, and we do not knowingly collect personal information from anyone.
Changes
If anything changes, for example if a relay server is added later, we will update this page and its date first.
Contact
Questions? Leave a message on GitHub.