Privacy Policy

Information when browsing this website

This website introduces Hangrail and provides tutorials and demos. Text, files, and screenshots on these pages are samples. Trying a web demo does not read your actual clipboard, desktop, or local library, and does not send real emails or files.

This website has no message form and does not load Google AdSense ads or Google Analytics. This version uses optional PostHog usage analytics, whose scope and opt-out are described below. Older versions with no analytics project configured do not send requests to PostHog. The website is statically hosted on Tencent Cloud EdgeOne Pages (Makers), using “Global availability zones (excluding mainland China).” No Hangrail registration or login is required to browse it.

To serve pages, provide security protection, and troubleshoot problems, the hosting provider may process network request data such as IP address, request time, access path, and browser information, and may use necessary cookies or related protective technologies. Because the website uses servers outside mainland China, this request information may be processed outside mainland China. See the service information in the Tencent Cloud Privacy Protection Statement and Tencent Cloud International Privacy Policy.

You can manage cookies in your browser settings. Restricting necessary protective technologies may affect access. This website's analytics code does not set cookies. This page will be updated if the hosting service changes or new data processing features are enabled.

Anonymous usage analytics

The website and clients with a PostHog project configured allow usage analytics by default to understand which entry points and features are used. These analytics exclude content. Versions with no analytics project configured do not create an analytics identifier or send analytics requests. Analytics do not include clipboard text, notes, images, filenames or paths, search terms, source app names, accounts, or sync credentials. They do not record the screen or replay actions.

The website sends only known page paths, event times, and predefined feature choices, such as viewing a tutorial, trying a demo, switching themes, or clicking get or download links. Download clicks are labeled only as Mac or Windows; the download URL is not sent, and a click does not indicate a completed download or installation. Requests exclude URL query parameters, fragments, and referrer URLs. A random session identifier is stored in the current tab's session storage and is not used to identify you across devices. Turning analytics off clears it. The opt-out preference is saved in this browser's local storage, and the website respects browser Do Not Track (DNT) and Global Privacy Control (GPC) signals. Clearing browser storage resets this preference.

Client analytics include a random installation identifier generated and stored on the device, app and OS versions, event times, and predefined feature usage choices. This identifier is separate from the website session and is not linked to a name, email address, or Hangrail account. You can turn off future analytics in the client's “Settings → Permissions & Data” (设置 → 权限与数据).

Analytics are currently sent over HTTPS to PostHog's US region. IP anonymization is enabled for the project, and requests also ask to disable person profile creation and IP-based location enrichment. The provider still encounters connection information, such as the IP address, when receiving network requests. Anonymization or disabling location enrichment does not mean the connection does not involve an IP address. See the PostHog Privacy Policy. Relevant data is processed outside mainland China.

The switch above controls only future analytics in this browser. The client has its own setting. Events from the disabled period are not sent later, and turning analytics off does not automatically delete data already received by the provider. Questions about data already received can be raised using the contact details on this page.

Content stored locally by the client

Depending on the features you use, Hangrail stores copied text, notes, images, screenshots, file references or copies, source apps, collection times, groups, pinned status, image text indexes, and related settings locally. The app uses this information to display cards and support search, previews, retrieval, and organization. No Hangrail account is required for everyday use.

Ordinary files usually remain referenced at their original locations. Resources in some protected folders are saved as local copies when readable. Image text recognition runs on the device; Hangrail does not upload images to a cloud recognition service. The client contains no ads and does not use your card content for advertising on this website. Optional usage analytics are handled as described above.

The local library is not encrypted as a whole, and the “Vault” group does not mean all its local files are encrypted. Protect your content with your system account, disk encryption, and device access controls. Encrypted sync and backups described below do not change how the local library is stored.

Clipboard and system permissions

When the relevant features are enabled, Hangrail records clipboard changes, collects newly created system screenshots or recordings in selected folders, and processes content you drag in, add, or capture yourself. You can pause collection, exclude specific source apps, or disable the relevant entry points.

The app skips recognizable sensitive sources and confidentiality markers, but cannot reliably identify every password or piece of private information from text alone. Automatic paste, screenshots, and file access may require system permission. When using a card, the app uses information such as the destination app and input focus to paste, without reading the text in the destination field. You can manage or revoke permissions in system settings.

WebDAV sync and backups

When you check a WebDAV connection, find, create, or restore a remote backup, or enable automatic sync, Hangrail accesses the specified WebDAV service for those actions. Synced records and attachments are encrypted with the sync passphrase; manual backups use their respective backup passwords. The server app password used for login serves a different purpose from either of these.

Connection credentials and sync passphrases are stored in macOS Keychain or credential storage protected for the current Windows user. A manual backup password is not included in the backup as recoverable plaintext; you must keep it separately.

Content encryption does not hide all connection information. Providers may still see metadata such as connection IP, request time, object names, and sizes. Server location and the handling of accounts and access logs depend on your chosen provider. Choosing a service outside mainland China may transfer relevant data outside mainland China. Please read that service's privacy and security information.

Nearby Sharing

Nearby Sharing is off by default. When enabled, Hangrail advertises the device name and connection identity information within a local network where devices can communicate. Content you choose to send is transferred to the other device over HTTPS after the receiver agrees. Separately authorizing automatic receipt for a device removes the need to confirm each receipt on this computer.

Device identities, remembered connection information, and received-item sources may be saved locally. Turning off Nearby Sharing stops discovery and transfers, but does not automatically clear remembered devices. You can forget a device in the device list. File copies held by a recipient are managed by that recipient; deleting a card on the sending device cannot recall those copies. Content received through Nearby Sharing is not automatically added to WebDAV sync.

Link icons and software updates

To display website link cards, Hangrail may request the website's root URL and icon information. The destination website and related redirect services receive normal network request information, such as your IP address. These requests do not carry the original clipboard link's path or query parameters, browser cookies, or Referer, and are not forwarded through a third-party icon lookup service.

Automatic update checks are enabled by default. Update checks and downloads connect to release services such as GitHub or Gitee, which may receive information such as IP address, request time, and app version. You can turn off automatic checks in “Settings → General → Software Update” (设置 → 通用 → 软件更新) and still check manually. If system dependencies are required for installation or updates, the installer may also connect to Microsoft's official download service.

Feedback and contact information

When you contact hangrail@outlook.com by email, the maintainer receives your email address, display name, message, and any attached files to reply and handle feedback or privacy requests. The email provider processes relevant information for delivery and storage. See the Microsoft Privacy Statement.

If you submit an issue through GitHub Issues, the maintainer sees the account name, description, attachments, and replies you provide. That information is stored on the platform, whose rules also affect visibility, retention, and deletion options. GitHub Issues is a public feedback channel; please use the email address above for privacy requests.

Whichever channel you use, do not submit passwords, sync passphrases, private documents, complete clipboard history, or unredacted screenshots. Your first message only needs to describe the issue; full personal records are not required.

Retention and deletion

In the app, you can organize or remove cards, set retention periods, export encrypted backups, or disable sync and sharing. Removing a card does not delete the original file. App-managed copies may remain temporarily for undo, references from other cards, or unfinished operations; removal does not mean immediate, complete erasure.

Manual deletion and sync library retention periods may affect ordinary history on other devices and in cloud storage. They do not delete all independent backups, restore snapshots, exported files, or recipients' copies. To clean up further, check those locations separately, along with your WebDAV service and feedback platforms.

To ask about, correct, or delete information you have provided to the maintainer, email hangrail@outlook.com. We may need to confirm your relationship to the information when handling the request. Do not include information requiring protection in public issues.

If advertising is enabled in the future

Google AdSense is not currently enabled on this website. Google explains that its advertising services and participating third parties may use cookies, web beacons, IP addresses, or other identifiers to deliver and measure ads and, subject to applicable settings and consent, personalize them. See How Google uses data from partners. For user choices, see Google Ad Settings.

If ads are enabled or the analytics service changes, this page will be updated with the providers actually used, the purposes of processing, and available choices. Consent management will be configured as required in applicable regions. The description above does not mean this website currently processes information for such advertising.

Policy updates

This policy and the date at the top of the page will be updated when information handling changes in website hosting, client features, or third-party services. You can use Contact us to send questions about the policy.