Privacy & security

How room text is handled

Text in an active room is held temporarily in the application server's memory so connected browsers can synchronize it. The application does not write room text to its own database or permanent file storage.

When the last connected device leaves, the room is scheduled for deletion after two minutes. Reconnecting during that window cancels the scheduled deletion until the room is empty again.

Shared codes are not passwords

A shared code identifies a room; it is not an account credential. Anyone who knows or guesses the code can enter that room while it is active. Use a long, unique phrase that is difficult to guess and never reuse a real password as your code.

Transport and encryption

On the production site, browser traffic is protected in transit with HTTPS and secure WebSocket connections. Room text is not end-to-end encrypted, which means copycopy is not appropriate for passwords, private keys, financial information, health information, or other sensitive data.

Operational logs

The web server and hosting network may process standard request metadata, such as an IP address, browser information, timestamps, and the requested path, for delivery, reliability, abuse prevention, and troubleshooting. A room code is part of its URL and may therefore appear in operational logs; do not include personal or sensitive information in a shared code.

Accounts, analytics, and files

The application does not require an account and its current interface does not include advertising or third-party analytics. copycopy accepts text only; it does not upload files or images and does not automatically read a device's system clipboard.