Skip to content
KanadeKanade

Clipboard and privacy

Gaps in the clipboard history, the privacy cluster and what a notification shows.

  • The clipboard history leaves out only a copy its app marks sensitive with x-kde-passwordManagerHint, as wl-copy --sensitive does. A password copied without it is kept like any other copy until removed or cleared (and pinning it keeps it past Clear all and restarts, on disk as plaintext, until you unpin or remove it). See ADR 0019.
  • Clipboard pins, text and pictures, persist across restarts as plaintext in $XDG_STATE_HOME/kanade/clipboard-pins (default ~/.local/state/kanade/clipboard-pins), readable by you only (the file 0600, its directory 0700 when Kanade creates it). Anything you pin, a password included, sits on disk unencrypted until you unpin or remove it, which deletes it from the file; Kanade does not filter a pin. A file that is damaged or oversized loads nothing or only its valid pins, and is kept as clipboard-pins.bak (also plaintext, 0600) before the next pin change writes a new one; Kanade never deletes the .bak, remove it yourself. A file Kanade cannot read at start (an I/O error, a link, not a regular file) or from a newer Kanade is left as it is, and nothing is saved until the next start. The rest of the history lives only in memory: restarting Kanade forgets it, and there are no snippets, placeholders or sync, and none is planned. A picture’s thumbnail comes from a file under $XDG_RUNTIME_DIR/kanade-clipboard/<pid>, in the folder of the Kanade that wrote it (tmpfs, owner-only), deleted with its entry and swept at the next start only for the Kanades that are gone, so a second Kanade, or a restart racing the one it replaces, keeps its own; with no $XDG_RUNTIME_DIR there are no thumbnails. A Kanade that exits, cleanly or by SIGTERM, or is killed leaves those files (tmpfs, mode 0600, your user only) until the next start or the end of the session. Pins stop at 20 or 16 MiB; the text pane shows only on an island at least 400 pt tall. See ADR 0114 and ADR 0115.
  • The privacy cluster’s microphone and camera see only capture that goes through PipeWire, using pw-dump from the pipewire package. An app that opens /dev/video* or ALSA directly, like ffmpeg -f v4l2, does not show. See ADR 0003.
  • Banners show a notification’s text on screencasts (a share, OBS) unless your niri config has the opt-in layer rule block-out-from "screencast" on kanade-banners, see Installation. The rule covers Banners only: the Island holds the privacy dots, so the Notifications Surface, which draws on the Island, still shows on a screencast. A third-party screenshot tool is not covered by "screencast". See ADR 0070.