What SIPLX stores, what leaves your device, and how to remove it.
Last Updated: 15 October 2026
SIPLX is a text-expansion app for Android and Windows. Snippets you write are saved on your device and work without an account. What leaves your device depends on what you use, and this policy goes through each part in turn: signing in, cloud sync, teams, AI Format, purchases, feedback and update emails. Cloud sync uploads your snippet library continuously, and there is no switch for it: it starts by itself once you are signed in on a Pro or Team plan. A team is the one exception to the plan: in a team, on any plan — the free one included — the team snippets you add or change are uploaded to the team, and so is a record of each time you expand one (section 6). AI Format sends the text of one snippet to an outside AI service each time you ask for it (section 4). Staying signed out is what keeps your snippets on your device.
If you do not sign in, nothing is uploaded by cloud sync. SIPLX is fully usable as a guest: your snippets, folders and triggers stay on your device and are never sent to us. Using SIPLX as a guest creates no account with us at all — there is nothing on our side to look up, export or delete, unless you choose to leave an email address for product update emails (see section 2).
The apps do still contact our server while you are a guest — for example to check which sign-in options exist and to fetch the notes for a new version. Those requests can carry the platform, the app version and your language; from Android they also carry the phone’s maker and model and a random identifier for that installation of the app. They carry no snippets, and our server does not store them.
To notice that you have typed a trigger, both apps have to watch what you type in other programs. They do it differently: SIPLX for Android uses an Accessibility Service, and SIPLX for Windows uses a keyboard listener. What each one sees, and what it does with it, is below.
Expanding a trigger into full text in another app is not something an ordinary Android app can do. To type for you, SIPLX uses an Accessibility Service — a permission Android grants only when you turn it on yourself, in your phone's system settings. It is off until you do, and turning it off again stops expansion immediately and does nothing else to your data.
While it is on, the service receives events from the text field you are currently typing in: that the text changed, that a field gained focus, and that you moved to a different screen. To decide whether what you just typed is one of your triggers, it reads the text immediately before your cursor.
Nothing you type in other apps is stored, logged, or sent anywhere, except the fact that you used one of your own triggers. The comparison happens on your device, in memory, against your own snippet list. Text that does not match a trigger is discarded as soon as the check finishes. We never receive it, and it is not written to the app's database, to a file, or to any server — including while your library is being synced. When what you typed is one of your triggers, the app records that expansion — which trigger, which snippet, when — for your statistics (section 2), and for a team snippet that record is uploaded to the team (section 6). Cloud sync uploads snippets you wrote in SIPLX, never text you typed elsewhere.
Open your phone's Settings → Accessibility → SIPLX and switch it off, or use the shortcut in SIPLX's own Me tab (its Settings tab, in versions of the app that have one instead). Expansion stops; your snippets, folders and account are untouched. You can also pause expansion temporarily from the SIPLX notification without revoking the permission.
Windows has no accessibility permission to grant. SIPLX for Windows notices triggers with a keyboard listener that runs on your computer, and it is off when you install SIPLX: it starts only when you turn expansion on yourself, and turning expansion off stops it. While it is on, it receives every key you press, in every program, except where it deliberately stops listening (below).
Collected only if you create an account. An email address you leave only for update emails does not create one; see Product update emails (optional) below.
There is no cloud sync setting to turn on or off. While you are signed in on a Pro or Team plan, the following is uploaded on its own — when you return to the app, shortly after you save something, and when another of your devices changes something:
On the free and Plus plans nothing you write in your personal workspace is uploaded by cloud sync. Signing in on either of those still lets SIPLX download a cloud library you already have — your own data coming back to you — but nothing this device writes there leaves it. A team is the exception, on every plan. If you are a member of a team, the team snippets and team folders you add, change or delete are uploaded so that the rest of the team receives them, together with the change history described above, and each time you expand a team snippet that is recorded for the team. See section 6.
Attachments are never uploaded to us. Images, PDFs and any other files you attach to a snippet are not sent to our servers and do not appear on your other devices through cloud sync. To keep your own copy of them, use Export.
If you have device backup switched on in your Google account settings, Android backs up some of the app’s storage to your Google account. That copy is held by Google under your own account, never by us. SIPLX keeps your snippet database, your attachments, its main settings file and its diagnostic record out of that backup. What it does include is the app’s smaller stored values: among them the random identifier for that installation described below, and your sign-in in encrypted form. Versions of SIPLX for Android from before mid-September 2026 also kept a list of your recent searches inside SIPLX there. Current versions no longer save your searches, but a list an older version saved stays on the phone, and is part of that backup, until you sign out. Moving to a new phone with Android’s device-to-device transfer is a separate path: it carries your snippet database, your attachments and the main settings file across.
So that a change you make on one device shows up on your others without you waiting for the app to check, each signed-in device is registered with us to receive a wake-up signal.
The signal carries none of your content. None of your snippet text, trigger phrases, folder names, email address or account name is in it. What it does carry, and what Google can therefore read as it delivers it, is what kind of signal it is — changes to fetch, or new team usage figures — and which library it is about: the word “personal” for your own, and for a team the random identifier our server gave that team, never the team’s name. Nothing appears on your screen: the app wakes silently and then fetches the change from us over its own encrypted connection.
The Android app registers its token each time it starts while you are signed in, and again when Google issues a new one. We store the token, which platform it belongs to, a random identifier for that installation of the app, and when it was first registered and last updated. Registering the same installation again replaces the stored token rather than adding another. The token is removed when Google tells us it has stopped working — which is what happens when the app is uninstalled or its data is cleared — and otherwise thirty days after you delete your account. Signing out does not remove it from our server, so wake-up signals for your account can still reach that phone; they carry none of your content, only what is described above.
If you answer the in-app “How’s your experience with SIPLX?” prompt, or send feedback from inside the app:
Sending a message needs you to be signed in. Signed out, the app opens your own email app instead, with a message addressed to us.
We link it to your account only so we do not ask again on your other devices, and so we can act on it if it names a problem specific to your account. So that a message reaches a person rather than sitting in a table, our server also forwards it to our own support address through an email delivery provider, Resend; the forwarded copy carries the message, the platform, the app version, the time it reached us, how many snippets you had saved, and which account sent it — identified there by its account id and by the email address on your account. On Android, answering that you are happy opens Google Play’s rating screen, inside the app or in the Play Store; we do not learn whether you went on to leave a rating there.
To decide when to show that prompt, a signed-in app tells our server how many snippets you have saved, and our server keeps, for your account, how many times the prompt has been shown, when, how you answered it, and the highest count it was told. It keeps the same kind of record — how often it was shown and how you answered — for the occasional notice that suggests SIPLX’s app for your other platform.
Only if you choose to leave your email address for them — on the website, in the Android app, or by ticking the box in the feedback form. We then keep:
We use the address only to tell you about new versions of SIPLX and tips for using it. We do not send promotions to it, we do not sell it or share it, and we do not use it for advertising. It is stored with the rest of our data: in the database hosted by Neon, reached through our server on Render (see section 3).
To stop, use the unsubscribe link that every one of these emails carries, or write to siplx.app@gmail.com. After you unsubscribe we keep the address, marked as unsubscribed, only so that we do not email it again; we delete it when you ask us to. Deleting your SIPLX account deletes, at once, an address linked to that account. An address is linked to an account only if, at the moment you left it, our server could still confirm that you were signed in to that account — so one you left while signed in is not always linked, and leaving one while signed out does not link it. Deleting an account does not remove an address that is not linked to it: the unsubscribe link stops the emails, and to have the address deleted, write to siplx.app@gmail.com.
The Android app also keeps the address you subscribed with on the phone, so it can show that you have. It stays there when you sign out, and is removed if you delete your account together with that phone’s data (section 7).
The apps tell our server two small facts about the device they run on, and we keep them:
One phone and one Windows computer at a time. An account holds one phone session and one Windows session. Signing in on a second phone ends the first phone's session, and signing in on a second computer ends the first computer's; the earlier device is signed out. Signing in on the website counts against neither. There is no screen that lists your signed-in devices. For each session our server keeps the kind of device and when the session was created, when it expires and when it was ended — no IP address and no other device details — until you delete your account.
We do not collect an advertising identifier, a hardware serial number, your IMEI, your phone number, or a list of the other apps on your device.
Some of what the apps keep never leaves the device it is on:
Cloud sync data is stored in a PostgreSQL database hosted by Neon, in Amazon Web Services' Asia Pacific (Singapore) region. Data is encrypted in transit using HTTPS. It is stored as ordinary text: we do not offer end-to-end encryption, and the database can be read by us.
The server our apps and our website talk to runs on Render, in its Singapore region. Everything sent to us passes through it: your email address and the sign-in that proves it is you, the token that renews your session afterwards, your snippet data while you are signed in on a Pro or Team plan, and, on any plan, what you add to or change in a team you belong to.
Like any server, ours receives the IP address a request comes from. It uses that address, in memory, to limit repeated attempts at signing in, at leaving an email address and at deleting an account. Our server does not store it and does not write it to its log.
Our server also writes a diagnostic log — the ordinary record of what it did, kept so that failures can be traced. It is held by Render, separately from the database, and it is not reached by anything you delete: deleting a snippet, or your whole account, changes the database and does not go back into the log. Render keeps log lines for 7 days — the retention period for the plan our workspace is on — after which they are no longer available to us. We cannot shorten that period, and neither we nor you can erase one line before it expires. The log is not forwarded anywhere else: no third-party logging or analytics provider receives it.
Your email address has been written to that log. Several sign-in and account paths recorded the address of the account they were acting on, so that a line could be matched to an account. That changed on 4 October 2026: those paths now record an internal account number instead. Lines written before the change still carry the address. Either way, a line expires with every other line, within 7 days of being written — including lines about an account that has since been deleted. Deleting your account does not remove them; the 7 days does.
The outside services that take part in running SIPLX, and what each one handles:
| Neon | Hosts our database: everything this policy says we store. |
|---|---|
| Render | Runs our server and keeps its diagnostic log (above). Everything the apps and the website send us passes through it. |
| Sign-in: Continue with Google in the apps and on the website. Android device wake-up signals through Firebase Cloud Messaging (section 2). Purchases made inside the Android app, through Google Play (section 5). The main pages of siplx.com also load their typefaces from Google Fonts (section 9). | |
| OpenRouter, and the provider of the AI model it routes to | The text you send with AI Format (section 4). |
| Lemon Squeezy | Subscriptions bought on siplx.com (section 5). |
| Resend | Delivers the copy of your feedback that our server forwards to our own support address (section 2). |
| Netlify | Hosts siplx.com and serves its pages to your browser. |
| GitHub | Hosts the copy of this policy and the account-deletion page at siplx.github.io, and the SIPLX for Windows installer and its updates (section 2). |
Neon, Render, Resend and Google's wake-up service process data on our behalf and are not given it for their own purposes. Google Play and Lemon Squeezy handle payments under their own privacy policies (section 5), OpenRouter under its own (section 4), and Netlify, GitHub and Google receive, like any website or download host, your IP address and basic browser details when you use them. We do not sell your data to anyone.
When you tap the AI Format button on a snippet, the text of that snippet and the format you picked are sent to our own server, which forwards them through OpenRouter — an AI gateway — to the language model that produces the formatted result. We choose that model on the server rather than in the app; today it is DeepSeek V3.2, and it may change. So the text of that one snippet is seen by OpenRouter and by the provider of the model in use. A run starts only when you ask for one, and only for the snippet you chose. The first time, the app tells you that text will be sent to an AI service and waits for you to agree. You have to be signed in; signed out, nothing is sent.
What is sent is the snippet's text and the format itself. A format is something you wrote, so the request also carries the instruction you gave that format, the list of fields you asked it to produce, and any rules you have taught it. Teaching a format by showing it examples is a second request, and that one carries the examples themselves — the before and after text you typed — along with any correction you wrote and the rules the format already holds. In SIPLX for Android up to version 1.22.8 and SIPLX for Windows up to version 1.5.36, that second request is sent without the notice described above being shown first, even if you have never agreed to it. Attachments — images, PDFs and any other file you attach — are never sent to the AI.
Two more requests can follow from a format you have used, without a separate tap:
Our server does not log or store the text you send, or the result that comes back from a successful call. When the AI provider answers with an error instead, the first 400 characters of its response are recorded in our diagnostic log so the failure can be traced. Beyond that it records only metadata about the call: its size, whether it succeeded, and the usage counted in section 5. Your account credentials are not sent to OpenRouter or to the provider of the model.
SIPLX for Windows has a setting, under AI, for an AI gateway address of your own. It is empty unless you fill it in. If you do, AI Format requests — your text, and your SIPLX sign-in — go to that address instead of to our server, and what happens to them there is outside this policy.
A format can be taught: you can give it rules, and you can show it examples — a before and an after that you type in yourself. On Android, what a format has learned — including the corrections described above — is stored inside that format, so it is uploaded with the format on a Pro or Team plan, and is deleted from our server with your account record, thirty days after you delete your account. On Windows it is held in the app's own database on that computer and is never uploaded.
Each app also keeps a record of its own AI Format runs, on the device, and neither record is uploaded:
What you can remove, on Windows. In SIPLX's settings, under AI, you can clear the run history, and clear what the AI has learned for all formats at once; a single format's learning screen also has Forget everything. Signing out clears both for the account you signed out of. Removing the app and its data removes everything it kept on that computer.
There are two ways to pay, and both attach to the same SIPLX account. Purchases made inside the Android app — subscriptions and Ink top-ups — are handled entirely by Google Play Billing. Purchases made on siplx.com by Windows users — subscriptions — are handled by Lemon Squeezy, LLC, the merchant of record for those sales. Which plans are on sale through each of them can change; the pricing page always shows what you can actually buy today. In both cases we never see or receive your card number, bank details or billing address. Google or Lemon Squeezy tells us only that a purchase happened, and our server then updates the Plus, Pro or Team entitlement on the account the purchase belongs to.
To make a subscription or an Ink top-up work, our server stores:
| The purchase token Google issues | So we can ask Google whether the purchase is genuine and still valid, and so a refund can be applied |
|---|---|
| The subscription and customer identifiers Lemon Squeezy issues | For a website purchase: so we can ask Lemon Squeezy whether the subscription is still active, and so you can open its customer portal from the app or the site |
| Which SIPLX account a website purchase belongs to | Your account identifier and your email address are passed to Lemon Squeezy when you start a checkout on siplx.com. The identifier is what comes back with its notifications, so the subscription lands on the account you were signed in to; the address is there so its receipt reaches you without you retyping it. Only the website does this — a purchase made inside the Android app goes through Google Play and never reaches Lemon Squeezy |
| Which product and plan you bought | Plus, Pro or Team, monthly or yearly, and the number of seats for a team |
| When it expires | To know whether your subscription is active |
| Your Ink balance | Ink is the credit that pays for AI use |
| A line per Ink movement | The amount added or spent, the balance afterwards, the reason, and — for AI use — how many tokens the request and the reply came to |
| How many free AI uses you have had this week | A count only, reset every Monday |
| A record of each Google Play order | Play's order number, the purchase token it belongs to, the product, and when we first and last confirmed it — so that a later refund or chargeback can be matched to the purchase it is about |
| A record of a payment dispute, if one is opened | Which order it concerns, its state and amounts, and what Google Play or Lemon Squeezy reported about it |
| A record of each notification Lemon Squeezy sends us | What kind of notification it was, which subscription it was about, which account it was matched to, when it arrived and whether we acted on it — so the same notification is never applied twice, and so a payment that did not reach an account can be traced |
The Ink record counts your AI usage; it does not keep what you sent. The text of a snippet is not written to that record — see AI Format above.
When you delete your account, the identifying details on it — your email address, your name, the link to your profile picture, your sign-in details — are removed immediately. The purchase and Ink records above go with the account when the record itself is removed, thirty days later — except three kinds, which we keep: the Google Play order records and any payment dispute records, so that a refund or chargeback can still be settled, and the record of Lemon Squeezy’s notifications, so that none is applied twice. The dispute and notification records lose their link to your account at that point, and the order record never had one. A dispute record also keeps notes on what was reported about it, and those can still include the internal number our server gave your account and, for a website purchase, Lemon Squeezy’s number for you as a customer. None of these records contains snippet text at any point.
Google keeps its own record of an Android purchase under Google's privacy policy, and refunds for it are requested through Google Play rather than through us. Google Play also notifies our server about Android purchases, for example when one is refunded or disputed. Lemon Squeezy keeps its own record of a website purchase — including the email address, name, billing address and payment method it collects to take payment, issue invoices and handle tax — under Lemon Squeezy's privacy policy; refunds and cancellations for it go through the Lemon Squeezy customer portal or by email to us. Lemon Squeezy sends our server notifications about a subscription (created, paid, cancelled, expired, refunded); we act only on notifications whose signature we have verified, and a repeated notification is not applied twice.
If you join or create a team, content you place in that team's workspace is shared with the other members of that team.
@. If your account has no name when you sign in on Android, the
app asks you for one. The apps do not offer a way to change it afterwards;
contact us (section 13) if you want it changed. Inside a team, the owner
— or an admin, for an ordinary member — can also give you a name
that only that team sees.
When you expand a snippet inside a team workspace, that expansion is recorded and uploaded to the team: the trigger phrase you typed, the title of the snippet it expanded, when you typed it, and how many characters it saved, attributed to your account. Which app you were typing in is not uploaded.
Deleting a snippet puts it in a recycle bin rather than destroying it. For thirty days you can restore it, and for those thirty days its text still exists — on your device, and in your cloud library if it had reached your cloud library. When the thirty days are up, SIPLX for Android clears the title and the text and sends the emptied row to us, so the cloud copy is emptied too; what is left is an empty record that the snippet was deleted, which is what tells your other devices to delete it as well. That record is removed from the device after ninety days.
One exception, in current versions of both apps: a snippet with no body text — one that holds only a title or an attachment — is treated as already deleted forever as soon as you delete it. It does not appear in the recycle bin and cannot be restored, and if it had reached our server, its internal note is cleared there.
Delete forever, in the recycle bin, does not wait: the snippet’s text and its internal note go from the device and from the snippet in your cloud library in the same step. Whether its title goes too depends on the app. SIPLX for Android clears the title of a snippet in your personal workspace; SIPLX for Windows keeps the title, and so does SIPLX for Android for a team snippet, on the emptied record that tells your other devices the snippet was deleted. If the snippet had reached our server, its trigger phrases also stay there, in the record that they were deleted. SIPLX for Windows has no thirty-day sweep of its own, so on an account you only ever use from Windows a deleted snippet's text stays in your cloud library until you delete it forever.
Neither removes the snippet's change history. If a snippet ever reached the cloud, the earlier versions kept in its history — up to fifty, each holding the title and text before and after a change — stay on our server after the snippet is deleted, and so does the empty record of the deletion. For a personal snippet they are removed when you delete your account. For a team snippet they stay part of the team’s history, readable by its members, until the owner dissolves the team.
In the app on Android, open Me, tap your account at the top, then Delete account. In versions of the Android app that have a Settings tab instead of Me, it is Settings → Profile → Delete account. On Windows, open Account in the sidebar, then Delete account. If your account signs in with Google, you will be asked to sign in with Google again first, to confirm it is you.
You can also delete your account from the web, without installing the app: siplx.github.io/siplx-privacy/delete-account/.
When you delete your account, on our server:
| Your personal snippets, with their triggers, internal notes and change history, and your personal folders | Deleted immediately |
|---|---|
| Your email address, display name, profile picture link and sign-in details | Removed from your account record immediately |
| All sign-in sessions | Ended and deleted immediately; every device is signed out |
| An email address for update emails that is linked to your account | Deleted immediately. An address that is not linked is not reached by this — leaving one while signed out never links it, and leaving one while signed in does not always (see section 2): ask us to delete it |
| Your AI Formats and what they have learned; feedback you sent us; your device wake-up tokens; your team usage records; your subscription, Ink and free-use records | Deleted with the account record, thirty days later |
| Google Play order records, payment dispute records and the record of Lemon Squeezy’s notifications | Kept. Their link to your account goes with the account record, thirty days later (section 5) |
| Teams you own | Passed to the member who joined earliest. If you are the last member, the team ends: its snippets are marked deleted on our server with their text kept, and its usage records and history are not removed at that point |
| Team snippets you wrote | Kept for the team with your name removed, unless you choose to delete them (below) |
| Entries you made in a team’s change history | Kept for the team with your name removed. They still hold the text before and after each change, and the name of the device that made it |
| Lines already written about you in our server’s diagnostic log | Not removed — they expire on their own within 7 days (see section 3) |
When you delete your account from SIPLX for Windows or from the web page, you are asked whether to also delete the snippets you contributed to teams; the Android app does not ask, and leaves them with the teams. Snippets you leave remain available to those teams and are no longer associated with you. If you choose to delete them, the snippets themselves are deleted, but the team’s change history of them is kept as described above.
On your devices. Deleting your account signs every device out, and each app then clears what it clears when you sign out. The snippets on a device stay there, where no account can open them any more — unless, on the device you delete the account from, you also tick the option to delete that account’s data from it. That option is off until you tick it, and it runs only after our server has confirmed the account is gone:
After deletion, a de-identified record of the account remains for 30 days — without your email address, display name or sign-in details. Nobody can sign in to it. Signing in again with the same Google account creates a new, empty account; it does not bring the old one back. After 30 days the record is removed as well, together with the records the table above says go at that point.
All of that is the database. Our server’s diagnostic log is a separate store, and deleting your account does not rewrite it: lines written before the deletion, including any that carry your email address, stop being available after 7 days and cannot be removed sooner.
The sections above are about the SIPLX apps. The website is a separate thing and a much smaller one: it describes the product, it lets you sign in with Google (which creates an account if you do not have one yet), buy a subscription, send us feedback and ask for update emails. Your snippets are never on it. siplx.com is served by Netlify; the copy of this policy and the account-deletion page at siplx.github.io are served by GitHub. Like any web host, each receives your IP address and basic browser details when you open a page.
The site sets no cookies, so there is no cookie banner to dismiss. Three values are kept in your browser's own storage:
siplx_refresh_token |
Kept while you are signed in, so that reloading the page does not sign you out. It is sent to our server to renew your session, and it is removed when you sign out. It has no expiry of its own — signing out is what clears it. |
|---|---|
siplx_user_cache |
The account details our server returns when you sign in — your email address and display name among them — so the page can show who is signed in without asking again. Cleared when you sign out, and when you close the tab. |
siplx-lang |
The interface language you picked. It is not tied to your account, and it stays until you clear your browser data. We do not send it to our own server, but it is passed to Google as the language for the sign-in button, at the moment you open the sign-in dialog. |
The website only offers Continue with Google — there is no email and password form here. Choosing it loads Google's sign-in code, and only at the moment you open the sign-in dialog, not on an ordinary visit; Google sees that request. We receive an identifier for your Google account, never your Google password. If you are already signed in, opening the site quietly asks our server to renew your session, and asks it whether your subscription is still active — nothing else is sent.
The main site loads its typefaces from Google Fonts as the page opens, so your IP address and basic browser details reach Google — before you sign in, and whether or not you ever do. This policy page and the refund page carry no such request: they use whatever fonts your device already has, and load nothing from Google. Google explains what it does with that in its own privacy policy.
SIPLX is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will remove it.
If we change what SIPLX collects or how it is used, we will update this page and change the "Last Updated" date at the top. Material changes to how we handle data that has already been collected will be announced in the app.
Questions about this policy, or requests about your data, can be sent to siplx.app@gmail.com.