Start with the uncomfortable description
A clipboard manager watches a stream that can contain passwords, recovery codes, private links, customer data, and fragments of conversations. Calling that stream “history” does not make it less sensitive. The product only deserves to exist if refusal is designed as carefully as recall.
Pastry begins with a narrow promise: the history stays in one SQLite file on your Mac. There is no account, cloud history, analytics feed, or remote search index. Local storage is the baseline, not the entire privacy model.
Local-first answers where data goes. Refusal answers whether it should be written at all.
Drop the obvious secrets first
macOS applications can mark clipboard contents as concealed or transient. Pastry respects those hints before it hashes, classifies, or stores the item. Password managers, two-factor tools, and banking applications are also ignored by default, and the list remains editable because no bundled list can know every app on every Mac.
These checks are cheap and decisive. A clip that matches one of them never needs a redacted preview because it never becomes a history record.
Classify what remains
Not every application labels a secret. The next pass looks locally for structures with a strong signal: card numbers that pass a Luhn check, JSON Web Tokens, familiar API-key shapes, and high-entropy tokens that do not resemble ordinary prose.
A suspected secret is covered in the drawer and put on a short retention path. Revealing it is temporary for the current window session; it is not a preference that quietly makes every future secret visible.
Give the final decision back
Automation should be conservative around deletion and generous around user control. Monitoring can be paused globally. A pinboard can be marked as a no-history context. Individual apps can be added to the ignore list. Screen-sharing exclusion can hide the drawer from recordings without hiding it from the person using the Mac.
There is no perfect classifier and no useful clipboard manager with zero access. The honest design is layered: decline what the system identifies, detect what it misses, expire what remains sensitive, and make the off switch easy to find.