ClipBuddy
A native macOS clipboard manager, on the Mac App Store
2025 — now
Everything you copy, kept locally and searchable in a keystroke. A menu-bar app in Swift and SwiftUI over a local SQLite store with full-text search, a picker drawer on a global hotkey, and no account anywhere in the product. I designed it, built it, shipped it, wrote the marketing site, and run the releases.
- MAS
- sole distribution channel
- 2.9.x
- shipped release line
- 16
- localizations
- 0
- bytes of clipboard data sent
Designed, built, shipped and supported solo — app, marketing site, store listing and release pipeline.

The constraint that shaped everything
A clipboard manager sees every password, every API key, every private message you copy. That makes trust the whole product, and trust you can only assert is worth nothing. So the privacy claim had to be structural: no account system, no server, no sync path — nothing to leak because there is nowhere for data to go. Every feature since has had to fit inside that constraint, and several obvious ones were cut because they did not.
Local-first storage that stays fast at 20,000 clips
History lives in a single SQLite database in the app's container, with an FTS5 virtual table for search and image blobs on disk beside it rather than in the row. Search stays instant because the index does the work, not a scan.
- FTS5 full-text index over clip contents, kept in sync on write
- Images stored as files, referenced by id — the database stays small
- A schema migration ledger so a database written by any past version opens correctly
- Probe connections opened read-write, after a WAL-mode bug proved a read-only probe silently reports 'no version'
Entitlement with no account system
Free tier is the last ten clips plus the emoji picker; Pro unlocks history, search, snippets and labels. There is no login, no licence key, no backend to check against — StoreKit is the only authority.
- A single access object reads Apple's on-device entitlements and fails closed
- Every surface observes it, so there is one place to be wrong instead of forty
- Monthly, annual and lifetime products, prices always read from StoreKit so they are region-correct
- No server means no outage can lock a paying user out of their own clipboard
A picker that has to be faster than not using it
The drawer opens on a global hotkey, filters as you type, and puts the chosen clip on the pasteboard. Anything slower than reaching for the original window makes the app pointless, so the interaction budget is measured in frames.
- Configurable picker hotkey, with registration failures surfaced instead of failing silently
- Type-to-search across the whole history, not just the visible page
- Opt-in direct paste behind a compile flag — Accessibility is requested only when a user enables it, never at launch
- Labels with their own hotkeys, so a frequent set is one chord away
Release engineering, because there is nobody else
Solo shipping means the process has to catch what a second reviewer would. Most of the tooling in the repo exists because a specific bug got through once and is not allowed to again.
- One reproducible App Store build script — compiling is not packaging, and the script enforces that
- Source gates wired into the build that fail on known-bad patterns, added after a modal-dispatch bug froze the app invisibly
- A manual pass checklist per release covering every surface a change can touch
- Version discipline across the plist, the tag and the store listing, so a rejected build can be re-uploaded without ambiguity
The native surface area nobody sees until it is missing
The long tail is most of the work in a Mac app: system integrations, appearance, localisation, and the dozens of small affordances that separate a native app from a cross-platform shell.
- OCR through Apple Vision — a screenshot becomes searchable by the words inside it
- Translation through Apple's on-device Translation framework
- Snippets with expansion keywords, quick actions for QR, colour swatches and calculations
- 16 localisations, light and dark themes, backup and restore
Also shipped
- Marketing site rebuilt from a React SPA to Astro static output, served through a Cloudflare Worker
- Migrated off direct distribution — Sparkle updater, Ed25519 licensing and payment integration all removed for a store-only build
- Privacy policy written to disclose the one outbound request the app makes: a daily version check carrying only the public store id
- Press kit, App Store screenshots and store copy produced in-house