Privacy
This service is built to know as little as possible. Here is everything it stores, and what it doesn’t do.
What we store
- The encrypted content (text and files). We don’t have the key and cannot read it.
- The number of allowed and remaining views plus creation and expiry time.
- Not: IP addresses, browser details, e-mails or anything else pointing to the sender or recipient.
Cookies and tracking
No cookies, no analytics, no third-party scripts or fonts. The page only loads its own files.
Logs and abuse protection
To slow down abuse, the number of creations and views per IP address is counted in the server’s memory for up to 15 minutes. The counts are never written to disk and are not tied to any secret. The web server may log errors, but never content or keys – the key never reaches the server at all.
Deletion
A secret is deleted the moment its last view is used or its expiry time is reached. Expired secrets are purged automatically every minute. No backup of the content is taken.
Encryption
Your browser generates a random 256-bit key and encrypts text and files with AES-GCM (Web Crypto API) before anything is sent. The key is placed in the link’s # fragment, which browsers do not include in HTTP requests. The server therefore only ever sees encrypted data.