Privacy

What we store

For each secret: the encrypted content, the 12-byte nonce and the two salts needed to derive its key, a coarse size (rounded to the nearest 256 bytes), the times it was created, expires, was read or was burned, and a truncated network prefix of whoever created it — a /24 for IPv4 or a /48 for IPv6, never a full address.

What we do not store

No accounts. No email addresses. No names. No cookies — the theme preference lives in your browser's local storage and is never sent to us. No analytics, no tracking pixels, no third-party scripts of any kind. No full IP addresses. No user agents. No referrers.

What we cannot read

The key that decrypts a secret is generated in your browser and travels in the part of the link after the #, which browsers never transmit. It is not in our database, our logs or our backups, and we cannot derive it. A copy of our entire database yields ciphertext and nothing else.

How long anything lasts

A secret's encrypted content is destroyed the moment it is read or burned. The remaining record — the timestamps, so the sender's private page can say what happened — is deleted at the secret's expiry, and nothing may be set to expire more than seven days out. A job runs every five minutes to remove what has expired.

Logs

Request logs record the method, the route pattern, the status and the duration. They do not record secret identifiers, private tokens, or the resolved paths that contain them. One consequence is worth stating plainly: if a link does not work for you, there is nothing for us to look up.