Privacy & limitations
There are no ads or analytics anywhere on this site. Note text, secret links, and PINs are not sent to advertisers or translation services. A recipient can still copy or screenshot a message.
What we store
We store encrypted notes, random identifiers, expiry times, and reading/deletion authorization tokens. We do not store plaintext notes, encryption keys, PINs, accounts, or a note history. AES-256-GCM encryption happens in your browser. The secret after # in the link is not sent to our server by the app.
No ads or tracking
The entire site is currently ad-free. We load no advertising scripts, tracking pixels, analytics, or third-party fonts, and the app sets no cookies. We do not send note text, secret links, or PINs to advertisers or translation services. Translations are bundled interface text; your notes are never translated. Language selection uses the page URL, not a cookie.
One read and expiry
Choosing to reveal a note retrieves and deletes the encrypted record in one atomic operation: only one request can succeed. Visiting the link alone does not consume it. Deletion happens before local decryption. If delivery or decryption fails after deletion, the note may be lost and cannot be recovered. Unread notes expire after the sender’s chosen duration.
Links and PINs
Without a PIN, anyone with the full link can open the note first. A PIN-protected note needs both. The browser derives its key using PBKDF2-SHA-256, 600,000 iterations, and the random link secret. Choose an unpredictable 6–12 digit PIN and share it separately. Wrong PINs do not consume the note. After 10 unlock attempts per note in a 15-minute window, all attempts must wait for reset. We cannot recover a forgotten PIN. Short PINs remain vulnerable to offline guessing if both the link and stored encrypted data are obtained.
Search and previews
Public landing pages, guides, and privacy pages can appear in search results. The sitemap lists only those pages and their translations. Editors and note pages send noindex instructions and use generic previews. Crawlers may ignore instructions; these are not access controls. Note contents are never placed in server-rendered HTML, search metadata, or sitemaps. Retrieval requires an authorized request with the secret link and any PIN.
Deletion and device limits
Deletion removes a note from active storage. Infrastructure providers may retain encrypted remnants in backups or operational systems. Recipients can copy, photograph, or save a note. Messaging apps, clipboard history, and browser history may retain links. Encryption cannot protect against compromised devices, extensions, or a website serving malicious code. The app does not verify recipient identity and has not undergone an independent security audit.
Hosting and abuse prevention
Rate limits use a keyed hash of your IP address, retained for up to one hour, plus temporary per-note unlock counters. Vercel and Upstash Redis provide production hosting and storage and may process connection information and operational logs. We do not intentionally log note bodies or secret keys. Local development uses SQLite on your computer.
Your controls
Choose the expiry and optional PIN before creating a note. Keep the sender receipt open to check availability or delete the note. Closing or refreshing loses those controls. Close note clears a revealed message from the recipient’s view. Language switching is disabled while drafting or viewing a note to avoid losing it. We cannot recover notes or PINs.