PrivacyPrivacy

Sending a secret needs no account and collects nothing about you. What reaches our server is ciphertext we cannot read, its size, when it expires and a random id. The key never leaves your browser.

An account exists only because a subscription was paid for. Then we hold an email address, what Stripe tells us about the subscription, and whatever contacts you choose to save.

We keep no record of what you sent, to whom, or when. There is no history to leak because none is written.

[legal entity name], registered at [registered address], decides how the data described here is handled and is the controller for it. Write to [email protected] with any question or request about it.

The secret is encrypted in your browser with a key generated there. Only the ciphertext, its nonce and the chosen lifetime are sent to us. The kind of secret and any name that goes with it are sealed inside the ciphertext, so we cannot tell a password from a note.

The key is placed in the part of the link after the #. Browsers never transmit that part, so it does not appear in our logs, our storage or anyone else’s.

Your IP address is used for one thing: a short-lived marker that enforces the rate limit. It is held for at most sixty seconds and is never linked to a secret or an account.

We hold your email address, because it is both your identity and the way you sign in. We hold what Stripe reports about your subscription: its status, the period paid for, whether a cancellation is pending, and identifiers that let us match you to it. We never receive your card details.

We hold any contacts you save — a name and an address each, up to five. Addresses are shown masked throughout the interface. We do not record which contact you sent what, or when.

We hold hashes of any API tokens, never the tokens themselves, along with the first few characters so a token can be recognised in a list, and the time each was last used. Connecting an AI assistant also stores the identifier that assistant registered with.

Emailing a link. When you ask us to send a link to a contact, the whole link — key included — is sent to our server and on to our mail provider, because an email has to be composed somewhere and it is not composed in the recipient’s browser. It builds one message and is kept nowhere afterwards. Copying the link instead avoids this entirely.

Links made by an AI assistant. A remote assistant cannot run our encryption, so the secret arrives as plain text and is encrypted on our server. It is never written to storage unencrypted. For those links your assistant provider has also seen the secret, as it would anything typed into a conversation.

Cloudflare serves the site and stores the ciphertext. Supabase holds accounts, subscription records, contacts and token hashes. Stripe takes payments and keeps the billing record. Purelymail delivers our email.

Each acts on our instructions for these purposes only. We do not sell data, and we do not use it for advertising. We have no analytics, tracking pixels or advertising cookies; the only things stored in your browser are what a signed-in session needs.

A stored secret is deleted the moment it is opened. One that is never opened is deleted when it expires, and in any case within eight days — the storage itself removes anything older, so nothing can linger because a request never came.

Account data, contacts and tokens are kept until you delete them or ask us to close the account. Stripe keeps billing records for as long as accounting law requires, which is outside our control.

Authorisation codes used when connecting an assistant last ten minutes. Rate-limit markers last sixty seconds.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Contacts and tokens can be deleted yourself, at any time, in your dashboard. For anything else, email [email protected] and we will answer within 30 days.

If you are in the EU or UK you may also complain to your data protection authority. We would rather you told us first.

One request we cannot fulfil: we cannot show you a secret you sent, or tell you whether it was opened. We do not have that, by design.

If this notice changes, the date at the top changes with it. If a change materially affects people with accounts, we will tell them by email before it takes effect.