Security & privacy

When you enable encryption on a note, the content is encrypted in your browser with AES-GCM-256 before any request is made. The key is placed in the link fragment — the part after the “#” — which browsers never transmit to a server. We receive ciphertext when the note is created and serve ciphertext when it is opened; the key only ever exists in your browser and your recipient's.

The practical consequence is that our good intentions stop being part of the arrangement. We cannot read an encrypted note, cannot produce its contents in response to a legal demand, and cannot expose it in a breach, because the stored rows contain nothing readable. That is a structural guarantee rather than a policy promise.

What it does not protect is the link itself. Anyone who obtains the full URL — from a forwarded message, a screenshot, or a device someone else can read — has the key. Encryption protects the note from us and from anyone who breaches our storage; it cannot protect it from a link that reaches the wrong person. Pair it with burn-after-read or a short expiry when that risk is real.

Unencrypted notes are stored so the share page can render them, and are deleted when the link expires. Files uploaded to a share are stored until the link expires or you delete it, then removed from storage — expiry is a deletion, not a hidden flag on a record that stays in a bucket.

Passwords on links are stored only as a one-way hash. That is why a lost password cannot be recovered: there is nothing to look up. A password we could recover for you would also be a password we could be compelled to hand over.

For trackable links and QR codes we record the scan, the device and browser family, and a country derived from the request. The IP address is used to derive that country and is then discarded — it is never written to storage, so scan history cannot be traced back to an individual visitor.

We are specific about this because vague claims are worse than none. Our marketing and blog pages carry advertising and analytics, which is how the free tier is funded. The pages where your content lives — shared notes, file shares, and hosted documents — carry no ad script and no third-party tracking.

That separation is enforced in code rather than by convention: the ad script is loaded only on an explicit list of marketing routes, so it cannot appear on a note page, a file share, a document, or any signed-in part of the application.

Shared content is also excluded from search engines. Note pages and file shares are served with a noindex directive, and hosted documents are not indexable unless the owner opts in — so a link stays private to the people you send it to, even though anyone holding it can open it.