Privacy Policy
Last updated: 8 August 2026
What we do not collect
There are no accounts, no sign-up and no analytics on this site. We do not ask for your name, email address or phone number, and we do not set any cookie of our own.
Files and chat
Files and chat messages travel directly between the two browsers over an encrypted WebRTC connection. They are never uploaded to us and we could not read them if they were: the encryption keys are generated in your browser and never leave it. Our server only relays the handshake needed for the two devices to find each other.
When a direct connection is impossible — typically behind a strict firewall — the encrypted stream is relayed through our TURN server. That relay forwards ciphertext and cannot decrypt it.
Notes
A note is encrypted in your browser before it is sent. We store the ciphertext, a wrapped key, and an identifier derived one-way from your secret code. We never receive the code itself, so the data we hold is not sufficient to read your note. Notes are held in memory only, are deleted when they expire or are read once, and do not survive a server restart.
Server logs
Our reverse proxy records standard request information, including IP address, for a short period in order to apply rate limits and detect abuse. Secrets are deliberately kept out of URLs — they are carried in the fragment, which browsers never transmit — so they do not appear in these logs.
Advertising
Advertisements from Google AdSense appear on the home page only, and never on the pages where files or notes are handled. Google and its partners may use cookies to serve ads based on your prior visits to this or other websites. You can decline this when first asked, and you can review Google's practices at policies.google.com/technologies/ads.
Contact
This is a self-hostable open project. If you are using someone else's deployment, the operator of that domain is the data controller for the request logs described above.