Privacy policy

Draft. This policy is a starting point and has not been reviewed by a lawyer.

The short version

shhnote.com (“this site”) can’t read your secrets. They are encrypted on your device, and the key never reaches us. We keep as little else as we can, and delete it as soon as we can.

What we store

When you create a secret, we store:

• The encrypted secret. Without the key in your link, it is unreadable, including to us.
• Its settings: when it expires and whether it is deleted after one view.
• Hashed credentials: one-way hashes of the values your browser uses to find or burn it, which can’t be turned back into anything useful.

We don’t store your passphrase, the key from your link, when the secret was created, or whether a passphrase was set. The expiry time is rounded, so it can’t be turned back into the creation time. The encrypted data is padded, so we only know its rough size class.

Large secrets may be kept outside the database, on disk or in object storage. That storage records when each file was written, which is the one place a creation time exists. It is attached to an encrypted file we can’t open, and it goes when the file goes.

If someone reports a link, we count the report for that day. We keep no record of which secret was reported.

When we delete it

A secret is deleted when it expires, or straight after it has been opened if it is a one-time secret. Deleted secrets can’t be recovered.

Deletion removes the record. As on any computer, encrypted leftovers may linger in database journals, free disk space or backups until they are overwritten. They are ciphertext without a key, and we treat backups accordingly.

What we don’t do

• We don’t use cookies or tracking, and we don’t show ads.
• We don’t load anything from other sites: no fonts, scripts or images from elsewhere, so no third party sees your visit.
• We don’t ask you to create an account.
• We don’t sell or share your data.

Your theme choice and, if you pick one in the language menu, your language are remembered in your browser’s local storage and never sent anywhere.

Server logs

This site keeps no request logs: the web server in front of it does not log requests, and the shhnote server keeps no per-secret access log or IP history (rate limiting uses a keyed hash of the address under a salt that rotates). Cloudflare terminates TLS for this site and sees IP addresses under its own privacy policy; it never sees a link fragment or any key, because browsers don’t send the part of the link that holds the key.

Your rights

Depending on where you live, you may have the right to ask what data we hold about you, and to have it corrected or deleted. Since we hold almost nothing that identifies you, there is usually little to share. Contact us at [email protected].

Contact

Questions about this policy: [email protected].