Your browser makes a random key and encrypts the secret with AES-GCM before it sends the secret. The key is in the link, after the # sign. Browsers never send that part to a server. If you add a passphrase, the key also depends on the passphrase (PBKDF2, 210000 rounds). Your passphrase and your key never leave your browser.
What the server stores
The secret as encrypted data.
A hash of a read token and a hash of a delete token. The server uses them to check who may read or delete the secret. They do not show the key.
Whether the secret has a passphrase.
The number of wrong tries, the time you made the secret and the time it ends.
A random id, which is part of the link.
The server never stores these items:
The key of the link, or your passphrase.
The text of your secret, in a form it can read.
Your email address or your IP address.
How long it stays
You choose 1 hour, 1 day or 7 days. The server deletes the secret at the first view, when you press "Delete this secret now", on the 10th wrong passphrase, or when the time ends. Expired secrets are removed at the latest one hour after the time ends. A secret never stays longer than 7 days.
Links and previews
A link looks like /s/ID#KEY. Anyone who has the whole link can try to read the secret. Send it only to the person you mean.
A chat app can load the link to make a preview. A preview does not read or delete the secret. Only the button on the page does.
The server cannot show you the link again, because it does not have the key. Copy the link when you make it.
In your browser
The page keeps the secret, the passphrase and the key only in memory. It writes nothing to localStorage, sessionStorage or IndexedDB. After you read a secret, the page removes the key from the address bar. Copy the secret before you close the page.
Where it runs
Secret link runs on Cloudflare. The records are in Cloudflare D1. Like any web host, Cloudflare sees your IP address and the page you ask for. To limit how many secrets one address can make, Cloudflare counts requests by address. We do not store or log the address.
Analytics and error reports
Cloudflare Web Analytics can add a small script to the pages, to measure visits and speed. We do not control that script. Our own code sets no cookie and keeps no profile of you.
If the page has an error, it sends a report with the error message, page type and browser. It has no secret, key or passphrase. Cloudflare keeps technical request logs, with no IP address, for 7 days. For about 1 in 10 requests, Cloudflare also records the browser and operating system, the language, the network and an approximate location. These records hold no secret and no key.
