Privacy, plainly

The person who creates a session gets a link and a separate secret phrase. Anyone opening the link sees the ordinary utility. The private view only appears after the phrase is verified by the server. It locks after five minutes without interaction, and also when the page is hidden, the device is locked, or Hide is selected.

The phrase never leaves your device. Your browser derives two keys from it: one is sent as a verification value, which the server keeps only as a slow one-way hash; the other stays in memory and encrypts message content.

Message content is encrypted in your browser with AES-GCM before it is uploaded. The server stores ciphertext and a nonce. Content is never logged, never included in error reports, and never used for analytics.

Reply references and emoji reactions are encrypted as message content. A reply does not copy the original text, so it displays as expired after the original message is removed. A sender can delete their own message for both participants; linked reactions and any encrypted photo file are removed with it.

Every message carries an expiry that starts when the other participant first opens it. An unread message remains until the conversation itself expires. Expired messages are deleted from the database by a scheduled job and are also removed whenever the conversation is loaded. Decrypted text is held only in memory, so closing or reloading the page discards it and requires entering the phrase again.

Where photo sharing is enabled, the browser resizes and re-encodes the image to remove embedded metadata, encrypts the resulting bytes, and uploads only the encrypted file to private storage. Decrypted photos remain in browser memory only and are cleared when the private view locks. The encrypted storage object is queued for deletion with its message. A conversation can store up to 250 photos at once. In a conversation without automatic expiry, each unread photo is retained for no more than 90 days.

Phrase attempts are limited per client and per session, with a growing delay after repeated misses. Incorrect attempts look exactly like ordinary use of the utility, and unknown links behave identically to real ones.

Noduo does not require accounts and does not verify anyone’s identity, age, authority, intentions, or trustworthiness. A private conversation proves only that someone has the session link and secret phrase — not that they are the person they claim to be.

Do not share sensitive information, send money, follow instructions, meet in person, or take any other action based on a conversation unless you have independently verified the identity and authority of the person you are communicating with.

Noduo provides the communication technology only. It is not a party to agreements, transactions, meetings, representations, or disputes between participants.

One-hour and 24-hour conversations are free. Longer conversation lifetimes use a one-time Stripe Managed Payments checkout; there is no subscription and joining a conversation is always free. Encrypted photo sharing is an optional €3.99 one-time add-on for any conversation lifetime.

Stripe Managed Payments is the merchant of record and collects the email, payment and billing information needed to process the order and issue a receipt. Noduo receives a transaction identifier, amount and payment status through a signed webhook. It does not store the checkout email, card details or billing address.

• A device that someone else controls, or that is infected with malware.
• Screenshots, screen recording, or a person looking over your shoulder.
• Browser extensions with permission to read page content.
• The other participant keeping a copy of what you wrote or shared.
• Impersonation, deception, fraud, coercion, or other harmful conduct by another participant.
• Network-level observation of the fact that you visited this site, or a compelled request to the hosting provider for stored ciphertext and timestamps.

Nothing here is anonymous, undetectable, or unbreakable. It reduces how much is retained and how long it stays — that is all it claims.

Translation runs entirely in your browser using a built-in dictionary, so text typed into the utility is never uploaded. If a hosted translation provider is configured later, it needs an API key stored as a server-side environment variable, and that switch will be described here.

Premium payments are processed by Stripe Managed Payments and are subject to its privacy policy and payment-data retention requirements. No secret phrase or message content is sent to Stripe.

Supabase provides private storage for encrypted photo files where photo sharing is enabled. Supabase receives encrypted bytes and ordinary transfer metadata, not the decrypted photo.