Privacy, plainly
This is a small text utility with an optional private mode. The notes below describe what it does, and just as importantly, what it cannot do.
How a private session works
The person who creates a session gets a link and a separate secret phrase. Anyone opening the link sees the ordinary utility. The private view only appears after the phrase is verified by the server, and it disappears again after a period of inactivity.
The phrase never leaves your device. Your browser derives two keys from it: one is sent as a verification value, which the server keeps only as a slow one-way hash; the other stays in memory and encrypts message content.
What happens to messages
Message content is encrypted in your browser with AES-GCM before it is uploaded. The server stores ciphertext and a nonce. Content is never logged, never included in error reports, and never used for analytics.
Every message carries an expiry — counted either from when it was sent or from when it was read. Expired messages are deleted from the database by a scheduled job and are also removed whenever the conversation is loaded. Decrypted text is held only in memory, so closing or reloading the page discards it and requires entering the phrase again.
Rate limiting
Phrase attempts are limited per client and per session, with a growing delay after repeated misses. Incorrect attempts look exactly like ordinary use of the utility, and unknown links behave identically to real ones.
What this cannot protect you from
- A device that someone else controls, or that is infected with malware.
- Screenshots, screen recording, or a person looking over your shoulder.
- Browser extensions with permission to read page content.
- The other participant keeping a copy of what you wrote.
- Network-level observation of the fact that you visited this site, or a compelled request to the hosting provider for stored ciphertext and timestamps.
Nothing here is anonymous, undetectable, or unbreakable. It reduces how much is retained and how long it stays — that is all it claims.
Third-party services
Translation runs entirely in your browser using a built-in dictionary, so text typed into the utility is never uploaded. If a hosted translation provider is configured later, it needs an API key stored as a server-side environment variable, and that switch will be described here.