Privacy
SecretPacket is designed to handle as little of your data as possible.
No accounts or logins
SecretPacket does not require you to create an account, provide an email address, or log in. There are no user profiles and no stored identity of any kind.
No tracking or analytics
We do not use Google Analytics, tracking pixels, session recording, fingerprinting, or any third-party analytics service. No JavaScript from external analytics providers is ever loaded.
Messages encrypted before storage
When you create a secret, your browser encrypts the message using AES-256-GCM before sending it to our servers. Only the encrypted ciphertext is stored. We are technically unable to read your message.
The decryption key never reaches us
The decryption key is placed in the URL fragment (the part after #). Browsers never include the fragment in HTTP requests, so our servers never receive or store the key.
Links are one-time use
Once a secret is revealed, the encrypted content is immediately and permanently deleted. The link cannot be used again.
Automatic expiry
Secrets automatically expire after the time selected by the sender. Expired secrets that were never opened are deleted during routine cleanup.
Optional passwords
If a password is set, it is hashed using bcrypt before storage. The raw password is never stored. Always share the password separately from the link.
No IP address logging
We do not log the IP addresses of users who create or view secrets.
In short
- ✓No accounts required
- ✓No analytics or tracking of any kind
- ✓Messages encrypted client-side before storage
- ✓Decryption key never stored on our servers
- ✓Links are single-use and self-destruct
- ✓Passwords hashed with bcrypt, never in plaintext
- ✓No IP address logging