Privacy and zero-knowledge security
How SecretLink handles account information, encrypted payloads, message metadata, and browser-generated decryption keys.
Last updated: August 23, 2026
1. Browser-Based Encryption
Message plaintext is encrypted locally before it reaches SecretLink. Decryption keys remain in URL fragments that browsers do not send to servers.
2. Information We Process
SecretLink processes account details required for authentication, encrypted message payloads, and delivery metadata such as creation time, expiration, one-time status, and view count.
3. How Information Is Used and Shared
Account and message metadata are used to provide, secure, and maintain the service. SecretLink does not sell or rent personal information, and it cannot decrypt message contents.
4. Data Retention and Deletion
Encrypted messages are retained until their configured expiration, one-time consumption, or deletion by the account owner. Users can delete individual messages or remove their SecretLink account data.
5. Security Responsibilities
Anyone with the complete link may possess the decryption key. Use password protection when appropriate, send passwords through a separate channel, and avoid sharing links in public locations.