Browser Encryption and Privacy Policy

1. Browser-Based Encryption

Message and file plaintext is encrypted locally before it reaches Strumio. Decryption keys remain in URL fragments that browsers do not send to servers in normal requests.

2. Information We Process

Strumio processes account details required for authentication, encrypted message and file payloads, and delivery metadata such as creation time, expiration, one-time status, view count, and network data needed to operate and defend the service.

3. How Information Is Used and Shared

Account and message metadata are used to provide, secure, and maintain the service. Strumio does not sell or rent personal information, and its servers do not receive the browser-generated fragment keys needed to decrypt message contents.

4. Data Retention and Deletion

Encrypted messages and files are stored as ciphertext. Expiration and one-time consumption make payloads unavailable through normal delivery, but do not guarantee immediate deletion of stored ciphertext. Account owners can delete individual messages or remove their Strumio account data. Eligible recovery keys remain only in the creator's browser storage or exported recovery file.

5. Security Responsibilities

Anyone with the complete link may possess the decryption key. Use password protection when appropriate, send passwords through a separate channel, and avoid sharing links in public locations.

6. Private and Group Conversation Data

Chat messages, participant display names, room titles, and attachments are encrypted in participants' browsers. Strumio processes ciphertext plus operational room data such as participant sessions, room type, expiration, access counts, and connection status. A creator can end a room, and rooms are removed when they expire.

7. Panic Close and Dead Drop Limits

Panic Close revokes the current participant session and clears that room's local in-memory and session data; it does not close the room for others. A Dead Drop's final permitted claim locks later access and queues stored ciphertext for deletion. Neither control erases copies already downloaded, captured, or stored elsewhere.

8. QR Code Sharing

Strumio generates SecretLink and active chat invitation QR codes locally in the browser. The complete access link, including its fragment key, is encoded into the QR image without being sent to a remote QR provider. The code does not contain plaintext messages, file contents, or passwords, but anyone who scans or keeps it may gain the same access as someone holding the complete link.

For a practical explanation of invitation links, room expiration, Panic Close, and encrypted attachment limits, read the private chat and Dead Drop guide.