Privacy

Bidadari Seal is built to know as little as possible. Here is exactly what happens to your data.

What stays in your browser

• Your secret is encrypted in your browser before anything is sent. The server never receives the plaintext.
• The decryption key travels in the part of the link after # (the URL fragment). Browsers do not automatically send the fragment to the web server.
• If you add a passphrase, it is used only in your browser and is never sent to or stored on the server.

What the server receives and stores

• The encrypted message (ciphertext) and its initialisation vector, which are unreadable without the key.
• A random public identifier, the time it was created, when it expires, and its state (active, claimed, expired or destroyed).
• A cryptographic hash of the creator's destruction credential, so only the creator can destroy the seal early.
• The plaintext is not intentionally stored on the server, and the server cannot decrypt the ciphertext.

When data is removed

• The ciphertext is destroyed when the seal is successfully opened, when you destroy it, or when it expires, whichever happens first.
• Expiry is enforced by the server and a scheduled cleanup, even if nobody opens the link.
• A small record without any secret content (identifier, state and timestamps) is kept for a limited period, 30 days by default, and then deleted.

Operational data and rate limiting

• To limit abuse, the service counts requests per client using a keyed one-way hash of the network address (HMAC) and a time window. Raw IP addresses are not stored by the application for this purpose, and the counters are deleted automatically after a short time.
• Like any web server, the hosting provider may keep standard access and error logs. The application does not write secrets, keys, passphrases or fragments to its own logs, and the fragment is not part of the request the server receives.

What we do not do

• No account, email address or name is required or collected.
• No cookies are used by the application.
• No advertising, analytics, session replay or third-party tracking is used. Pages make no requests to third-party services, and fonts and images are served from this site.
• Revealed secrets are kept only in the page while it is open. They are not written to local storage, session storage, cookies or IndexedDB.
• The creator's destruction credential is kept in this browser tab's session storage until the tab closes, so the creator can use Destroy Now. It is never part of the shared link.

Please remember

Anyone who has the complete link can attempt to open the message. Once a message has been shown on a screen, the recipient can copy or photograph it. See Security for the full picture, including limitations.