Privacy

The short version

• Notes, secrets, files, requests, chat messages and synced notepads are encrypted in your browser before upload. The server stores ciphertext. It never receives your plaintext, your key, or your password.
• Alongside the ciphertext it keeps what it needs to do its job: a hash it can check before handing the ciphertext out, the expiry time, read or download counts, and file sizes.
• A few extras keep a little more, and only when they're used: a push address if you ask to be told when a link is opened, what you write in an abuse report, a 10-minute lock on a link after too many wrong passwords, and a daily count of links created.
• No accounts, no email sign-up, no ads. The app itself sets no cookies.
• Our hosts see IP addresses and request details, like any website: the web app's host for page loads, and Cloudflare, which runs the API your browser calls. The contact form stores what you type into it.
• One exception to encrypting on your device: the remote Claude connector encrypts what you give it on our server, in memory, and stores and logs none of it. The website and the local MCP server encrypt on your device.

What the server stores

Keys travel in the part of the link after #, which browsers do not send to servers. When you choose a password instead, you send it to the other person yourself. Either way, the server only ever gets a hash derived from it.

The notepad in local mode and the free tools send nothing to our server. One tool sends something to someone else: the breached-password checker hashes the password with SHA-1 in your browser and sends only the first 5 of the hash's 40 characters to Have I Been Pwned (api.pwnedpasswords.com), with no cookies or referrer, and asks for a padded reply so its size doesn't give away which 5 were sent. The password and the rest of the hash stay in the tab. That page's security policy allows connections to that one extra host; every other tool makes no request at all.

Older (v1) links use a password proof (PBKDF2 with a fixed salt, then SHA-256) instead of the auth hash; they still open, and the server still never sees their password.

Receipts and manage tokens

When you create a note, secret, file drop or request, your browser makes a random manage token and saves it in My links on this device. The server keeps only a hash of that token, plus a receipt:

• the kind and id of the share, and its status (active, opened, expired or revoked)
• how many times it was read or downloaded, and the limit (a file download counts when it starts)
• when it was created, when it expires, and when it was first and last opened

Receipts never contain content, IP addresses or anything about who opened the link. Your browser sends the manage token only when you check a receipt, revoke a share, or switch read notifications on or off for it, and anyone holding it can do all of those. Revoking deletes the ciphertext straight away.

Read notifications

In My links you can ask to be told when a link is opened. Your browser sends us the link's manage token, to show the link is yours, and a push subscription. We then notify you when the link is first opened (for a secret request, when it's answered) and when a read or download uses it up. For each browser that asks, up to 5 per link, the server keeps:

• the push address your browser's push service (Google, Mozilla, Apple or Microsoft, depending on the browser) gave it
• the subscription's public key and auth secret, which encrypt each message for that browser alone
• the link's kind and id, and when you turned notifications on

No content, no key, no IP address and no account. Each notification goes from our server to that push service, which delivers it to your browser. The message is encrypted so only your browser can read it: the link's kind and id, what happened and when, padded to a fixed size. The push service also gets how long to hold it if your device is offline (up to one day) and a signed token that identifies our server. So it learns that a message was sent to your browser, and when, but not what it says. The label you see in the notification comes from this browser, not from us.

A subscription is deleted right after the notification for the last read or download, when the link is revoked or taken down, when the push service tells us the subscription no longer exists, or by the cleanup job once the link expires. Switching notifications off in My links deletes it for every browser watching that link.

Abuse reports

Pages that open a note, EnvShare secret, file drop or request have a Report abuse link. A report stores:

• the kind and id of the link, which the form takes from the page, never from the address bar
• the reason you choose (phishing, malware, illegal content, spam or something else)
• details, if you write any (up to 500 characters), and an email address, if you give one
• when it was sent

A report can't carry a link's key: the form won't send text that contains one (#k=… or #p=…), and the server refuses it too. Your IP address isn't stored with it. Reports are deleted after 180 days. If email forwarding is set up, each report is also emailed to our inbox through Resend, an email delivery service, so Resend handles that email: the link's kind and id, the reason, your details and your email address.

We can't read the reported content either, so we go on what the report says. When we take a link down, its ciphertext and any file chunks are deleted, its receipt is marked revoked so the sender's My links shows it, and any notifications for it end.

Rate limits, locks and usage counts

To slow floods and password guessing, the API counts requests with Cloudflare's rate limiter. Most counts are per link, room or request: wrong keys or passwords, people joining and posting in a chat room, answers sent to a request, reports about a link. Creating a note, secret, file drop, request or notepad, sending a report and sending a contact message are also counted per IP address (an IPv6 address counts by its /64 block). That address is used only for this one-minute count inside Cloudflare. We don't write it to our database.

After more than 10 wrong keys or passwords in a minute, a note or EnvShare secret that has a password (older v1 links included), a chat room or a synced notepad is locked for 10 minutes. While it's locked, even the right password is refused. The lock is stored as the item's kind and id (for a notepad, the hash of its username) and the time it ends, and nothing about who tried. The cleanup job deletes it once it has run out.

Each time a link is created, the server adds one to a counter for that day and kind (notes, EnvShare secrets, file drops, requests, chat rooms). The counters hold no ids, no content and nothing about who created what, and they're deleted after 400 days. The last 30 days' totals are public through the API, and the homepage shows the overall number once it reaches 250.

So that file drops stop at their storage limits instead of running up a bill, the server also keeps the total size of the file-drop chunks it holds and a count of storage reads and writes for each day. These hold no ids, no content and nothing about who sent or downloaded what. The daily counts are deleted after 90 days.

Claude and other MCP clients

ProtectedShare's tools also work from Claude and other MCP clients, through a remote connector or a local server (setup). Both create the same links as the website, and our storage keeps exactly what it keeps for the website, as listed above. There's no account, sign-in or cookie.

• Remote connector (mcp.protectedshare.me/mcp). The text you hand a tool travels over TLS to our MCP server, a Cloudflare Worker, and sits in its memory only while it's encrypted. Remote links use a key only, never a password. To create a link, the Worker passes our storage only ciphertext and hashes, Worker to Worker. To check or revoke one, it sends the link's kind and id with the manage token itself, not a hash of it, just as My links does. It stores nothing and never logs tool arguments, results or request bodies; Cloudflare's logs hold each request's method, path, status and timing. Cloudflare's rate limiter counts requests per connecting IP address (an IPv6 address by its /64 block): 600 a minute in all, and 120 calls a minute to the tools that create links. The address isn't stored. Each request carries one message; batches are refused. Our web host isn't in this path.
• Local server (npx protectedshare-mcp). It encrypts and decrypts on your computer and sends our API what the website sends: ciphertext and hashes to create a link, the link's id and a derived token to open one, and the link's kind, id and manage token to check or revoke it. Never the text, a link key, a password or a private key. Like any API call, it reaches our web host and Cloudflare with your IP address and a protectedshare-mcp/<version> user agent. It writes nothing to disk. Its breach check sends only the first 5 characters of a SHA-1 hash to Have I Been Pwned, from your computer.

Link keys, request key pairs and manage tokens are made where the tool runs and returned in the tool's result. Nothing else keeps them, so these links don't appear in My links. That result is part of your conversation, so your MCP client and its AI provider (Anthropic, for Claude) see the links with their keys, along with whatever you asked it to share and any text the local server opens. Their own terms cover that conversation.

How long things last

Every read checks the expiry first, so an expired share can't be opened even before it's cleaned up. A scheduled job runs every 30 minutes and deletes expired rows.

Notes and secrets

Deleted on the read that uses up the limit (burn after reading, or the last of 1–100 reads), or at expiry. Expiry is at most 30 days.

File drops

Deleted, chunks in R2 included, once the last allowed download finishes (or its 60-minute download session expires), when revoked or taken down, or at expiry. Uploads that never finish are deleted after 6 hours. The cleanup job also removes any stored chunk whose drop is gone.

Download sessions

Deleted when the download finishes, or 60 minutes after it started (sooner if the drop expires first).

Secret requests

Deleted when you collect the reply in your inbox, or at expiry.

Chat

Messages are deleted once nobody is left in the room (on the room's next request, or by the 30-minute job), when their disappearing timer runs out, or when someone burns the room. A presence entry is removed when you leave; otherwise it stops counting about 15 seconds after its last heartbeat and is deleted the same way. A room's auth record is forgotten after 7 idle days.

Receipts

Kept until 30 days after the share's expiry, so My links can still show what happened.

Read notifications

Deleted after the notification for the last read or download, on revoke or takedown, when the push service says the subscription is gone, or once the link expires.

Locks

Deleted once the 10-minute lock has run out.

Abuse reports

Deleted 180 days after they're sent.

Usage counts

Deleted after 400 days.

Synced notepads

Kept until you delete the vault. They don't expire on their own. An open tab's check-in is deleted on the next check-in by anyone once it's 30 seconds old.

Contact messages

Kept until we delete them. Ask and we will.

Deleted means removed from our database and file storage. We don't control copies the recipient makes, and links you sent stay in whatever chat or inbox you sent them through.

Hosting and logs

The API runs on Cloudflare Workers with a Cloudflare D1 database, and encrypted file-drop chunks are kept in Cloudflare R2 storage. The remote MCP connector is a separate Cloudflare Worker at mcp.protectedshare.me, reached directly rather than through our web host. Like any host, Cloudflare sees IP addresses and request details such as the path, time, user agent and response status. Workers observability logs are enabled, so requests and errors are recorded in Cloudflare's logs for a limited period.

Your browser calls the API on Cloudflare directly, at api.protectedshare.me. The host that serves the web app sees the same kind of request information for page loads. We don't write IP addresses into our database. Request paths include share ids, never the key after the #.

A few features involve one more service: Resend delivers contact-form messages and abuse reports to our inbox, your browser's push service delivers read notifications, and the breached-password checker asks Have I Been Pwned directly from your browser. Analytics, if it's on, is covered next.

Analytics and cookies

ProtectedShare's code sets no cookies. There are no ads and no ad scripts.

Google Analytics loads only when the site is built with a measurement id. It is off for this build of the site. When it's on, your browser loads a script from Google, Google sets its own analytics cookies, and Google receives page views along with your IP address and device details. It never loads on pages that open or hold a share (note, EnvShare and file links, requests and their inboxes, chat, My links, the notepad, and anything shared to the installed app), and if it loaded earlier in your visit it's switched off while one of them is open. The page views it gets carry the page path only, never the query string or the part after #. It never receives share content or keys.

Cloudflare Web Analytics loads only when the site is built with a Cloudflare beacon token. It is off for this build of the site. When it's on, your browser loads Cloudflare's beacon script, which sets no cookies and uses no browser storage. On each full page load it sends Cloudflare the page's address and the page you came from, both without the query string or the part after #, along with page-load timings and your browser's name and version. Like any request, it reaches Cloudflare with your IP address. It doesn't count moves between pages inside the app, and it follows the same rule as Google Analytics on the pages listed above, so it never receives share content or keys either.

What your browser keeps

Some things are saved in your browser's storage on this device. Most never reach us. The exceptions are tokens, which your browser sends only when you use them, as noted below.

• Theme. Light or dark, if you picked one.
• My links. The full links you created (including their keys), manage tokens, a short label and expiry. A manage token is sent to us only when you check that link's status, revoke it, or switch its notifications on or off; the links and keys are never sent. Anyone using this browser profile can open them. Clear them on the My links page.
• Notepad, local mode. Your encrypted vault, with its key stored next to it. That protects it from the server, not from someone using your browser.
• Chat. Your display name and notification preferences. The current room key, a per-tab sender id and the tokens that let you delete your own messages are kept in session storage, which clears when the tab closes. A delete token is sent to us only when you delete that message.
• Read notifications. If you turn them on: a service worker (a small script your browser runs in the background, limited to addresses under /share-target/, which never stores a copy of the app's code), and, in IndexedDB (ps-notify), each watched link's kind, id, label and expiry, so a notification can show your label. Never the link, its key or its manage token. The site registers the service worker only when you turn notifications on, or when you use the installed app.
• Sharing to the installed app. If you share text or files to ProtectedShare from another app, the service worker keeps them in IndexedDB (ps-share-inbox) on this device. The page shows you what arrived and does nothing with it until you choose to continue: text is cleared as soon as the page reads it, files once File drop takes them or you discard them. If they sit there for more than 15 minutes, the page discards them unread the next time it looks. The installed app sets the worker up when you first open it; if you share before that, the share goes to our web host, which answers without reading or logging it, and the page tells you so.

The contact form

The form stores your name, email, optional company and message so we can reply. If email forwarding is set up, a copy is sent to our inbox through Resend, an email delivery service. The form is not end-to-end encrypted, so don't paste secrets into it. To have a message deleted, email admin@protectedshare.me.

What we can and can't do

• We can't read your shares, recover a lost key, or tell you what a link contains.
• Receipts and notifications record that a link was opened, and when, not who opened it.
• We can see the metadata listed above (counts, sizes, timestamps) and delete a share by its id, for example after a valid abuse report.
• If we receive a valid legal demand, the most we hold is what this page lists: ciphertext and that metadata.
• Self-hosted copies are run by whoever hosts them. This page covers protectedshare.me only.

Changes and questions

When the code changes what we store, this page changes with it and the date at the top moves. The source is public on GitHub if you want to check any of this. Questions: admin@protectedshare.me.