Privacy

SuperShare is built so that the people running it cannot read what you share. This page describes exactly what that means, in plain terms.

What the server stores

• The encrypted bytes of your secret. Nobody here can decrypt them.
• A random identifier for the link.
• The size of the encrypted file and when it expires.
• Whether a passphrase was set — not the passphrase itself.
• The account that created it, and counters of how much that account has used.
• For accounts: your email address, when you signed up, and when you last signed in.

What the server never sees

• Your text, your files, or anything else you put in a secret.
• The key. It is generated in your browser and lives only in the part of the link after the #, which browsers never transmit.
• Your passphrase, if you set one.
• The filename or file type. Those are encrypted along with the contents.

How long anything lasts

A secret is destroyed the moment it is opened — the database row is deleted and the file is unlinked before a single byte is sent to the recipient. If nobody opens it, it is deleted when it expires, at most 7 days after it was created. Files up to 10 MB are accepted.

There are no backups of stored secrets. That is deliberate: a backup would be a copy of something that was supposed to be destroyed, and it would quietly break the promise this whole service is built on. Once a secret is opened or expires, it is genuinely gone, and nobody — including the administrator — can bring it back.

Logs

The server writes short operational log lines: what kind of event happened, a status code, and an internal account identifier. Logs never contain email addresses, tokens, cookies, request contents, query strings, IP addresses, or the identifiers of secrets.

Third parties

There are none, with a single exception: sign-in links and administrative notices are delivered by Resend, an email provider, which necessarily sees the recipient address and the message. Nothing about the contents of a secret is ever included in an email.

There is no analytics, no tracking, and no third-party scripts, fonts or images. The pages load nothing from anywhere but this server.

What we cannot protect you from

• Pasting a complete link — including the part after the # — somewhere that keeps a record, such as a chat log, and then sending the passphrase to the same place.
• A compromised device or browser extension belonging to you or your recipient.

Contact

Questions about this service go to info@hybric.nl.