privsend

Last updated: 17 July 2026 · Suomeksi

Controller

The short version

What we process

• Ciphertext. Your message — and, if you attached files, the list describing them — already encrypted by your browser into one sealed package. We cannot read it. It is destroyed the moment it is read, or when it expires.
• Encrypted files. If you attach files (up to 10, 25 MB in total), each is encrypted in your browser and stored as a separate opaque blob on our server. Against each one we hold only a random reference, its size in bytes, and a deletion deadline. We do not store the filename, the file type, or even how many files there are — those live inside the encrypted package above, so we never learn them. A name like “resignation_letter.pdf” would give away a secret without decrypting a byte of it, so we made sure we never see it.
• Minimal metadata so the service can work and your status link can answer: a random link id, a separate random status id, the encryption nonce (and a salt, if you chose a passphrase — neither is secret), whether a passphrase was set, and the created / expiry / opened timestamps. No sender identity, no recipient identity, and no IP address is ever stored against a secret.
• Your IP address, briefly and in memory only. To stop abuse we count requests per IP address for a short window. That count lives in the server's memory, is discarded automatically, is never written to disk, and is never linked to any secret.
• Abuse reports. If someone reports a link, we store the link's id and whatever reason they typed, so we can act on it. Your browser strips the decryption key before the report is sent, so a report never reveals a secret's contents to us. We do not store the reporter's IP address.

What we do not do

• We keep no web server access logs. Your visit is not recorded.
• We use no cookies and no analytics or tracking of any kind. No third-party scripts run on this site at all.
• We ask for no name, email address or phone number, from anyone.
• We do not deliver your secret or your link. You share it yourself, through a channel of your own choosing, and we never learn who the recipient is.
• We never sell or share personal data, and we do not use it for advertising or profiling.

Why (legal basis)

Storing ciphertext and its metadata is necessary to perform the service you asked for (GDPR Article 6(1)(b)). The short-lived, in-memory rate-limiting count and the handling of abuse reports rest on our legitimate interest in keeping the service secure, available, and lawful (Article 6(1)(f)).

How long we keep it

• Ciphertext: destroyed the instant a secret is read, or when it expires (you choose 1 hour, 1 day, or 7 days) — whichever comes first.
• Encrypted files: destroyed as soon as the recipient's browser confirms it has decrypted them — normally within seconds — and in every case within 30 minutes of the secret being read. Files are the one thing we keep a little longer than the secret itself, and it is deliberate: destroying a file the moment its download starts would mean a dropped connection leaves the recipient with nothing and no way to try again. If we remove a secret after an abuse report, its files go immediately, with no such window.
• Files you never sent: a file is uploaded while you are still writing, before the link exists. If you close the tab and never create the link, that encrypted file is deleted automatically within 1 hour. No link to it was ever made, so no one could have opened it.
• Metadata: deleted 7 days after the secret is read, expires, or is removed. After that, your status link stops working, because there is nothing left.
• Rate-limiting counts: minutes, in memory only.
• Abuse reports: kept while we deal with them, and then for up to 6 months after we act, so we can show that we acted on notice. After that they are deleted automatically.

Where it is

On our server in Tuusula, Finland, hosted by Hetzner Online GmbH (Germany), who act as our processor. Data stays in the European Union. Traffic to and from the site is encrypted with TLS.

Your rights

You have the right to access, correct, erase and restrict processing of your personal data, to object to it, and to data portability. We must be honest about a limitation here: because we deliberately hold no identifying information about you, we usually cannot tell which data is yours — that is the point of the design, and it means we may be unable to act on a request we cannot connect to you (GDPR Article 11). You can always destroy a secret yourself simply by opening its link, and every secret destroys itself anyway.

Write to support@zumitomi.fi with any privacy question. If you are unhappy with our answer, you may complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

Back to privsend