A secret worth
keeping briefly.

Encrypted at rest

Message content is stored using AES-256-GCM authenticated encryption with a fresh 96-bit nonce. New links contain a random 256-bit secret. HKDF-SHA256 derives separate lookup and encryption values from that secret. The database stores ciphertext, the nonce, a lookup value, and any expiration time. The message secret and encryption key are never stored in the database. Older links retain their original separate token and key.

Protected in transit with HTTPS

HTTPS uses TLS to encrypt traffic between your browser and the HTTPS endpoint. The hosting operator must also secure any connection between a TLS-terminating proxy and this application.

Check that this page uses HTTPS before sharing real secrets. HTTP connections do not encrypt message traffic.

What the service can access

Encryption and decryption happen on the server. The service handles your message and key in memory while creating or showing it; this is not end-to-end encryption. Anyone with the complete link can access the message according to its lifetime. The secret stays in the URL fragment (after #), outside normal page-request URLs, and is sent in the request body when showing the message. The page removes the fragment from its current browser history entry.

Retention and deletion

Unread one-time messages are automatically destroyed after 30 days. The backend enforces this deadline on access, and periodic cleanup removes retained records even without new requests. Timed messages keep their selected expiration. Creation times are stored to enforce retention.

After showing a timed message, a recipient can permanently destroy it before expiration. Future reads through the original link are then blocked. This cannot erase text already displayed or copied by other recipients.

One-time messages are deleted before the response containing the message is sent. A failed delivery can therefore lose the message. Timed messages allow repeated reads until the backend-enforced deadline. Periodic cleanup and request-time checks enforce expiration and one-time retention limits.

Deletion removes the live database record. Copies of ciphertext may remain in backups, filesystem snapshots, or storage hardware. Recipients can retain copied text or screenshots. Clearing this screen does not clear the clipboard.

Browser and logging privacy

Production access logs record client and proxy IP addresses, request methods and routes, response status and size, duration, and browser user agent. They omit message bodies, query strings, cookies, and authorization headers. Log files are size-rotated, with up to five archived files.

Successful message creations and displays are counted by IP address for administrators. IP addresses, counts, and first/latest activity times are stored separately from message content and links. Records are removed after 30 days without activity; cleanup normally runs every minute.

Creation limits use temporary keyed IP hashes and timestamps. When creation is restricted, the IP address, rejection and block counts, and first and latest restriction times are stored for administrators. These records are removed after 30 days without a new restriction; cleanup normally runs every minute.

This application uses no recipient accounts, third-party assets, or browser local/session storage. It records aggregate message lifecycle counters for the password-protected administrator panel, without message text, credentials, IP addresses, or visitor profiles. A language cookie remembers your selection for one year; an administrator-only session cookie lasts one hour. Responses request no caching and no referrer sharing. Infrastructure logs are the operator's responsibility.

Cookies and their purposes

The public message service uses the first-party chwilunia_language cookie only when you select a language: en (English) or pl (Polish). It contains no message text, links, keys, or visitor identifiers. Administrator sign-in additionally creates the essential chwilunia_admin authentication cookie; message recipients do not receive it.

Name

chwilunia_language

Created when

You manually change the language. Automatic browser-language detection does not create a cookie.

Lifetime

One year (31,536,000 seconds) from your last manual language selection. Reading a page does not renew it.

Scope and protection

First-party, host-only, Path=/, SameSite=Lax, and Secure on HTTPS. JavaScript reads the preference, so it is not HttpOnly.

Aggregate statistics without visitor tracking

The administrator can view aggregate counts of created, active, read, expired, and destroyed messages. These counters contain no message text, share credentials, IP addresses, or visitor profiles. The application does not track browsing behavior or use advertising, third-party cookies, tracking pixels, or browser local/session storage. Hosting access/security logs may contain connection metadata and must be described by the deployment operator.

Administrator session cookie

chwilunia_admin is created only after successful administrator sign-in. It contains a random authentication token; only its hash is stored on the server. It is host-only, Path=/admin, HttpOnly, SameSite=Strict, and Secure on HTTPS. It expires after one hour and is revoked on sign-out or password reset. It is required for the requested administrator session, not for creating or reading messages.

Your choice

You can create and read messages without accepting a cookie policy or enabling cookies. Selecting a language after the notice asks us to remember that choice for one year. We use this informed action for the language preference, rather than a general acceptance banner. No cookie is created simply by opening this policy.

Remove the language cookie below, or delete/block this site's cookies in your browser settings. Removing it restores automatic browser-language selection. If cookies are blocked, language switching still works on the current page. Removing the preference does not delete messages or change their links.

Remove saved language preference