Privacy policy
The service is built so that the interesting data never reaches us. This page says exactly what does.
This notice explains what personal data notekill.com processes, why, and for how long, as required by Article 13 GDPR. It is short because the list is short.
Who we are
The controller is TUDOR A. ILIE-ALEXANDRU ÎNTREPRINDERE INDIVIDUALĂ, a Romanian sole trader. Full identification details, including the registered office and registration numbers, are on the legal page.
The short version
The service is designed so that the interesting data never reaches us. Notes, files and chat messages are encrypted in your browser before upload, and the decryption key travels in a part of the link that browsers never send to servers. The only personal data we retain server-side is a keyed hash of your IP address, kept for under an hour, plus error-log entries when a request fails. Your IP address is necessarily seen while your request is served, as it is by any web server; it is simply never written down. There are no accounts, no cookies for anyone using the service, and no analytics.
Your encrypted content
Notes, files (including filenames) and chat messages are encrypted in your browser before upload; we store only ciphertext and cannot read it. To the extent that ciphertext or its metadata (creation time, size, expiry, view counter) constitutes personal data, we process it solely to provide the service you requested (Article 6(1)(b) GDPR) and delete it on reading or expiry.
The decryption key is generated in your browser and placed in the URL fragment, the part of the link after the # symbol. Browsers never transmit fragments in HTTP requests, so the key cannot reach our server and cannot appear in server logs, proxy logs or Referer headers.
Deletion does not wait for a visitor: a scheduled job removes expired items every minute.
Abuse prevention and rate limiting
To keep the service usable, we rate-limit requests. For this we store an HMAC-SHA256 of your IP address, keyed with a server-side secret and truncated. The raw IP address is never written to the database, and the hashes are deleted when its hour-long window closes, so it lives at most an hour plus the minute until the next sweep. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in preventing abuse. The Article 21 right to object applies.
Server logs
Access logging is disabled by configuration for this site, so no access logs exist. There is no record of who created or read which note. The web server's error log may record an IP address when a request fails; those entries are used to diagnose failures and are rotated out after 30 days. Legal basis: Article 6(1)(f) GDPR, legitimate interest.
Cookies and local storage
Using this service sets no cookie of any kind. Exactly one cookie exists anywhere on this domain and it is not for you: the operator's settings page at /admin sets a session cookie, scoped to that path so a browser never sends it with any other request. It holds nothing but a random session identifier. Nobody writing a note, sending a file or joining a chat receives it. There are no analytics, no third-party scripts and no fonts from a CDN; a page load fetches only first-party files. Browser storage is used in three narrow places, all first-party and all listed here. Chat uses three sessionStorage entries per room: the display name you typed, a random token your browser mints so it can tell your own messages apart in the transcript, and a second random token used for the participant list. Both die with the tab. The verification page at /verify uses one localStorage entry, and only if you press the button that saves a baseline; it holds hashes of our own code and a date, never anything about you, and the page offers a control to erase it. The name itself reaches the server only inside the encrypted messages, so the server cannot tell who is talking.
This storage holds information you provided and is strictly necessary for the chat feature you request, so it falls under the exemption in Article 5(3) of the ePrivacy Directive. No consent banner is required, and none is shown.
Who is in a chat room
While a conversation is open, each participant's browser sends a heartbeat carrying a random identifier it chose for itself and the display name it typed, encrypted under the room key. This lets the people in the room see who else is there. It also means we can count how many participants a room has, and that is the extent of it: the names are ciphertext to us, the identifiers are random and meaningless outside the room, and every row is deleted when the room is — normally within six minutes of the last person leaving. Legal basis: Article 6(1)(b) GDPR, providing the feature you asked for.
Hosting and international transfers
The service is hosted on infrastructure provided by a hosting company acting as our processor under a data processing agreement. The servers are located within the European Union, and the data described on this page is not transferred outside the EU or the EEA.
We do not publish the specific provider, region or software we use. That is an operational detail rather than something the law requires us to disclose, and naming it would help an attacker more than it would help you. What matters for your rights is stated above: what is processed, on what basis, for how long, and where it is held.
Your rights
We hold no names, no accounts, no email addresses and no readable content, so we cannot look anyone up. Under Article 11(2) GDPR, where a controller cannot identify the data subject, the rights of access, rectification, erasure, restriction and portability apply only if you provide additional information that identifies your data — in practice, the specific link or identifier concerned.
The design gives you more direct equivalents:
- ERASURE Opening a one-view note destroys it. Anyone holding the link can trigger that destruction, and it is enforced server-side inside a database transaction.
- CHAT A chat room and all its messages are deleted once nobody has it open any more, normally within five minutes.
- RATE LIMIT The keyed hash of your IP address is deleted when its hour-long window closes - at most an hour, plus the minute until the next sweep.
You have the right to object to processing based on legitimate interest (Article 21 GDPR) and the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro).
Security measures
Content is encrypted in the browser with AES-256-GCM through the native Web Crypto API; keys are 256-bit values generated in your browser and never reach the server. Encrypted file bytes are stored outside the web root. The site sends a strict Content-Security-Policy, HSTS and related headers. One limit belongs here rather than only behind a link: the encryption code itself is delivered by our server, so this protection rests on the code we serve being the code we say it is. That is why the hashes of every file we serve are published at /integrity.json and can be checked independently. The full design, including this limit, is described on the security page.
Changes to this policy
Any change will be published on this page. We cannot notify users individually, because we hold no contact details.
Contact
Questions about this policy: contact@notekill.com.