Privacy policy
Updated
Private notes deserve a clear explanation of what happens to them. This policy describes the Once application and its current hosting setup.
Who runs this service
Once is maintained through the nani-samireddy/one-time-messager GitHub repository. Contact the maintainer through the repository’s issue tracker for service or privacy questions. Do not post message links, passwords, or private message content in public issues.
Messages and passwords
Your browser encrypts a message before sending it. The application database stores the encrypted letter (including any names and styling you choose), an initialization vector, a random message ID, and an expiry timestamp or a no-expiry setting. If you add a password, it also stores a hash of a derived authorization token. The application does not receive the plaintext message, password, or encryption key.
The link fragment (the part after #) carries the message ID and key material. Your browser sends the ID to the reveal endpoint when you ask to open a message; it does not send the fragment’s key material. With password protection, the browser derives the encryption key and authorization token from your password and the link material.
Retention and deletion
A successful reveal retrieves and deletes the record from the live application database in one atomic operation. Wrong or missing passwords do not consume a protected message. Unopened messages become inaccessible after the chosen expiry: 1 hour, 24 hours, or 7 days. If you choose Never expires, the encrypted letter stays available until someone opens it.
Expired encrypted records are removed when a subsequent message is created. If there is no later activity, expired records may remain in storage until cleanup. Deletion from the live application database does not guarantee immediate removal from hosting-provider backups or logs. Once cannot erase copies, screenshots, or recordings made by a recipient.
Technical data and providers
Cloudflare Workers delivers the public service and Cloudflare D1 stores encrypted records. Hosting providers may process IP addresses, request details, timestamps, and security or diagnostic logs to deliver and protect their services. The application does not deliberately log message bodies, passwords, or encryption keys.
The interface loads typefaces from Google Fonts. Loading those fonts sends ordinary connection information, such as your IP address and browser request information, to Google. If you use the separate ChatGPT Sites deployment, OpenAI also provides hosting and may require sign-in under its own terms and privacy policy.
Cookies, analytics, and AI
The Once application does not set advertising cookies, install analytics trackers, or send messages to AI models. Hosting, authentication, and security providers may use their own cookies or technical storage. Clipboard access is used only when you choose to copy a link.
Your choices and requests
You can choose not to create a message, choose a shorter expiry, and add a password shared through a separate channel. Anyone with a complete unprotected link, or a protected link and its password, can reveal it first. There is no account dashboard, password recovery, or sender-side revocation feature.
Contact the maintainer with questions about access, correction, deletion, or other rights available where you live. Include only the minimum information necessary; never post a complete message link or password publicly. Hosting providers describe their own processing and request channels in their policies.
Changes
This policy may change as the service changes. The date shown on this page identifies this version. Material changes will be described on this page.