The SneakNote Security Model
Security is the entire point of SneakNote, so you deserve a straight explanation of how it works, what I can see, and what I deliberately cannot. No marketing fog, just the model.
End-to-End Encryption
Your note is encrypted in your browser before it is ever sent to the servers. The decryption key lives in the link fragment, the part of the URL after the # symbol, which browsers never transmit to the server. That means the server stores ciphertext I cannot read, and only someone with the full link can decrypt the note.
One-Time Access and Self-Destruction
A note set to self-destruct immediately is deleted the moment it is revealed, so it can only ever be read once. If you choose a timer instead, the note stays available until that timer elapses, which means it can be opened more than once in the meantime — pick Immediately after reading if one-time access is what you need. Either way, deletion is permanent: there is no archive, no trash, and no recovery path. If a note is gone, it is gone for everyone, including me.
Optional Password Protection
You can add a password that the recipient must enter before the note can be decrypted. This protects the contents even if the link is intercepted, an extra layer on top of the encryption key in the URL. I never store this password.
What I Do Not Do
- I do not store the plaintext of your notes.
- I do not require an account or collect personal profiles to send a note.
- I do not retain notes after they are read or expired.
- I do not sell your data.
What I Can Still See
Not being able to read your notes is not the same as knowing nothing about them, and it would be dishonest to imply otherwise. The server still records when a note was created, roughly how large it is, when it was opened, and the IP address that reached it. If you ask for a notification, it holds that email address too. What it never holds is the note itself, or the key to it.
What This Costs You
The decryption key lives only in the link. If the part after the # is dropped, truncated, or rewritten in transit, the note cannot be opened by anyone, including me. There is no reset and no recovery, because there is nothing on the server to recover from. That is the direct price of the guarantee above, and it is worth knowing before you rely on it.
Responsible Disclosure
No system is perfect, and I welcome scrutiny. If you believe you have found a security issue, please report it so I can address it quickly. You can review the broader privacy commitments in the Privacy Policy.
Want the Plain-Language Version?
For a less technical walkthrough, see how end-to-end encryption works and whether SneakNote is safe.