Privacy policy
What cipher.ink collects, why, who else receives it and how long it stays. No accounts, no cookies, no trackers.
Effective October 26, 2026. This page says what cipher.ink collects, why, who else touches it and how long it stays. It describes what the site does today, and the code behind it is readable. For the cryptography, see the security page.
Who runs it
cipher.ink is run by B Klug. For anything about your data, write to privacy@cipher.ink. General questions go to support@cipher.ink. Email is not encrypted, so please don't put a secret in it.
The short version
- We can't read your messages. The browser seals them, and the key never reaches us.
- There are no accounts, no cookies, no analytics, no ads and no trackers.
- We never sell or rent data, to anyone.
- The few things the server does see are in the table below, each with how long it's kept.
What we collect, and for how long
| What | Why | How long |
|---|---|---|
| The sealed message (ciphertext) and any sealed attachments | So the recipient can fetch and open them | Until the message ends (read and burned, destroyed, or expired), then wiped at once |
| The mode (passphrase or secret link), the burn flag, the expiry, the number of attachments and their encrypted sizes | To run the message | With the message, and in the record kept after it ends |
| The passphrase hint, in plain text, if you write one | It's shown to the recipient on the lock screen | Until the message ends, then wiped with it |
| A SHA-256 hash of the read-receipt token | So the read-receipt page can tell it's you without the server holding the token | With the message and its end-of-life record |
| When the message was sealed and first opened, how many times it was opened, and when it ended | The read receipt, and keeping the service tidy | 90 days after the message ends. No content is kept in this record |
| Your IP address, as a salted one-way hash in hourly buckets | To limit how many messages (and contact emails) one connection can send in an hour | 2 days |
| Secret Santa: the exchange, the cards, and each person's wishlist and notes, all sealed in the browser. The server sees the number of cards and when the exchange began and expires, never a name or who drew whom | To run the exchange | Until the organizer ends it, or 30 days after the gift date, and never more than 120 days. Then deleted |
The IP address, time and page address of each request. The part after the # is never sent | The web host's standard access log, for running and securing the site | Set by the web host, not by us |
| What you type in the contact form, and a reply address if you give one | To answer you, or to remove a reported message | The site doesn't store it. It's emailed at once to B Klug and stays in that mailbox until deleted by hand |
| Email you send to support@cipher.ink or privacy@cipher.ink | To answer you | In B Klug's mailbox until deleted by hand |
| The feedback box: what you type, your mood pick, the kind of page you were on (not its address), your screen size bucket, theme, browser family, a one-way hash of your address, your country and the time | To read your feedback and filter spam | On feedback.cipher.ink until deleted by hand. No account or email is involved |
The contact form and the feedback box are the two places where what you type isn't sealed. Both say so on their faces.
Who else receives data
- DreamHost hosts the site and the database. It sees ciphertext, the data in the table above, and its own access logs. It also forwards mail sent to our two addresses.
- Cloudflare sits in front of the site. Your connection ends at Cloudflare, so it handles each request and response, including pages and ciphertext, and keeps its own logs under its privacy policy. It can't see a secret link's key, because that part of the address never leaves your browser. Its analytics beacon is switched off.
- Mailgun delivers the contact form's email to B Klug. It sees the message and the reply address and keeps delivery logs under its privacy policy.
- The feedback server at feedback.cipher.ink is run by B Klug, not by a third party. The country is looked up on that server from a local database, and no outside service gets your address.
- Stripe. Nothing on cipher.ink costs money today. If a paid plan is ever offered, Stripe processes the payment and receives your card details, email and billing country. We receive a record of the payment, not your card number.
No ad network, analytics service or data broker receives anything from this site.
Cookies and local storage
cipher.ink sets no cookies. It does keep a few things in your browser's local storage, which stay on your device and are never sent to us:
| Name | Holds |
|---|---|
ci-theme | Whether you picked paper or ink |
ci-sent | "My messages": the ids, tokens and links of messages you sealed from this browser (a secret link includes its key) and the first 48 characters of each message as a label |
ci-santa-groups, ci-santa-cards, ci-santa-opens | Secret Santa exchanges you organized, cards you chose to keep, and how many times each card was opened here |
Anyone using the same browser profile can see these, so clear "My messages" on a shared computer. The feedback box stores nothing in your browser.
Your choices
There are no accounts, so there's nothing to log into or delete. To end a message you sent, open it under "My messages" or from its read-receipt link and press Destroy it now. To have a message removed, send its address (the part up to the #) through the contact form or to privacy@cipher.ink. To see, correct or delete anything else we hold about you, such as a feedback note or an email, write to privacy@cipher.ink. We can't find a sealed message from its text, and can't open one, so tell us the address.
Children
cipher.ink is not meant for children under 13, and we do not knowingly collect their data.
Changes
If this page changes in a way that matters, we'll say so on the site, and the date at the top will change.