PrivacyLast updated October 23, 2026

Privacy policy.

secretshare is built so that we hold as little as possible about you, and nothing readable about your secrets. This policy explains what that leaves.

Who is responsible

KIORA SARL, 58 avenue des Bergères, 92800 Puteaux, France (RCS Nanterre 850 361 999), is the data controller. Contact: contact@secretshare.co.

Your secrets

Secrets, files and requests are encrypted in your browser before they reach us. We store the encrypted data, which we cannot decrypt, together with technical data needed to run the service: a random identifier, hashes used to check access, the Argon2id salt when a passphrase is used, the size, the creation and expiry dates, and the times the secret was opened. The security page lists each item.

The encrypted data is deleted when the secret is read for the last allowed time, when its sender burns it, or at the latest at its expiry date. The remaining record is deleted at the expiry date. The longest possible lifetime is 30 days.

No account, no cookies

There is no account and no sign-in. The site sets no cookies and uses no local storage for tracking.

IP addresses and logs

Our web servers keep no access logs. To stop abuse, the number of requests from an IP address is counted for up to ten minutes. The counter is stored under a keyed hash of the address, never the address itself, and expires on its own. Error logs may record the identifier of a link involved in an error, never its key.

Visit statistics

We count visits with Plausible Analytics, hosted on our own servers. No script is loaded from another site: your browser tells our server which kind of page was viewed (for example "a secret page", never which secret), the site you came from (its domain only) and any campaign tags (utm_) in the address. Our server forwards that, with your browser's user agent and IP address, to our Plausible instance, which turns them into a daily anonymous count and does not store the IP address. No cookie is used.

Hosting and transfers

The service runs on servers operated by Kiora in France. Your data is not transferred outside the European Union, and we do not sell or share it.

Legal basis and your rights

We process this data to provide the service you ask for (GDPR, Article 6(1)(b)) and, for abuse limits and statistics, on our legitimate interest in keeping the service available and improving it (Article 6(1)(f)). Since we don't know who you are, we usually can't link data to you; if you think we hold personal data about you, write to us and we will answer within one month. You can also complain to the CNIL (cnil.fr).

Changes

If this policy changes, the date at the top changes too.