Privacy Policy & Terms of Service

1. The short version

• There are no accounts. We never ask for your name, email or phone number to use the Services.
• Password-protected notes are encrypted in your browser before they reach us. We cannot read them, and we cannot recover them if you lose the password.
• Files sent with Nearby Share or Secure Transfer go directly from one device to the other. They never pass through our servers, and we never store them.
• We show no ads and we do not sell or share personal data.

2. Encrypted notes (securetext.cloud)

When you save a note, we store:

• The note content. If you set a password, this is ciphertext encrypted with AES-256 on your device. Your password is never sent to us. If you make a note public without a password, its content is stored readable, and anyone with the link can view it.
• The note address (the URL path you chose), its public or private setting and the time it was last updated.
• An edit-password hash, only if you set an edit password on a public note. We store a one-way hash, not the password.
• A network identifier, only if you turn on "same network only" access. This is your public IPv4 address, or the /64 prefix of your IPv6 address. We use it only to check that later visitors are on the same network.

Notes are kept until you delete them, or until we remove them for maintenance or for breaking these terms. We do not promise to keep any note for any length of time. Keep your own backups.

3. Nearby Share and the Secure Transfer app

Nearby Share (securetext.cloud/share) and the Secure Transfer app both use the same small "signaling" server to find devices on the same network. To do this, the server briefly handles:

• Your public IP address. This groups devices that share an internet connection, so you only see devices on your own network.
• A device nickname and device type (for example "Blue Fox, phone"). Other devices on your network see these so you can pick who to send to.
• Connection setup messages (WebRTC offers, answers and network candidates). These are passed between two devices and contain no file data.

This information exists in server memory only while you are connected. When you disconnect, it is removed. We do not write it to a database.

Your files are never uploaded. File contents go directly between the two devices over an encrypted WebRTC connection (DTLS). To set up that direct connection, your device contacts a public STUN server (run by Google or Twilio), which sees your IP address. On some restricted networks, traffic may go through a TURN relay. The relay forwards encrypted data it cannot read.

Same-network caution: "Same network" means "same public IP address". On shared networks (some mobile carriers, offices, campuses, public Wi-Fi), people you don't know may appear in your device list and see your nickname. A file is only sent after the receiver accepts it, but check the device name before you send.

Secure Transfer app permissions. The app asks only for the permissions it needs to send and receive files, such as local network access, and access to files or photos you choose to send or save. Files you receive are saved on your device, and you control them. The app has no account system and does not collect your contacts or location.

4. Analytics, cookies and local storage

• Google Analytics on securetext.cloud counts visits and page views in aggregate. We do not use it to identify you, build profiles or serve ads. Google may set its own cookies; see Google's Privacy Policy.
• Cloudflare sits in front of our servers for security and performance, and handles your IP address and request data as part of that. When you create a new note, you may be asked to complete a Cloudflare Turnstile check. Passing it sets a short-lived, security-only cookie (st_pass) so you are not asked again right away.
• Local storage in your browser keeps your Nearby Share nickname and display preferences, such as the theme. This data stays on your device.
• Buy Me a Coffee. If you choose to support us, the payment is handled by Buy Me a Coffee under their own privacy policy. We do not receive your card details.

5. Security and abuse logs

To stop spam and abuse, our servers count requests per network for rate limiting, and they log when a note is created or deleted. In these logs, your network identifier is replaced by a salted hash that changes whenever the server restarts, so the logs cannot be used to follow you over time. Our web server and Cloudflare may also keep short-term access logs (IP address, time and requested URL) for security and troubleshooting.

6. Who we share data with

We do not sell, rent or trade personal data. The only parties that handle data for the Services are the infrastructure providers named above (Cloudflare, Google Analytics, public STUN/TURN servers, and our hosting provider). We will share information only if the law requires it. Even then, we cannot hand over the content of encrypted notes or any transferred file, because we never have them in a readable form.

7. Your choices and rights

• You can delete a note at any time from the note itself.
• You can block analytics cookies with your browser settings or an extension. The Services still work without them.
• You can clear your local storage to remove your saved nickname and preferences.
• Depending on where you live (for example under the GDPR or CCPA), you may have the right to access or delete data about you. Because we have no accounts, we usually cannot link any stored data to you. Contact us and we will help where we can.

8. Children

The Services are not aimed at children under 13, and we do not knowingly collect information from them.

1. Accepting these terms

By using securetext.cloud or the Secure Transfer app, you agree to these terms and to the Privacy Policy above. If you do not agree, please do not use the Services.

2. What the Services are

securetext.cloud is a free online notepad with optional browser-side encryption. Nearby Share and Secure Transfer let you send files directly between devices on the same network. All of these are free and need no account. We may change, add or remove features at any time.

3. Acceptable use

You agree not to use the Services to:

• Store, send or share illegal content, including child sexual abuse material, content that infringes someone else's copyright or other rights, or malware.
• Harass, threaten, defraud or harm other people, or send files to someone who has not agreed to receive them.
• Run phishing, spam or other abusive schemes.
• Disrupt, overload, scrape or try to break into the Services or their infrastructure, or get around rate limits and security checks.
• Create notes in bulk or with automated tools to reserve or squat note addresses.

We may remove content or block access for anyone who breaks these rules. We can only act on content we can see, such as public notes or note addresses that are reported to us.

4. Your responsibilities

• Passwords: keep them safe. We cannot reset or recover them, and without the password an encrypted note cannot be read by anyone, including us.
• Backups: do not use the Services as the only copy of anything important.
• Who you send to: check the receiving device before you send a file. You are responsible for the files you send and accept.
• Your content: you keep all rights to your notes and files. You confirm that you have the right to store or send them.

5. No warranty

The Services are provided "as is" and "as available", without warranties of any kind, whether express or implied. We do not promise that the Services will always be available, free of errors or free of data loss, or that any transfer will succeed. You use them at your own risk.

6. Limitation of liability

To the fullest extent the law allows, the operators of securetext.cloud and Secure Transfer are not liable for any indirect, incidental, special, consequential or punitive damages, including loss of data, profits or business, arising from your use of the Services or inability to use them. Our total liability for any claim is limited to the amount you paid us for the Services in the 12 months before the claim. Because the Services are free, that amount is zero.

7. App stores and third parties

If you downloaded Secure Transfer from an app store, that store's own terms also apply. The app store is not responsible for the app or for supporting it. We are not responsible for third-party services we link to or rely on.

8. Changes to this page

We may update this page from time to time. When we do, we will change the "Last updated" date at the top. If you keep using the Services after a change, you accept the updated version.