For twenty years, a tool on the web started with the same request: upload your file. A contract, a scan of a passport, a recording of a meeting went to a stranger's computer so it could do something your own computer could have done. We build tools that don't ask for that.
Your device is enough
The phone or laptop you are reading this on is fast. A browser can now run compiled code through WebAssembly, use the graphics card through WebGPU, and read a file you choose without sending it anywhere. That is enough to merge a PDF, compress a video, transcribe an interview or run a language model.
So that is where our tools do their work: in the tab, on the device the file is already on. It is not a setting you have to find. It is how the tools are built. A file we never receive is a file we can't lose, leak, sell, train a model on, or be ordered to hand over.
Some jobs need a second place
Sending a file from your laptop to your phone. Sharing a document with a colleague by link. These jobs involve two devices by definition, and two devices on different networks need something in between to find each other.
We used to say that nothing ever leaves your device. When Send and share links in the Markdown editor arrived, that stopped being true for those two features. A promise that is false on one page is worth nothing on the others, so we changed the promise. Here is the one we keep instead.
When our server helps, it holds only what it can't read
Every feature that uses our server follows five rules.
- Encrypted before it leaves. Your browser encrypts the data with a key it makes itself, before anything is sent.
- The key never reaches us. It travels in the part of the link after the
#. Browsers don't send that part to any server, and our page counter doesn't either. - Kept no longer than the job. Send's connection details: two minutes after the last message, ten minutes at most. A share link: as long as you choose, 30 days at most, or until the first time it is opened. Then it is deleted.
- Said before, not after. A tool that uses our server says so on its own page and in the status bar at the bottom of the screen, and the share dialog says where the document goes before you create the link. A tool that sends nothing says that.
- Nothing we don't need. No account, no name, no email address. A share link is stored as the encrypted document and nothing about who made it. Send stores nothing at all.
What encryption doesn't hide
We would rather you hear the limits from us.
- Our server sees that a transfer or a share happened, when, roughly how large it was (share links are padded to a few fixed sizes), and the IP address it came from while the connection is open.
- On a direct Send connection, the two devices see each other's IP addresses. That is how a direct connection works.
- Cloudflare, the network in front of this site, carries every request. It sees addresses and which pages are asked for, but not the part of a link after the
#. - The code that encrypts comes from our server. A server that wanted to cheat could send different code; that is true of every web app that encrypts in the browser. Send shows the same six-digit safety code on both screens: if they match, nobody in between swapped the keys, us included.
Everything that leaves, listed
The privacy page lists every connection this site makes, tool by tool: what goes where, how long it stays and who can see it. When we add a feature that sends anything, it goes on that list before it goes live. And every page hands your browser the same list as a rule, so a connection to anywhere else is refused, not just undocumented.
What we won't do
- Ask you to make an account to use a tool.
- Put ad networks or tracking cookies on this site. A banner you may see at the top is one we write ourselves, and it loads nothing from anyone else. Our page counter counts visits, not people, and never sees what you put in a tool.
- Use your files for anything. We don't have them.
- Charge for the tools you use today.
When we get it wrong
We will, sometimes. In October 2026 we found that our page counter received full page addresses, including the part after the # where share keys live. We changed it so it receives the page path and nothing after it. When a promise and the code disagree, we fix one of them and tell you which. This page is where we do that.