Know what you’re trusting.

Content is encrypted on your device

Your browser generates the access password and encrypts your note and recipient context before upload. File contents, filenames and recipient context are encrypted too; approximate file length remains observable. Securanote does not send that password or the content-encryption key to the server.

The server stores encrypted content, its owner, access settings, timestamps, counters and a separate verifier used to authorize a release. Account details and operational metadata are not hidden by note encryption.

The access password is shown once

Save the generated password when you create a share. Your dashboard can copy the link and stop sharing, but cannot retrieve the password or decrypt the note. Resetting your account password will not recover a share password.

Send the link and password through separate trusted channels. Anyone holding both can request access while the share is available.

A view means a release of encrypted content

Opening a link does not consume a view. Submitting the correct password requests one release. The server enforces expiry, scheduled availability and remaining releases together. Requests are not automatically retried.

A lost response or decryption failure can still consume a release. A recipient can save content they receive, take screenshots or decrypt a saved copy again. Limits and deletion cannot recall those copies.

Deletion has boundaries

Stopping sharing removes the active encrypted payload and prevents future access. Expired shares are denied even before the scheduled cleanup processes them.

Metadata for shares you’ve stopped sharing becomes eligible for removal after 24 hours; scheduled cleanup can take longer. Earlier encrypted versions can remain in point-in-time recovery and seven-day backups. Cleanup failures can delay physical removal; we do not promise immediate erasure from every system.

The browser is part of the trust model

Web encryption relies on the code delivered to your browser and the security of your device. A compromised device, malicious extension or malicious application update could capture content or passwords.

Encryption is one part of protecting your information. Use a trusted device and keep a suitable backup of important information.

Account and service data

Your account uses Firebase Authentication. The service processes account identity, session and security cookies, share metadata and request-budget records to operate and protect sharing. Note content and access passwords are not put in browser local storage or session storage by the application.

Encrypted PDF/image sharing is available. Objects use separate private storage; deletion retries can be delayed, and any storage recovery retention still applies. Optional recipient notifications contain neither the access link nor its password. Access notifications record an encrypted-content release, not proof that a person read it.

For questions or to report a security concern, contact support@securanote.com. Do not include a real note, access password or account password in your report.