Privacy by design
CHOPPNOTE is designed to encrypt note plaintext in the sender’s browser. The backend receives only an encrypted envelope, an expiration choice, a one-way key commitment, and normal technical request metadata. The decryption key remains after the # symbol in the complete share link and is not sent to the backend.
Data processed by the service
- ephemeral encrypted note payload and IV;
- creation and expiration timestamps;
- random public retrieval token and a one-way SHA-256 key commitment used to derive the storage address;
- an HMAC-pseudonymized request address for short rate-limit windows;
- operational metadata generated by hosting and Redis providers, subject to their final configuration.
CHOPPNOTE does not require an account for the core note flow and does not intentionally collect recipient identity or message plaintext.
The commitment is derived from the random decryption key but cannot decrypt the note. The decryption key itself remains in the browser fragment and is not sent to the service.
Retention
Unread ciphertext expires after the selected server-enforced TTL: 10 minutes, 1 hour, 24 hours, or 7 days. A deliberate reveal atomically makes the ciphertext unavailable from the application. Rate-limit counters expire after 10 minutes.
Application-level deletion does not by itself prove that no provider replica, memory representation, backup, or operational artifact exists. Provider behavior must be reviewed and stated accurately before launch.
Cookies and analytics
The anonymous MVP does not require accounts or product analytics on create and reveal routes. No session replay or advertising tracker is included. Final cookie behavior must be verified against the deployed hosting configuration.
Processors and international transfers
The planned infrastructure uses Vercel-compatible hosting and an Upstash Redis-compatible ephemeral datastore. The final legal names, regions, subprocessor lists, transfer mechanisms, and data-processing agreements must be documented here after the production accounts are configured.
Your rights and contact
The responsible entity and verified privacy contact are not yet configured. These details, applicable rights, complaint route, and legal bases must be supplied by a privacy professional before launch.