Privacy, with a clear boundary.
Secret handling and public-site measurement happen in separate zones.
Secret content
The private creation page encrypts your text in your browser. The server stores a random identifier, ciphertext, IV, encryption format version, creation time and expiration time. The secret record does not contain plaintext, the decryption key, an email address, user-agent or recipient identity.
The key is part of the link fragment after #, which a browser does not include in HTTP requests. Treat the complete link as sensitive. A messaging service or person you send it to may still see the full link.
Private pages
Routes for creating, viewing and claiming secrets use only resources from OneTimeRead. They do not load Google Analytics, Google Tag Manager, Microsoft Clarity, Google AdSense, external fonts or other third-party resources. Pages and API responses use no-store caching instructions.
Retention and delivery
A successful claim deletes the secret record before returning its ciphertext. Unread secrets become unavailable at their selected expiration, no later than 7 days, and scheduled cleanup removes expired records. Logical deletion cannot guarantee removal of old ciphertext from every storage layer or backup.
Abuse prevention and request metadata
Infrastructure processes network information to deliver requests. Creation limits use a short-lived keyed identifier derived from the connection’s origin, separate from secret records. This is a limited abuse-control measure, not cross-site fingerprinting. Private request bodies and secret keys must not be recorded in application logs.
Public analytics and advertising
Public information pages use Google Analytics 4, Google Tag Manager, Microsoft Clarity and Google AdSense. Those providers can process browsing, device, cookie and interaction information according to their own policies. Clarity can support public-page heatmaps and session recordings. Advertising may be personalized where applicable settings and consent allow.
These integrations are not permitted on creation, reveal, API or error pages. We do not create analytics events containing secret content, ciphertext, identifiers, keys or full secret URLs. Consent and cookie controls must meet the requirements of the location where the service is offered.
Your choices and questions
Use browser privacy settings for public-page tracking. You can use the private workspace without those third-party resources. Contact hi@valle.dev for privacy questions; never include a live secret or full secret link.