FAQ
Questions we get
Short answers, with links to the longer explanation where one exists. If something here contradicts what the product does, the product is right and this page is a bug worth reporting.
Privacy and encryption
Can classified read my notes or files?
No. Your browser encrypts the content with AES-256-GCM before anything is uploaded, and the decryption key is never sent to us. The server holds a ciphertext blob it has no way to open. The exact parameters are published on the security page.
What can the server see?
The size of the ciphertext, when a share was created, when it expires, when it was read, and whether it is password-protected. It does not see the content, the filename, the sender or the recipient, because none of those are ever collected. Standard request metadata such as IP address and user agent is handled transiently at the Cloudflare edge for delivery and abuse prevention.
Is this really "zero-knowledge"?
In the sense the term is normally used commercially, yes: encryption happens on your device and we are not given the key. It is worth being precise, though. There is no cryptographic proof that we stored, expired or deleted anything correctly, and the JavaScript doing the encryption is served by us. Those are real limits, and they are described plainly under where the design stops.
Where does the decryption key live?
After the # in the share link. Browsers do not send that part of a URL to the server, so the key stays out of our request logs. It does travel wherever you send the link, so the channel you choose still matters.
Using it
Do I need an account?
Not for notes. Encrypted notes can be created without signing in at all. File shares do require an account with a verified email address, because file storage carries a per-plan quota that has to be attributed to someone.
How long does a share last?
You choose a lifetime between 5 minutes and 24 hours. A share ends when it is first read or when that time expires, whichever comes first. The two mechanisms are independent and both are always active.
What are the size limits?
Notes are capped at roughly 200 KB of ciphertext, which is a great deal of text. Files default to 10 MB each and the exact ceiling is set per plan. Larger transfers are outside what this tool is designed for.
What does a password add?
With a password set, the key is not in the link at all; it is wrapped so that the password is needed to unwrap it. Use it when the link and the password can travel by different routes. Note that the wrapped key is returned to anyone who fetches the share, so a weak password can be attacked offline at speed. Choose one with real entropy.
When something goes wrong
I lost the link, or forgot the password
The content is unrecoverable. We hold no key, so there is no reset path and no support request that can restore it. This is the intended behaviour rather than a gap. Treat a one-time link as a delivery mechanism, never as storage.
My recipient says the link was already used
Usually an automated first reader. Chat link previewers, corporate mail security scanners and URL sandboxes all fetch links in order to inspect them, and any of them can consume a one-time share before a person opens it. Sending through a channel that does not unfurl links helps, and so does password mode, because fetching alone reveals nothing without the password.
Is one-time reading guaranteed?
It is a strong default rather than a guarantee. Reading is a fetch followed by a delete against an eventually-consistent store, so two requests arriving at nearly the same moment can both succeed. If a second read would be a serious incident rather than an inconvenience, this is not the right tool.
The link opens but the content will not decrypt
Most often a truncated link. Some chat and email clients wrap or clip long URLs, and losing characters after the # leaves a link that finds the right record with an incomplete key. Copy the link again from the original message rather than from a forward.
Plans and ads
Why are there ads?
The free tier is designed to be ad-supported. No ads are being served at present, while our advertising setup is under review. When they do run, they will be limited to public informational pages of this kind and will never appear on the screens where you create, reveal or download a share. Paid plans exclude them entirely. In no configuration can an ad script reach your content, because decryption happens only in your browser and the readable form never exists anywhere else.
What does a paid plan change?
It removes ads and raises your monthly sharing allowance and per-file ceiling. The encryption is identical on every plan; there is no "more secure" tier, and there will not be one.
Legal and contact
Company-level policies live on the MAIN OÜ site: privacy policy, terms of service, and refund policy. For anything not answered here, the contact address is on the company home page.