Privacy Policy

Effective October 26, 2026

Who we are

Safe With Us (safewith.us) is operated by Dharani Holdings Inc. (“we,” “us”). Questions about this policy can be sent to hello@safewith.us.

How encryption works

When you create a link, your browser encrypts your message with AES-256 before anything is sent to us. The decryption key is placed in the part of the link after the “#”, which web browsers never send to any server. We receive only the encrypted message, so we cannot read it, and neither could anyone who gained access to our systems.

If you add a passcode, it is used on your device to strengthen the encryption. We never receive the passcode.

For requests, your browser creates a private key that stays only in your private inbox link. The question you ask and the answer you receive are both encrypted, and we can’t read either one.

To help protect people from scams, after a message, request, or reply is decrypted, the reader’s browser checks it for web links and for phrases often used in scams, and shows a “Be careful” note if it finds any. This check happens entirely on the reader’s device. Your browser downloads our public list of phrases, but nothing about the message, or whether a note was shown, is ever sent to us.

What we store

For each secret link

• The encrypted message, which we can’t read
• A random link ID
• One-way hashes (scrambled fingerprints) used to confirm a person has the correct link or tracking link, without us knowing the link itself
• The settings you chose: expiry time, how many times it can be opened, whether it has a passcode, whether it’s a note or a password, and whether it vanishes after reading
• Timestamps for when it was created, expires, and was opened, plus counts of opens and wrong passcode attempts. These power your tracking page.
• An empty, encrypted reply slot, so the person who opens it can reply privately. It works like a request (below): the key for replying is locked with the message’s own key and erased with the message, and only your tracking link can open a reply. The slot closes a day after your link expires; a reply that arrives waits up to 7 days for you to open it, then it’s erased.

If you send a file

• The file is encrypted on your device before it’s uploaded, with a key we never receive. We store the encrypted file with Cloudflare’s file storage (R2) and can’t open it.
• The file’s name and type are encrypted along with it. We only know the general kind you sent it as (for example a photo or a PDF), so we can apply the kinds of files we allow, and its size.
• When the file is opened, the recipient’s browser checks that it really is that kind of file before showing or saving it. This check happens only on their device.
• The same applies when someone answers a request with a file: it’s encrypted on their device so only the requester can open it, and we only know its general kind and size.

For each request

• The requester’s public encryption keys: a classic one and a post-quantum one (ML-KEM). Public keys can only lock things, not unlock them.
• The encrypted question, the encrypted name (if provided), and the encrypted answer, none of which we can read
• Status and timestamps, such as when it was created and answered

For abuse prevention

• To limit spam and guessing of passcodes and codes, we count actions from each network using a one-way hash of the IP address combined with a secret key and the date, so the same network can’t be linked from one day to the next. We never store raw IP addresses, and these counts are deleted within 2 days.
• If you use “Report this link,” we store the link ID, an optional reason, the time, and whether we shut the link down or dismissed the report. We don’t store who made the report. Reports are deleted within 90 days.
• When you create a link or request, we save a one-way fingerprint of your network with it: your IP address (for IPv6, your network’s prefix) scrambled together with a secret key. It can’t be turned back into an address, and it’s deleted along with the link, at most 7 days after the link expires. If a link is reported for abuse, we may block the network that created it from creating new links for 1, 7, or 30 days. That fingerprint stays on our block list only until the block ends.
• Cloudflare tells us which country each visit comes from, and we use it only to apply any limits we’ve set for a country. We don’t store it, apart from daily totals of how many attempts those limits stopped in each country.

If you turn on email updates

• Email updates are optional. If you turn them on, we store your email address and which updates you chose (your tracking link, when it’s opened, if it expires unread, or wrong passcode alerts; for requests, when the reply arrives).
• Your address is deleted as soon as it’s no longer needed: after the last email about that link, when the link ends for any reason, or when you click “Stop these emails.” It’s never used for anything else, never added to a list, and never shared.
• Emails never include your message. If you ask for your tracking link, we email it once, right away, and don’t keep it. Anyone with that link can see the status and destroy the message, but can’t read it. For requests, we never email your inbox link, because it’s the only key to the reply.
• To prevent abuse, each address gets a limited number of emails per day. Emails are sent through Cloudflare.

If you lock a link to someone’s email

• “Only for this email” is optional. If you turn it on, we store the email address you enter with the link, so we can email that person a 6-digit code when they try to open it. Please only enter the address of the person you’re sending it to.
• The address is deleted when the link has been opened as many times as allowed, when it’s destroyed or locked after too many wrong tries, and within an hour after it expires. It’s never used for anything else, never added to a list, and never shared.
• Each code works once, for 10 minutes. We store only a scrambled version of the current code, which can’t be turned back into the code, and delete it once it’s used or the link ends.
• The page that opens the link shows only a hint of the address, such as j•••@example.com. Code emails never include the message or the link. Up to 5 codes can be sent per link, and each address gets a limited number of emails per day.

If you send feedback

• We store the kind of feedback you chose (idea, problem, praise, or other), your message, and the time. We don’t ask for or store your name, email address, IP address, or any link, and we remove anything that looks like a link key. Feedback is deleted within 180 days. Because it’s anonymous, we can’t reply; email hello@safewith.us if you’d like an answer.
• When our staff review a reported link, we keep an internal record of the action (such as looking up or shutting down a link by its ID), which staff member did it, and when. These records contain no message contents and are deleted after 1 year.

Aggregate usage counts

• To understand how the service is used and spot abuse early, we keep daily totals, such as how many links were created or opened that day, how many used a passcode or each expiry option, and how many times our rate limits were reached. These are plain counts. They contain no link IDs, IP addresses, message contents, or anything that could identify a person or a link, and we keep them indefinitely. We publish a few of these totals, such as how many links have been created and how many reports we’ve handled, on our Transparency page.

What we don’t collect

• Message contents, file contents or file names, passcodes, or decryption keys
• Names or phone numbers, and no email address unless you turn on email updates or lock a link to someone’s email (there are no accounts)
• Cookies or advertising identifiers
• Analytics or tracking scripts of any kind (our daily totals are counted on our server and never identify anyone)

Stored only on your device

If “Remember links on this device” is turned on (it is by default), the tracking and inbox links you create are saved in your browser’s local storage so you can find them later under My links. Your appearance choice (system, light, or dark) is saved the same way, and so are a note that you closed a site announcement, your password generator settings, and, if you turned on email updates, your email address so you don’t have to type it again. A note that you’ve already seen the opening animation is kept only until you close the tab. This information stays on your device and is never sent to us. Message contents are never saved.

Anyone who uses your device could open saved links. You can remove individual links, clear them all, or turn this off at any time in My links.

How long we keep data

• An encrypted message is permanently deleted from our database the moment it reaches its final open, is destroyed by the sender, is locked after 3 wrong passcodes, or expires. Expiry options are 10 minutes, 1 hour, 1 day, or 7 days for messages, and 1 hour, 1 day, or 7 days for requests.
• An encrypted file is permanently deleted as soon as its final download finishes. If a download is interrupted, we keep it for up to 10 minutes so it can be retried, then delete it. Files are also deleted when the sender destroys the link, after 3 wrong passcodes, or when the link expires, and uploads that never finished are deleted within about 2 hours. As a safety net, our file storage automatically deletes anything older than 8 days.
• Our database provider (Cloudflare) automatically keeps a recovery history of the database for up to 30 days, which we would only use to recover from a serious failure. A deleted message can remain in that history until it ages out, but only in its encrypted form. The key was never sent to us, so no one, including us, can read it.
• An answered request stays available for its requester to open for up to 7 days, then is deleted. If the answer is a file, the encrypted file is deleted as soon as the requester’s download finishes (or up to 10 minutes after they open it, if the download is interrupted), when the request ends, or within about 2 hours if the upload never finishes.
• The remaining record (timestamps and counts, with no message) is kept for up to 7 days after a link’s expiry time so tracking pages keep working, then deleted.
• Daily usage totals contain no personal information and are kept indefinitely. Internal records of staff actions are deleted after 1 year. Feedback is deleted within 180 days. Email addresses for updates are deleted when their link ends, at the latest. An address entered for “Only for this email” is deleted when the link is fully opened or ends, and within an hour after it expires. Network blocks end after at most 30 days and are then deleted.
• An automatic cleanup process runs every hour.

Service providers

Safe With Us runs on Cloudflare, which hosts the website, runs our servers, stores the encrypted data, and protects the site from attacks. Like any network provider, Cloudflare processes technical information such as IP addresses to deliver and secure traffic, under its own privacy policy. We have turned off application request logging on our side.

Emails sent to hello@safewith.us are forwarded by Cloudflare to our inbox. If you email us, we’ll see your email address and message so we can reply.

How we use information

We use the limited information above only to deliver links, enforce one-time opens and expiry, show senders their tracking status, prevent abuse, respond to reports, and keep the service secure. We do not sell personal information, use it for advertising, or share it with anyone except as described here.

Legal requests

We may disclose information if required by valid legal process. Because of how Safe With Us is built, we can only ever provide what we have: encrypted data we cannot decrypt, and the limited records described above. Messages that have been opened or have expired no longer exist in our database, and any copy left in the recovery history described above is encrypted with a key we never had.

Security

Beyond end-to-end encryption, we enforce one-time opens and passcode limits on our servers, use strict browser security protections, and keep data for as short a time as possible. No system is perfectly secure, so we encourage you to use a passcode for sensitive information and share it through a different channel than the link. To report a security issue, contact hello@safewith.us.

Keep in mind that anyone who has a full link (and passcode, if set) can open it. Your own device and the apps you use to share links also affect your privacy.

Your choices and rights

Because we don’t collect names, accounts, or contact details, we generally can’t identify which data belongs to you. You can delete an unopened message at any time using its tracking link, and you can cancel a request from your inbox link. Depending on where you live, you may have rights to access or delete personal information. Contact us at hello@safewith.us and we’ll help however we can.

Age requirement

Safe With Us is intended only for people 18 and older. It is not directed to children, and we do not knowingly collect information from anyone under 18.

International use

Safe With Us is operated from the United States and runs on Cloudflare’s global network, so encrypted data may be processed in data centers in different countries.

Changes to this policy

If we update this policy, we’ll change the effective date at the top. If a change materially affects how we handle data, we’ll make it clear on the site.

Contact

Dharani Holdings Inc.
hello@safewith.us