Privacy policy

There's no sign-up, no login, no user profile of any kind. We don't run analytics, ad trackers, or session tracking on this site or in the app. Nothing you do here is tied to an identity we hold.

Every note is AES-256-GCM ciphertext in storage, never plaintext. In the default mode the server generates the encryption key, hands it to you exactly once in the share link, and never stores it — we could not decrypt your note after that point even if compelled to. In true end-to-end mode the key is generated in your browser and we never see it at all. Either way, a note is deleted the instant its view/time limit is reached — there's no backup, no trash, no retention window.

Any HTTP request — from a browser, the CLI, or curl — carries a User-Agent header and comes from an IP address. That's just how the internet works; we can't make your client stop sending them, and no service can. What we do with them is the part that's actually our choice:

• User-Agent — never read, never logged, never stored. Our application code doesn't look at it.
• IP address — used only in two narrow, automated ways: checked in real time against a note's optional "Allowed IP" restriction if you set one (never stored — just compared and discarded), and briefly kept (up to about an hour) purely to rate-limit abuse, i.e. stop spam and password-guessing. That record is never linked to any note's content, never inspected by a person, never analyzed, and is automatically deleted by a cleanup job — not sold, not shared, not kept.

Our hosting provider's infrastructure may keep its own short-lived operational logs (standard for any hosted service, outside the application's control) — that's not something Whisper itself collects, stores, or has access to.

Whisper Decrypt (the browser extension) decrypts a note locally, in its own popup, using your browser's built-in Web Crypto — the same guarantees as above apply, plus a few specific to how an extension works:

• No analytics, no telemetry. The extension doesn't call home to us or anyone else. The only network request it ever makes is the one you trigger — fetching the ciphertext of the specific note you asked it to open.
• The key never leaves your device. It's used only locally to decrypt — the request to fetch a note's ciphertext contains its ID and nothing else. The one exception: a true end-to-end note's optional password is verified by the server itself (it holds no key to check a password-derived value against), so that password specifically is sent — the encryption key never is, in either mode.
• Permissions are scoped, not blanket. It requests access to api.whisper.beer specifically (granted once, at install) so reading a note doesn't prompt every time — not access to every site you visit. It has no content scripts and doesn't read or modify any page. A self-hosted whisper-backend instance gets its own one-time, per-origin prompt when you point the extension at it.

The decrypt code ships inside the reviewed, signed extension package itself — it's never fetched from a server at the moment you use it, so there's nothing to swap out from under you. Source is public: github.com/incatswetrust/whisper-extension.