ViewOnceSecretPrivacy Policy
We built ViewOnceSecret so we literally cannot see your secrets. This page explains exactly what we do and don't collect, in plain language.
Overview
ViewOnceSecret is a zero-knowledge service. Your secrets are encrypted in your browser before they reach our servers. We cannot read them — ever.
This Privacy Policy describes how Gradiolex ("we," "our," or "us") collects, uses, and protects information when you use ViewOnceSecret at viewoncesecret.vercel.app.
By using the service you agree to the practices described here. If you disagree, please do not use the service.
Information We Collect
What we never collect: We do not collect your name, email address, phone number, or any account information. No registration is required.
Encrypted payloads: When you create a secret link, your browser encrypts the content locally using AES-256-GCM. Only the ciphertext is sent to and stored on our servers. The decryption key lives in the link fragment — it never touches our servers.
Server logs: Like any web service, our servers automatically record standard request data including:
- IP address of the requester
- Timestamp of the request
- HTTP method and path (never the secret content)
- Browser user-agent string
These logs exist solely for abuse prevention and are not linked to any identity.
How We Use Your Information
We use the minimal data we collect only to:
- Operate the service — store encrypted payloads temporarily and deliver them to recipients.
- Prevent abuse — detect and block spam, bot traffic, and malicious use patterns using IP and rate-limiting data.
- Improve reliability — monitor service uptime and performance using aggregated, anonymised metrics.
We do not use your data for advertising, profiling, or any purpose beyond operating and securing the service.
Storage & Security
Even if our servers were fully compromised, an attacker would only obtain AES-256-GCM ciphertext — meaningless without the key that lives only in the link you shared.
Encrypted payloads are stored in an in-memory Redis store. They are automatically and permanently deleted when one of the following occurs:
- The secret is viewed for the first time (or the view limit is reached)
- The expiry timer elapses (1 hour, 1 day, 3 days, or 7 days)
- You manually delete the link
Deletion is irreversible. We have no mechanism to recover a deleted secret — not even with a legal demand. All data in transit is encrypted via TLS 1.3.
Third-Party Services
We use a minimal set of third-party infrastructure providers who process data on our behalf under data processing agreements:
- Cloud hosting provider — servers and CDN. They see only encrypted ciphertext and request metadata.
- DNS provider — resolves our domain. Sees only your IP address, not any secret content.
We do not sell, rent, or trade your information with any third party for commercial purposes.
Data Retention
Secret payloads are retained only until viewed, expired, or deleted — after which they are gone permanently.
Server logs (IP, timestamp, path) are retained for a maximum of 30 days, then automatically purged. We do not maintain any long-term database of user activity.
Your Rights
Because we collect no personal account information, most traditional data rights do not apply in the conventional sense. However:
- Right to deletion: You can delete a secret link at any time via the link you created. It is destroyed immediately.
- Right to know: You can verify our encryption implementation — the client-side code is open-source and auditable.
- Log deletion requests: If you believe your IP is in our 30-day server logs and you are in the EU/UK, you may contact us to request deletion within 72 hours.
If you are in the EU, you have rights under the GDPR. If you are in California, you have rights under the CCPA. Email us at inquiry@gradiolex.com for any privacy-related requests.
Children's Privacy
ViewOnceSecret is not directed at children under 13. We do not knowingly collect information from children. If you believe a child has used the service in a harmful way, please contact us and we will investigate.
Policy Changes
We will never change this policy to allow us to read your secret content. That would require a fundamental change to our architecture — and we'd tell you publicly.
We may update this policy to reflect operational changes. The "last updated" date at the top of this page will always reflect the most recent revision. Material changes will be announced on our website.
Continued use of the service after changes are posted constitutes your acceptance of the updated policy.
Contact Us
For privacy questions, data requests, or concerns about our practices, reach us at:
- Email: inquiry@gradiolex.com
- Phone: +91 90429 72156
- Company: Gradiolex
We aim to respond to all privacy requests within 5 business days.