Privacy Policy

Last updated: July 9, 2026

hidetext.sh is built so that we can't read what you share. This page explains exactly what that means — what the tool does and doesn't collect, and the few honest exceptions where something isn't encrypted. We'd rather tell you plainly than market ourselves as perfect.

The short version

• No accounts. No cookies. No analytics or trackers.
• Your text and files are encrypted in your browserbefore they're sent. The key lives in the link (after the #) and is never sent to our server during normal use.
• We don't store your IP address.
• A few things are, by necessity, stored in plain text — see What isn't encrypted below.

What we don't do

• No cookies. The site sets no cookies of any kind.
• No analytics or tracking.No Google Analytics, no Plausible, no Vercel Analytics — nothing. We don't count you or build a profile.
• No accounts. There's nothing to sign up for, so we hold no names, emails, or user profiles.
• No IP logging.Your IP address is never written to our database or logs. It is used only momentarily, in memory, to rate-limit the "Send to device" code so it can't be brute-forced — and then it's gone.

How your content is protected

When you create a paste or upload a file, the content is encrypted in your browser using end-to-end encryption (NaCl secretbox) before anything leaves your device. Our server only ever receives scrambled bytes.

The decryption key is placed in the part of the link after the # symbol. Browsers never send that part to any server, so during normal viewing the key stays entirely on your device and the device of whoever you share the link with. We could not decrypt your content even if we wanted to.

The QR code generator runs entirely in your browser — whatever you type into it is turned into a QR image locally and never sent to us at all.

For the full technical explanation, see How it works.

What isn't encrypted

In the interest of being honest rather than marketing-perfect, these things are stored in plain text on our server:

• File and bundle names.A file's contents are encrypted, but its filename is stored in plain text. Avoid putting sensitive information in the filename itself.
• "Send to device" links.When you send a link to another of your own devices, the full link — including the decryption key — is briefly sent to our server so the other device can pick it up with a short code. It is stored for at most 30 seconds (or until it's used, whichever comes first) and then deleted. This is the one deliberate exception to the "key never touches the server" rule, and it happens only when you actively use this feature.
• Bug report email (optional). If you choose to include your email when reporting a bug, we store it so we can reply. Leaving it blank is completely fine.

How long things are kept

Content lasts until its expiry time, or until it's opened if you enabled burn after read. Burn-after-read content is deleted once no one is actively viewing it, and a scheduled cleanup job also removes anything past its expiry. Content created with no expiry remains accessible until it is deleted.

Third parties

Your browser contacts outside services in only these cases:

• Cloudflare Turnstile — a CAPTCHA, loaded only if the person who created a paste turned on CAPTCHA protection. It distinguishes humans from bots and sets no tracking cookies.
• DuckDuckGo favicons— when a paste contains a link, your browser loads that site's small icon directly from DuckDuckGo. This happens entirely on your device; the link itself is never sent to our server.
• Voice input (optional)— the microphone button uses your browser's built-in speech recognition. Depending on your browser, audio may be processed on your device or sent to your browser vendor's speech service (for example, Google in Chrome or Apple in Safari). We never receive or store your audio — but the browser vendor may process it before the text is encrypted. If that trade-off isn't right for what you're sharing, type instead of speaking.

Our hosting, storage, and database run on Cloudflare (Pages, R2, and D1). Fonts are self-hosted at build time, so Google is never contacted when you visit — except for the voice input exception noted above, when you actively choose to use it.

Your choices

Because we don't hold accounts or identifiable data, there is usually nothing personal to request or delete. Every paste, file and file bundle comes with its own deletion link, shown once right after you create it — use that to remove your content at any time, before its expiry or before it's opened. We don't keep a copy of it, so if you lose it, email [email protected]with the share link instead and we'll remove it. Otherwise it expires or burns on its own, exactly as you set it up.

Contact

• Privacy questions: [email protected]
• Abuse or takedown requests: [email protected]

Questions about anything on this page? Email [email protected]— we'd rather explain than hide behind legalese.