Privacy Policy

Enigma Notes is a toy for swapping coded notes with friends. There are no accounts, and nothing at all that identifies you is collected. Your note, the coded text and the settings are worked out only on your device and never reach our server.

Just for fun. For real secrets, use a messenger like Signal.

What the link holds

The settings card and the coded text sit after the # in a share link. Browsers do not send the part after # to any server, so we cannot see your note. Anyone who holds the link can decode it, though, and the link may stay in a chat app or an address bar history. Whatever app you send it through follows its own policy.

What stays in this browser

Notes and settings are not saved anywhere. A refresh clears them. We do not use cookies.

What we never send

• Your note, the coded text and the settings card, in any form.
• IP addresses and device information (User-Agent) are not read, and no cookies are used.
• No notifications are sent, and permission for them is never requested.
• Connections leaving this site are blocked at the browser level, so even code that tried to send something could not.

This site is served through Cloudflare, which automatically injects a visit-tracking script into our pages. We did not add it, so we have configured your browser to refuse it. That means the tracking call does not go out. The tag itself is still injected by that layer though, so we would rather you know about it than not. We do not use cookies.

Anonymous signals the server receives

• Step names (page opened, a note was written, the link was copied or shared, a link was opened, a link was decoded, the alphabet was switched, first touch on the page), the interface language, the channel label we wrote into our own link or the domain of the previous page (never the path or query), and the date you arrived (day only, no clock time).
• Notes and coded text are not included. Only the fact that the step happened is counted.
• If something breaks on screen, that fact reaches the same place: we send only the error name (TypeError, for example) and an eight-character fingerprint of where it happened. We never send the error message, the stack, or the address. At most three per visit.
• These signals live in short-term server logs only and are never shared with third parties. We may show Google AdSense ads to cover running costs; Google may then use cookies or ad identifiers under its own policy.

How to delete

We keep nothing of yours, so there is nothing to delete. There is no record on the server to delete.

Business registration details and a contact address will be posted here once registration is complete.