Privacy policy
What CredShare knows about you, and for how long
In short
- No accounts, no email addresses, no tracking, no cookies.
- Your secret is encrypted in your browser before it is sent, and the server stores only the encrypted form. The key is never stored: it is sent once, by the recipient, at the moment of unlocking, and is used in memory only.
- The encrypted secret is deleted the moment it is unlocked, after 5 wrong keys, or within minutes of expiring, 48 hours after it was created.
- We keep a salted hash of your IP address for about 24 hours, only to limit how many secrets one connection can share.
- Everything is hosted in Norway. Nothing is shared with, or sold to, anyone.
Who is responsible
CredShare is a privately run, open-source service. The person who maintains the CredShare project on GitHub operates this instance and is the data controller for the processing described here. The service runs on privately hosted servers located in Norway and is governed by Norwegian law, including the Personal Data Act and the EU General Data Protection Regulation (GDPR).
CredShare is sponsored by ArktIQ IT AS. The sponsor does not host the service, does not operate the servers and has no access to any stored secret or other data.
Questions about privacy, or requests concerning your data, can be raised by opening a ticket in the GitHub repository. Please do not include personal details, secrets or keys in a ticket, since tickets are public.
What we process
The secret you share
Before anything leaves your browser, the secret is encrypted with AES-256-GCM using a key derived from the passphrase you choose (PBKDF2 with SHA-256, 100 000 iterations, a random salt and a random nonce). Only the ciphertext, salt and nonce are sent to and stored on the server. The passphrase is not sent when you create the link, and it is never stored, so nobody who obtains the stored data can read the secret without it. If you use the API instead of this page, encryption is up to your client; the helper script in the repository does it the same way.
The ciphertext is stored until it is unlocked once, until 5 wrong keys have been tried, or until it expires, 48 hours after it was created. Unlocking deletes it immediately. Expired entries are removed by a background job that runs every 5 minutes, so a secret that has expired is gone within minutes, though it may still be unlockable until that job runs. A secret can hold up to 262 000 characters.
Unlocking is the one moment the server handles the key. The recipient sends it, the server derives the same encryption key, decrypts the ciphertext in memory, returns the plaintext and deletes the stored entry, all within that single request. Neither the key nor the plaintext is written to disk or to any log.
Traffic between your browser and this site is encrypted (HTTPS). The unlock link contains a random code that cannot be guessed. Anyone who has both the link and the key can read the secret, so send them through different channels.
A hash of your IP address
To stop a single connection from flooding the service, we count shared secrets per IP address. We never store the address itself. Instead we store a salted SHA-256 hash of it, together with a counter and a timestamp. The salt is a random secret that exists only on this server, which means the hash cannot be reversed by simply trying every possible address. The record is deleted about 24 hours after your last share. It is not linked to any secret.
Technical server logs
Like every web server, ours writes an access log line for each request: the requesting IP address, the time, the request method and path, the response status, the referring page if your browser sends one, and the browser's identification string. Unlock codes are removed from the logged path before the line is written, so a log entry cannot be tied to a particular secret. Keys and secrets are sent in request bodies, which are never logged. The logs are kept for security and abuse prevention only and are not combined with any other data.
Nothing else
There are no user accounts, and we never ask for your name or email address.
Fonts and all other assets are served from our own server. The one exception is our visit counter, anonymised web analytics loaded from plausible.remim.com. It uses no cookies, stores nothing in your browser, does not record your IP address in a form that can identify you, and cannot follow you to other sites. It tells us how many people use CredShare and which pages they view, nothing about who they are. See the cookie policy.
Why we are allowed to do this
Storing your encrypted secret is necessary to provide the service you asked for (GDPR article 6(1)(b)). Counting shares per hashed address, keeping server logs and measuring anonymised usage is our legitimate interest in keeping a free service available and secure (article 6(1)(f)). We process nothing beyond that.
Who receives your data
Nobody. We do not share, sell or transfer any data to third parties, including the sponsor, and no data leaves Norway. The only exception is a legal obligation, such as a valid order from a Norwegian court, in which case we could hand over only what we still hold at that moment: at most an encrypted blob we cannot read.
How long we keep things
| Data | Kept until |
|---|---|
| Encrypted secret (ciphertext, salt, nonce) | The moment it is unlocked, after 5 wrong keys, or within minutes of expiring, 48 hours after creation |
| Your key and the plaintext | Never stored. The server holds them in memory only while the recipient's unlock request is processed |
| Salted hash of your IP address, share counter | About 24 hours after your last share |
| Server access logs (without unlock codes) | Kept for security and abuse prevention |
| Theme preference | Only in your own browser, until you clear it (see the cookie policy) |
Your rights
Under the GDPR you have the right to access, correct, delete and restrict the processing of your personal data, and to object to it. Because we hold no identity and only a salted hash of an address, we are normally unable to tell which data, if any, belongs to you. You can delete a secret yourself at any time by unlocking it, or simply by letting the link expire. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet.
Changes
If this policy changes, the new version is published here with a new date. The service is open source, so you can also verify what it does rather than take our word for it.