How private is this, really?
Cinder is zero-knowledge: your note is encrypted in your browser and the key travels only in the link's fragment, which browsers never send to a server. We store ciphertext we cannot read. But a privacy tool that oversells itself is worse than one that's honest, so here is the whole picture.
What Cinder protects
Server-side exposure
Encryption and decryption happen only in your browser. Our server stores ciphertext, an IV, and (in passphrase mode) a salt — never the key, never the plaintext.
Tampering
We use AES-256-GCM, which is authenticated. If anyone alters the stored blob, decryption fails instead of returning altered content.
A leaked stored blob
Without the key from the link fragment, the stored payload is useless. The key never reaches us.
Sending a file
One server delivery attempt
That is the exact promise, and it is narrower than "one download." Cinder allows a single atomic claim on a file. It deletes its own encrypted stored copy and confirms the copy is gone before any response byte exists — so holding the bytes is itself proof the deletion already happened.
Sender-only availability
The browser that creates a file keeps a separate status capability on that device. If that same browser revisits the link, it can ask whether the transfer is available or gone without claiming it. The recipient link does not carry this capability. Cinder returns no identity or timestamp, but repeated checks can reveal when availability changed.
A failed delivery is permanent
If the connection drops after the claim, Cinder has already deleted its copy and will not recreate it. There is no retry, no resume, and no second attempt. This is the cost of the guarantee above, and it is real: ask the sender for a new link.
The filename is encrypted too
The file name and its type are encrypted inside the same authenticated envelope as the bytes. A stored object reveals its size and nothing else — not what the file is called, not what kind of file it is. In a multi-piece transfer the name is encrypted once, into the first piece, rather than repeated in every one.
A large file arrives in pieces
Above 4 MiB, a file is split into pieces of 4 MiB or less, and each piece is a separate encrypted object with its own single delivery attempt. Nothing about the promise changes at a larger size — the same atomic claim, the same delete, the same verified absence, once per piece. The size limit exists because one server response is capped, and more responses was the honest way past it. Sending the whole file in one streamed response would have raised the ceiling by trading a guarantee we can prove for one you would have to take on trust.
One piece failing destroys the whole transfer
This is the real cost of the design and we will not soften it. Pieces are claimed in order, and each one is deleted before it is handed over. If the fifth of twelve fails, the first five are already destroyed, the file cannot be assembled, and there is no retry and no resume — a piece Cinder has deleted cannot be delivered a second time. The recipient is told the number of pieces and this exact consequence before they press anything. Any pieces not yet claimed are abandoned to the same scheduled cleanup that collects a cancelled upload.
Paying does not change what we can see
A paid transfer is encrypted the same way, stored the same way, and deleted the same way. Cinder’s account system runs on a separate API that transfer requests cannot reach: sending a file carries no account token, and the transfer API will not even accept the header one would travel in. What a large send presents is a signed permission slip that says what may be done and nothing about who is doing it. We can tell that someone entitled to send a large file did so. We cannot tell who, and we did not build the ability to find out.
What Cinder still cannot control
Copies saved by the sender, the recipient, a browser, an operating system, or another service remain outside Cinder’s control. Deleting our stored copy is the only deletion any server can honestly promise.
What Cinder can't protect
A compromised server serving bad JavaScript
This is the fundamental limit of any browser-delivered crypto. Because the same server that stores your note also ships the code that encrypts it, a compromised server could serve modified code that captures your note or key. "Zero-knowledge" holds only while the served code is honest, and no website can cryptographically prove that to you. We state this plainly rather than pretend otherwise.
Anyone who gets the link
The key lives in the link. Whoever holds the full link can read the note once. Send it over a channel you trust, and only to the person you mean.
The link leaking through intermediaries
A full link can land in browser history, browser sync, clipboard managers, or chat backups. We run no third-party analytics on note pages, but your own tools might capture the URL.
Metadata
We hide the contents of a note, not the fact that a note exists, its rough size, or its timestamps. For a file sent in pieces, we also see how many pieces there are, which is roughly the total size.
Weak passphrases
Passphrase mode stretches your passphrase with 600,000 rounds of PBKDF2, which slows guessing — but a weak passphrase is still a weak passphrase.
A compromised device
Malware, a malicious browser extension, or a shared machine can see the note the moment you decrypt it. No web app can protect against that.
A server that quietly keeps a copy
"Self-destruct" is a promise our backend keeps by deleting the note, not a law of physics. Anyone who captured the ciphertext and the link before you opened it could still decrypt it.
Accounts
Sending needs no account, and never will
Cinder Pro will add a sign-in so a purchase can be honored on more than one browser. It stores an opaque number from Apple or Google, one-way hashed, and whether you bought something — no email, no name, nothing joinable to a note or a transfer. The full account page states every stored field: what an account stores.
The short version: trust the link to a person, not the internet. Cinder removes our ability to read your note — it can't remove your responsibility to share the link carefully.