Privacy

Encryption happens entirely in your browser. The plaintext of your files, the decryption key, and even the file names never leave your device in readable form - we only ever receive an opaque encrypted envelope. We cannot read your secrets, and we cannot recover them if you lose the key. That's the point.

The decryption key travels on a separate channel from the link. Holding only the link, or only our stored data, reveals nothing.

To provide the service, we store:

• Account. If you sign up, your identity is handled by Clerk - typically your email and the profile from your sign-in provider (GitHub or Google). We reference your account by its Clerk user id.
• Shares. The encrypted envelope (opaque to us) plus metadata: the cipher, byte size, file count, time-to-live, one-time flag, the owner, and - only if you enable it - the email a recipient must sign in as.
• Access logs. Each attempt to fetch a share is recorded (see below).

So you can monitor and revoke your shares, every fetch of a share's ciphertext is logged with:

• Time. When the access happened.
• IP address. The full IP of the requester.
• Approximate location. City / country / coordinates, derived from the IP by Cloudflare.
• Account. If the person fetching is signed in to Pock, their account; otherwise it's recorded as anonymous.
• Outcome. Whether it succeeded, was denied, expired, or revoked.

These logs are visible to the share's owner (and platform admins) as an audit trail. We surface a notice to recipients that access is logged.

• Time-limited. Every share has a TTL. An automated job deletes expired shares - ciphertext and their access logs - hourly.
• Revocation. Revoking a share destroys its ciphertext immediately. The metadata + log are kept (marked revoked) until the TTL sweep, so you retain the audit trail briefly.
• Burn-after-read. Optionally, a share's ciphertext is destroyed the moment it's first downloaded.

We don't sell your data or use it for advertising. We rely on a small set of infrastructure providers:

• Cloudflare. Hosting (Workers), encrypted storage (R2), database (D1), and the geo/IP data on access logs.
• Clerk. Authentication and account management.

Session cookies (set by Clerk) are used to keep you signed in. We don't use third-party tracking or advertising cookies.

You can revoke any share at any time from Shares, which destroys its ciphertext. For account data and deletion requests, or any privacy question, reach us at admin@pock.sh.