Frequently Asked Questions

A One-Time Link is a temporary way to transfer sensitive text without placing the value directly in long-lived email or chat history.

1. You enter the secret.
2. The application creates a unique URL and stores the secret in encrypted form.
3. You send the URL to the intended recipient.
4. After a successful retrieval, the active secret record is deleted and the same URL can no longer reveal it.

We use HTTPS for data in transit and server-side encryption for secrets stored in the database.

The application server holds the key required to decrypt a secret when the intended recipient retrieves it, so the service is not zero-knowledge or end-to-end encrypted. After a successful retrieval, the active secret record is deleted. Unused secrets are removed after expiration.

If you suspect you sent the link to the wrong person, you should click the link yourself immediately.

Since the link is "one-time use," opening it yourself will destroy the message. When the unintended recipient tries to click the link later, they will only see a "404 Not Found" or "Message does not exist" error.

No user-facing recovery function is provided.

After a secret is successfully retrieved, the application deletes the active record from the secrets table. The original one-time URL can no longer be used to retrieve it. OneTime Link is designed for temporary transfer rather than permanent storage.

A link remains active until one of two things happens:

• It is viewed: The moment someone clicks the link, it is deleted instantly.
• Time expires: If no one clicks the link within the set timeframe you have chosen (e.g., 7 days), the system automatically deletes it to ensure security.

Email and team chat are designed to preserve conversation history. If a password or token is pasted directly into those systems, it may remain in mailboxes, chat history, notifications, exports, or backups.

A one-time link separates the sensitive value from the ordinary conversation and removes the active secret record after successful retrieval. This can reduce the number and lifetime of copies, although it does not eliminate every possible trace or endpoint risk.

PGP and other end-to-end encryption methods can provide a stronger cryptographic trust model when both parties are able to manage keys correctly. OneTime Link focuses on a simpler temporary-transfer workflow rather than replacing PGP.

The recipient does not need special software or a pre-exchanged public key. The tradeoff is that OneTime Link uses server-side encryption and the application server must decrypt the secret for delivery. Use the method that matches the sensitivity of the data and your threat model.

Yes. While our system deletes the digital message immediately after viewing, we cannot control what the recipient does with their device locally.

A recipient could take a screenshot, take a photo with another phone, or copy-paste the text. Therefore, only send sensitive information to people you trust to handle it responsibly.

No. The link URL might appear in your history, but the content of the message will not.

Furthermore, once the link is clicked, that URL becomes "dead." Anyone trying to visit that URL from your browser history later will only see an error page indicating the message is gone.

We separate secret processing from public-site analytics.

• Secret records: The application does not intentionally store an IP address inside the secret record itself.
• Secret-view pages: Google Analytics and Google AdSense are not loaded on one-time secret-view pages, regardless of the visitor's saved cookie preference.
• Public content pages: Optional Google Analytics and Google AdSense services may be loaded only after consent on eligible pages. Those providers may process standard technical and advertising data under their own policies.

Do not open a link if you do not trust the sender or the context.

The service must not be used for phishing, malware distribution, credential theft, fraud, or other illegal activity. If a link appears suspicious, ignore it and report the surrounding message through the communication platform that delivered it. A one-time link does not itself prove who created or sent it.

Yes. Secret content is stored in encrypted form while it is waiting to be retrieved or expire.

The encryption is performed by the application server, which also holds the key needed to decrypt the secret for delivery. This protects stored database content but is not zero-knowledge or end-to-end encryption. After successful retrieval, the active secret record is deleted.