Text, passwords, keys, files and results are not sent to an encryption server or stored in localStorage, cookies, URLs or accounts. The tool uses a dedicated origin and Workers. The outer page receives only an allowlisted height message, not success payloads, names or cryptographic parameters.
Normal requests load page assets and may expose IP address, user agent and request metadata to the host. Hosting log retention and the formal operator/contact have not been supplied; no invented retention promise is made. The draft is noindex until those publication details are completed.
Public content pages use Google Analytics 4 to measure visits and traffic sources. Google receives standard analytics request metadata and may use analytics cookies. We send page URLs without query strings or fragments, disable Google signals and advertising personalization, and do not enable automatic form or interaction measurement. The isolated encryption workspace loads no analytics: inputs, passwords, keys, files and results are not passed to the public page or GA. Advertising, session replay and external fonts remain disabled.
Downloads are created with browser Blob URLs. Encrypted file packages hide the original filename inside encryption; restored downloads contain the filename and original bytes. Key exports are secret and must be protected. Clearing releases references and terminates active Workers, not certified secure memory erasure.