Privacy

Bidadari Note is a temporary text utility. This page says plainly what it does with your data.

Notes are temporary

Every note has an expiry chosen from 15 minutes, 1 hour, 24 hours or 7 days, counted by the server. Nothing is kept longer than 7 days from creation. Expired notes are removed from active storage by a scheduled job, and an expired note cannot be opened even before the job runs.

Encrypted in your browser

Your browser encrypts the note with AES-256-GCM before anything is sent. The encryption key is generated in your browser and lives in the part of the link after #. Browsers do not send that part to the server, and this site does not read it back or send it anywhere. The server stores only the encrypted text, a random note identifier, the hash of an edit capability, and timing and size metadata.

Because of this, we do not intentionally inspect the content of your notes, and we cannot read them or recover them if a link is lost. This is not a promise that nobody can ever read a note: anyone who has the full link can read it, and a compromised device or browser can expose it.

What the server processes

• Note record: random id, ciphertext, nonce, crypto version, hash of the edit capability, burn-after-reading flag, revision number, created, updated and expiry times.
• Abuse controls: keyed hashes derived from your network address, used for rate limits and abuse reports. They are not stored as raw addresses and rotate over time. Rate-limit rows are deleted when their window ends.
• Abuse reports: note id, reason, time and an opaque per-day reporter key. Reports never contain note text or keys and are deleted after a retention period.
• Security log: event names, note ids and opaque source keys. Note content, encryption keys and edit capabilities are never logged.

Hosting infrastructure

The hosting provider and its security software may keep standard web server, firewall and security logs (including network addresses and requested paths) according to its own configuration. Link fragments are not part of requests, so keys do not appear in those logs.

Backups

Database backups, where taken, contain only ciphertext. They may exist for a limited operational period after a note has been deleted from active storage. Expired notes are not restored into service.

On your device

The editor keeps the edit capability for a note in this browser tab's session storage so a reload does not lock you out. If you choose Remember edit access on this device, it is kept in local storage until the note expires. Note text is never written to browser storage. There are no cookies, no analytics, no advertising and no third-party scripts or fonts.

Please do not use it as a password manager

Avoid pasting passwords, recovery keys or highly sensitive information. For one-time secrets use Bidadari Seal; for files use Bidadari Drop.