Service Status
Checking…
Loading…
Scheduled maintenance
Incidents
Fetching status…
Privacy notices
Stripe's cookies now listed
16 Oct 2026
The Plans pages loaded Stripe's payment script as they opened, so Stripe set two fraud-prevention cookies before anyone chose to pay. The script now loads only once you start a payment, and both cookies are listed on the privacy page.
How it works
Technical: AES-256-GCM · RFC 3986 fragment
✓ Encrypted in your browser
Your file is encrypted before it leaves your device. The key lives only in the
share link — we never see it, and neither does anyone who handles the transfer in transit.
Technical: Cashu NUT-00 blind signatures · NUT-07 double-spend ledger
✓ Transfers can't be linked to you
No account. No email. Uploads are authorised by an anonymous credential —
the server grants access without learning who you are.
Technical: BLAKE3 WASM · server-side chunk verification
✓ Files arrive intact
Each chunk is hashed before upload and verified by the server on receipt.
Any corruption or tampering in transit is caught and rejected automatically.
Technical: SHA-256 password hash · NUT-11 Mode 1
✓ Optional password lock
You can protect a share link with a password. Only a hash of the password is stored.
When the recipient unlocks, the password is sent over an encrypted connection, checked, and not kept.
Technical: Cloudflare R2 lifecycle rules · 92-day hard cap
✓ Expired files can't be downloaded
Every transfer has an expiry. When it passes, the link stops working at once.
The encrypted data is then cleared by Cloudflare's storage layer no later than 92 days after upload.
Technical: rate limiting · UUID-bound credentials · Turnstile
✓ Abuse prevention
Each upload credential is cryptographically bound to a single transfer.
Rate limits and bot detection prevent the service being used as a relay for bulk abuse.