Law Enforcement Guidelines

If a secret row has not yet been revealed and has not expired, the Operator may still have: the public identifier; the ciphertext envelope (ciphertext, nonce, authenticated associated data, envelope version); the HMAC verifier and its key version; created and expiry timestamps. After Reveal, expiry, or purge, those fields are gone.

Separately, a hashed rate-limit bucket may exist for about one hour. It is a one-way hash over a server key, the create/reveal kind, and a platform connection address. It is not a raw IP column and is not joined to a secret row. Application privacy logs contain only a request identifier, a route template, a status, a duration, and a generic error class.

• Accounts, names, phone numbers, payment instruments, or recipient identities.
• Plaintext, AES keys, raw lookup proofs, URL fragments, or full capability links in application storage or in application logs.
• A mapping from a person to a public identifier.
• Message content after consume or purge.
• Geolocation, contacts, or device identifiers collected by the application.

The Operator is a natural person established in Romania, European Union. We respond to legally binding process that is valid under Romanian law or that is recognised in Romania (including a European Investigation Order or mutual legal assistance where required). Emergency informal emails that do not identify a still-existing public identifier usually cannot be executed against a row.

Send process to alex.jungean@gmail.com from an official mailbox. State the legal basis, the authority, the case reference, the precise public identifier if you have it, the time window, and what you are asking us to do (preserve if still present, produce the allowlist fields, or delete). Do not send victims’ plaintext or live capability links in the clear if a safer channel exists.

Default retention is 24 hours and one Reveal; the longest option is 7 days. After expiry, a purge runs within 6 hours. If a row is already gone, we cannot preserve it. If a row still exists and a lawful preservation duty applies, we will not voluntarily Reveal it. We cannot extend a row past the schema’s 7-day check without a product change.

We generally cannot notify an author because we do not have an author identity. If a law forbids notice, we will follow that law. If a law requires notice and we have a contact (for example the requesting authority named a complainant email that is also the user), we will follow that law.

The Service is free and has no subscriber billing file. We may ask an authority to use a precise identifier so we do not perform an indiscriminate search. We do not publish HMAC keys or production credentials.