Privacy Policy

Zero-Knowledge Architecture

VanishLink is designed with a zero-knowledge architecture. All content is encrypted directly in the user's browser before being sent to the server. The service has no ability to access plaintext content or decryption keys at any time.

No Collection of Personal Data

VanishLink does not collect, store, or process any personally identifiable information.

No accounts, registrations, emails, names, or other personal identifiers are required to use the service.

Data Processed by the System

The service processes only the minimum technical data required for functionality, including:

• Encrypted content (ciphertext) generated by the user's browser
• Initialization Vector (IV) required for cryptographic operations
• Technical metadata such as Time-To-Live (TTL), view limits, and content type (text or file)
• File handling metadata such as size and structure

Encryption keys are never transmitted to the server and remain exclusively in the user's browser.

File Handling

VanishLink allows users to upload files under the following technical limits:

• Maximum of 8 files per content
• Maximum size of 5 MB per single file
• Maximum total size of 5 MB per content

All files are encrypted client-side before being stored and cannot be read without the decryption key.

Data Retention and Deletion

All content is temporary and is automatically deleted under the following conditions:

• After first view, if self-destruction is enabled
• When the configured Time-To-Live (TTL) expires
• When the maximum number of views is reached
• After 15 days of inactivity for unlimited-view content
• When manually deleted through system-generated control links (if available)

Once deleted, data is permanently removed and cannot be recovered.

Security Measures

VanishLink implements multiple security mechanisms, including:

• AES-GCM 256-bit client-side encryption
• Zero-knowledge architecture
• Strict input validation (TTL, file limits, view limits)
• Protection against repeated unauthorized access attempts
• Temporary account/IP blocking after repeated failed attempts
• Secure password hashing when password protection is enabled
• Automatic cleanup of expired or invalid data

Hosting and Infrastructure

VanishLink is hosted on third-party infrastructure provided by render.com.

The hosting provider may process technical server-level data required for system operation (such as standard logs and connectivity information). However, it does not have access to encrypted content or decryption keys.

No tracking, profiling, or advertising systems are used by VanishLink.

International Availability

The service is designed for global use and may be accessed from different jurisdictions, including the European Union.

Technical data processing is performed in compliance with applicable data protection principles, including GDPR requirements when accessed from the EU.

All user content remains fully encrypted on the client side and is never accessible in readable form by the service or any third party.

Legal Compliance

VanishLink is designed according to principles of data minimization, security by design, and privacy by default.

Because content is encrypted on the client side and no personally identifiable information is collected, the service operator has no technical capability to access or retrieve user content in readable form.

Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in our practices, applicable laws, or other factors. We encourage users to review this policy periodically to stay informed about how we protect their information.

Contact

For any questions regarding this Privacy Policy: darkconnectspt@proton.me