Privacy Policy
Last updated 26 October 2026
OnePass lets you share passwords, notes, images and files through one-time links. It is built so that we cannot read what you share. This policy explains what we do and do not collect.
What we never see
Every secret is encrypted with AES-256-GCM in your browser before it is uploaded. The decryption key is placed after the # in the link, which browsers never send to a server. We store only ciphertext and cannot decrypt it.
What we store
- Encrypted secrets. Ciphertext of the text, file and its encrypted details (name, type, size, viewing timer). It is permanently deleted when the secret is opened or when it expires (1 hour, 24 hours or 7 days), whichever comes first.
- Usage counter. A random browser ID kept in your browser’s local storage, with the number of secrets created, your plan and referral code. It is used for the free quota and referrals, and contains no personal details.
- Account details (optional). If you create an account or sign in with Google or Microsoft, we receive your email address and basic profile (name and picture) from that provider. We use it only to sign you in and show your account. We never receive your Google or Microsoft password and do not access your mail, contacts or files.
- Secret history (signed-in senders). When you are signed in, we keep a history of the secrets you send: when it was sent and expires, whether it was opened, its type and size, and the recipient name or email you choose to note. It never includes the secret, the link or the key. You can delete any entry or your whole history from your dashboard.
- Where a secret was opened (only if the sender turns it on). A sender can ask to see where a secret is opened. The person opening it is told before they reveal it and chooses how. They can share their device location (their browser asks for permission), and we store it rounded to about 100 m with the area name. Or they can share only an approximate city worked out from their network address. We never store the IP address.
- Geofenced secrets. A sender can lock a secret to a place and radius. To open it, the viewer’s browser shares its location once so we can check it is inside the area (with a 5% margin). If the sender didn’t also ask to see where it was opened, that location is used only for the check and is not stored.
- Profile photo. Your account picture comes from Google or Microsoft. If there isn’t one, we look up a Gravatar image using a one-way hash of your email.
- Email delivery (optional). If you choose to email a link, we pass the recipient’s address and the link to our email provider solely to deliver that message.
How we use it
Only to run OnePass: storing and deleting secrets, enforcing quotas, signing you in and delivering emails you request. We do not sell data, show ads, or use your data for profiling.
Service providers
OnePass is hosted on Vercel, and stores encrypted data and accounts with Supabase. Emails you send through OnePass are delivered by our email provider. These providers process data only on our behalf.
Cookies
We use only the cookies and local storage needed to keep you signed in and to count your free secrets. There are no advertising or tracking cookies.
Your choices
You can delete a secret by opening it, or let it expire. You can clear your browser storage to reset the usage counter. To delete your account and its details, email us at the address below.
Children
OnePass is not intended for children under 13.
Changes
If we change this policy we will update the date above.
Contact
Questions or deletion requests: pulkit.verma@foxnetglobal.com