Privacy
No account, no analytics
Publishing needs no account, and no page on this site loads an analytics script, a third-party font, or any other external origin. There is nothing to correlate a config with a person.
What a stored config record holds
Ciphertext, a nonce, a salt, the key-derivation name, digests of the edit token and burn receipt, a version number, timestamps, a read count, and an optional label — the last only if you explicitly asked for the name to be stored unencrypted.
What it cannot hold
The secret and the encryption key never leave your browser. Neither appears in any request: the secret rides in the URL fragment, which is never transmitted, and there is no field in any endpoint that could carry it.
Rate-limit records
Abuse controls count requests per client. The counter is keyed by a truncated digest of the source address mixed with a daily-rotating salt, and rows are swept with their window — enough to enforce a quota, useless as a durable visitor log.
What encryption does not hide
The size of your config, when it was published and updated, when it expires, and how often it was fetched. None of that reveals its contents, and it is stated here rather than implied away.
Deletion
Deleting a config removes the record. Expiry deletes the ciphertext and keeps a tombstone for a while, so a reader is told the config expired rather than that the link was wrong.