← Back to Secret Message

Privacy Policy

Secret Message – Encrypted Chat Phrases (Chrome extension) · Last updated on November 2026

• Your private messages are encrypted in your browser; the server stores only encrypted data it cannot read.
• No registration, no account, no personal profile.
• No analytics, no advertising, no tracking, no third-party services.
• The extension reads page content only when you use it: when you open the widget or convert a text, and while you have auto decoding turned on.
• Conversation details used to write the public phrase (topic, style, language, message history) are sent unencrypted, as explained below.
• Private messages expire in 30 days and are then removed from the server without any trace; only the public phrase remains.
• Invite links contain your settings, password included. They stay in the link and in your friend's browser and are never sent to our server, but anybody who has the link can read your messages.

1. Introduction

Secret Message turns a private message into an ordinary-looking public phrase, for example a comment under a post. Only people who know the same workspace and password can read the private message behind it. This policy explains what data the Secret Message Chrome extension and the Secret Message service at secure.fileshare.ovh handle, and why.

2. Data collection

We do not collect personal data: no names, e-mail addresses, accounts, contact lists, browsing history, location, or behavioral metrics. The extension has no analytics and sends no usage statistics. The only data that leaves your browser is what is needed to encode and decode secret messages, listed in sections 4 and 5.

3. What stays in your browser

Data	Where	Purpose
Obfuscation settings: workspace, password, owner signature, topic, style, language	Encrypted, in the browser storage (IndexedDB) of the site where you saved them	Reusing your settings on that site
Widget position, collapsed state, auto decoding on or off	Extension storage	Restoring the widget and the auto decoding setting
Message history	Memory of the open page only; never saved	Making the public phrase fit the conversation
Texts already checked by auto decoding	Memory of the open page only	Not looking the same text up twice

Settings you export are saved as a JSON file on your device, including the password in plain text; keep such files safe. The same applies to invite links (section 7).

4. What is sent to the server when you encode

When you encode a message (Encode message in the widget, or Convert into secret message), the extension sends to https://secure.fileshare.ovh:

• The encrypted message. It is compressed and encrypted in your browser before sending; the server never receives the message text or your password.
• The workspace and a password verifier, so that only requests with the same credentials can retrieve the message. The verifier is derived from the password with PBKDF2-SHA-256 (600,000 iterations, salted with the workspace); it is not the encryption key, and it is as slow to guess a password from as the encrypted message itself.
• The owner signature, if you set one.
• Conversation details, used to write a fitting public phrase: topic, style, language and the message history. These are sent unencrypted. The history may contain text from the page you answer: the caption of the post, the comment you reply to, the last message of the chat, or text you selected before opening the widget (private messages shown by auto decoding are left out). It also contains earlier public phrases. Do not put private text into the history.

The server returns the public phrase; the extension puts it into the text box or copies it to the clipboard.

5. What is sent to the server when you decode

Auto decoding is off by default and works only on Facebook, Messenger, VK, LinkedIn and Telegram Web. While you have it turned on and hold the mouse pointer over a text on these sites, the extension sends that text (as a possible public phrase) together with the workspace, the password verifier and the owner signature, if set, at most once per second. If the text is a secret message for these credentials, the server returns the encrypted message, which is decrypted in your browser. Texts are not sent while auto decoding is off.

6. What the extension reads on web pages

• When you open the widget: the text you selected on the page, and the site's address (to choose the topic).
• When you convert a text: the text in the focused text box, and the caption, comment or last chat message it answers, to add it to the message history.
• While auto decoding is on: the text under the mouse pointer on the supported sites.

The extension does not read or keep any other page content, passwords you type into websites, or your browsing history.

7. Invite links

The right-click menu item Invite a friend (copy join link) copies to your clipboard a link to the join page https://secure.fileshare.ovh/join-secret-message.html. The part of the link after # contains your obfuscation settings: the workspace, the password in plain text, the owner signature, topic, style and language. The message history is not included. Nothing is sent anywhere when the link is created.

• Browsers never send the part of a link after # to a server. When your friend opens the link, our server receives only the ordinary request for the join page, not your settings.
• The join page reads the settings in your friend's browser and, when they click Join, saves them as a JSON file on their device, then opens the extension's page in the Chrome Web Store (a Google service with its own privacy policy). Before that it removes the settings from the page address, so they do not stay in the browser history.
• Anybody who has an invite link can read your secret messages. Share it only through a private channel and never post it publicly. Messengers and e-mail services you send it through may keep a copy of it. If a link is shared by mistake, switch to a new password and send a new link.

8. Encryption and security measures

• Messages are encrypted with AES-GCM using a 256-bit key derived from your password with PBKDF2-SHA-256 (600,000 iterations, the workspace as salt), with a fresh random IV for every message. Without the password, the server or anybody else cannot decrypt them.
• Saved settings are encrypted with a non-extractable key generated in your browser.
• All requests use HTTPS. The extension loads no remote code.
• The owner signature fingerprint (the fingerprint button) is computed in your browser from browser and device characteristics and only its SHA-256 hash is used; it is sent only if you choose to use it as the owner signature.

9. Data retention

The server keeps the encrypted message, the workspace, the password verifier and the owner signature, linked to the public phrase, so that the people you share the phrase with can decode it. It cannot read the message. No accounts exist, so the stored data is not linked to your identity.

Private messages expire in 30 days. 30 days after encoding, the encrypted message and the data stored with it are removed from the server without any trace. Only the public phrase you posted remains available, as ordinary text where you posted it: it no longer decodes, and nobody, including us, can restore the private message.

The extension does not keep message histories; it forgets them when the page is closed or reloaded. Invite links are not stored by us at all (section 7).

10. Cookies and local storage

The extension sets no cookies. It uses browser storage only for the settings and widget state listed in section 3, which stay on your device.

11. Permissions

Permission	Why
activeTab, scripting	Showing the widget and converting text on the page you are on, only after you click the icon, use the menu or press a hot key
contextMenus	The right-click menu items
storage	Widget state and the auto decoding setting
Access to Facebook, Messenger, VK, LinkedIn and Telegram Web	Auto decoding on these sites; it does nothing until you turn it on

12. Third-party services

No third-party tracking, analytics, advertising or APIs are used. The extension communicates only with the Secret Message service at secure.fileshare.ovh. The join page of an invite link only links to the extension's page in the Chrome Web Store and sends it no settings.

13. Use of data

Data handled by the extension is used only to encode and decode secret messages. It is not sold, not shared with third parties, not used for advertising, and not used to determine creditworthiness or for lending purposes. Its use adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

14. Geographic location

The Secret Message service runs on servers in the European Union, and we aim to comply with the GDPR.

15. Your choices

• Turn auto decoding off with Ctrl+Shift+L or the right-click menu; it is off by default.
• Remove saved settings by clearing the site data of the site where you saved them.
• Clear the message history in the widget, or reload the page.
• Do not create invite links, or share your settings in person instead.
• Uninstall the extension at any time from chrome://extensions.

Because no personal data or accounts are stored, access, rectification and deletion requests do not apply in the usual way; contact us with any question.

16. Free service, no obligations

Secret Message is free. It is provided "as is", without warranties or guaranteed support. You are responsible for keeping your workspace, password and owner signature safe and for sharing them only with people you trust; lost passwords cannot be recovered.

17. Changes to this policy

We may update this policy; changes are published on this page with a new date.

18. Contact us

Questions about this policy: sfile4share@gmail.com.