Send to NoData · 4 channels · 1 promise

Send us anything · without us seeing the content

Every channel is end-to-end encrypted in your browser. The server is blind to content · we hold only metadata. Choose the channel that matches what you have to share.

🔒 AES-256-GCM in browser🚫 Server blind📋 Metadata-only enforcement🔥 Auto-deletes 30d

01📨

Encrypted message

Write whatever you want. The message is encrypted in your browser before send · NoData cannot read content · auto-deletes after 30 days.

·AES-256-GCM · key never leaves browser
·Anonymous · optional encrypted business card for reply
·4 categories (general · bug · security · enterprise)

For anyone · also anonymous

Open form

02🔒

Sealed file

Drag any file. We seal it in your browser with a wrap-key · pick max opens · burn timer · share the link. Public /verify-pack proves authenticity.

·PDF · DOCX · XLSX · JPG · MP4 · MP3 · JSON · code · all formats
·Burn rules (max opens · TTL · device-bind)
·Cryptographic proof of every open · public verifier

Citizen sends · org receives

Drop a file

03🛡️

Responsible security disclosure

Found a vulnerability? We thank you. Initial response within 24h · patch coordinated within 90 days · credit you in our disclosure log if you wish.

·Published CVD policy · clear scope · safe harbor
·24h response · 90-day patch window
·Active bounty for critical findings

Security researchers · ethical hackers

Report vulnerability

04📞

Talk to the founder

CISO at an organization? Need DocuSign/M365/Google integration? Partnership inquiry? Write in the Enterprise category · we respond within one business day.

·Direct from the founder · no chatbot
·One business day · plus a stable mailbox
·NDA available on request before sensitive discussion

CISOs · enterprise buyers · partnership leads

Send as Enterprise

The shared promise · across all 4 channels

We never see content. Enforcement is on metadata · not on what you wrote.

If a sender abuses the channel · we can revoke by id and block by fingerprint · without ever decrypting their content. The keys live in your browser. We hold only the ciphertext.

Cryptographic guarantee

AES-256-GCM · keys in the browser only · server cannot decrypt even if it wanted to.

Forensic capability

Browser fingerprint + IP hash + ToS signature stored per message. Spammer URL → block in seconds.

Auto-deletion

30-day TTL across all channels. No long-term content storage. Auditable in /admin/inbox.

Public verifiability

Architecture, code, and proofs are open. Anyone can verify the server-blind claim.

See proofs at /security →