Privacy policy

Last updated: 12 October 2026

Who we are

Encode Group Ltd operates Vaporised and is the data controller. We host the service through EncodeDotHost, a brand of Encode Group Ltd.

Encode Group Ltd
The Mansley Business Centre
Timothy Bridge Road
Stratford-upon-Avon
Warwickshire
CV37 9NQ

• Company number: 07159623
• ICO registration reference: ZA426898
• Email: support@encode.host

Summary

• We do not ask for your name, email address, or an account.
• We set no cookies and use no analytics.
• We send no data to third parties.
• Your browser encrypts each secret before it sends it. We cannot decrypt it.
• We delete each secret permanently. We keep no archives.

The data that we process

Secrets

When you save a secret, your browser encrypts it with AES-256-GCM before it sends anything to us. The encryption key is the part of the share link after #. Browsers never send that part to a server. We store only the encrypted data, and we cannot decrypt it.

If you add a passphrase, the passphrase is part of the encryption key in your browser. The server also keeps a one-way Argon2id hash of the passphrase, to count incorrect attempts. We do not store the passphrase.

The database does not store the share link or the delete link. It stores only a one-way hash of each link. We do not record who saved a secret or who read it.

We delete a secret at the first of these events:

• The recipient uses the last view.
• The sender uses the delete link.
• A person types too many incorrect passphrases.
• The time limit ends. The secret becomes unavailable immediately, and our database removes it within 5 minutes.

The maximum time limit is 7 days.

Rate limits

To prevent misuse, we count the requests from each IP address. We do not store the IP address. We store only a keyed hash of it, which we cannot reverse. We delete each count within 5 minutes after its 1-hour window ends.

Browser check

Before it saves a secret, your browser solves a short calculation. We store a hash of each solved calculation to prevent reuse, and we delete it after 10 minutes. This data does not identify you.

Web server logs

Our web server records each request in an access log. The log includes your IP address, the date and time, the requested address, and your browser's user agent (the browser name, version, and operating system). The requested address can include the path of a share link or a delete link, but never the encryption key, because browsers do not send the part after #. We keep these logs for 3 months, then delete them. A path in the log does not give access to a secret after that secret is deleted.

Why we process this data

Our lawful basis is legitimate interests under UK GDPR Article 6(1)(f). We process the data to operate the service, keep it secure, and prevent misuse.

Do not use Vaporised for personal data that you have no right to share. The sender is responsible for the content of each secret.

Cookies and storage

Vaporised sets no cookies and does not use browser storage. The site loads no content from other websites.

Your rights

Under UK GDPR, you have the right to access, correct, or erase your personal data, to restrict or object to its processing, and to complain. To use these rights, email support@encode.host.

We do not record who saved or read a secret. Thus, we usually cannot find a secret or a log entry that relates to you unless you give us information, for example your IP address and the time of your request.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

Changes to this policy

If we change this policy, we update this page and the date at the top.