Our Core Security Guarantee
View Once is architected so that nobody—not third parties, not network intermediaries, and not even View Once administrators—can inspect or read your private messages.
01. Zero-Retention Architecture
At View Once, security and privacy are not afterthoughts—they are the founding premise of our system. We enforce an uncompromising zero-retention policy. Notes are stored in AES-256 encrypted ciphertext in our database and are permanently and irreversibly hard-deleted the moment they are decrypted by the recipient or reach their expiration timestamp. We never maintain server backups, logs, caches, or unencrypted archives of note content.
02. Encryption Mechanics
All transmissions and stored payloads utilize military-grade encryption primitives:
AES-256-CBC cipher with unique initialization vectors (IVs) generated per note. Decryption occurs strictly in-memory during single request lifecycle.
Derived via PBKDF2-HMAC-SHA256 with 100,000 iterations and random cryptographic salt. 3 failed attempts permanently purges the note to prevent brute-force attacks.
03. No Tracking, Cookies, or Fingerprinting
We do not set tracking cookies, load advertising telemetry, or build identity profiles. Optional read notification emails are encrypted in-memory and automatically purged the moment the notification fires or the note expires. Email addresses are never joined to message IDs or saved into relational user tables.
04. Acceptable Use Policy
You agree not to use the View Once platform to distribute malicious software, phishing payloads, spyware, or illegal materials. You are solely responsible for the links you generate and distribute. Because we do not possess decryption keys for stored notes, we cannot view or monitor transmissions, but will execute cryptographic deletion on any valid token upon request.
05. Support & Security Inquiries
For security advisories, bug disclosures, feedback, or support inquiries, contact the engineering team: