Privacy policy
Effective October 16, 2026. ncrypted is operated by Seidl Family ("we").
The short version
With the local MCP server, CLI or SDK, secrets are encrypted on your device before they reach us. We store only ciphertext we cannot decrypt, delete it the first time it is read or when it expires, and run no analytics or ad tracking.
What we store
- Encrypted secret: ciphertext, initialization vector, salt, and whether a passphrase is required. Deleted atomically on first read, when burned, or at expiry (default 24 hours, maximum 7 days).
- Receipt metadata: a SHA-256 hash of the creator's receipt token, status (pending, read, burned), creation, expiry and read times, and whether the link was emailed. Kept until 7 days after the secret expires.
The decryption key travels in the link's #fragment, which browsers and our SDK never send to our servers. We never store keys, passphrases or plaintext.
When we briefly see more
- Email delivery: if you ask us to email a link, the recipient address, the link (which includes the key) and your optional note pass through our server to our email provider, Resend, for that one request. We don't store them; we only record that the secret was emailed. Resend processes the message under its own privacy policy.
- Hosted MCP endpoint (
https://ncrypted.ai/mcp): this optional mode encrypts and decrypts on our server, so the plaintext is processed in memory for that request. It is never written to storage or logs. Use the local server if you don't want this.
Payments
Creating a secret is paid in USDC over x402 on the Base blockchain. Payments are verified and settled by Coinbase's x402 facilitator. Your paying wallet address, the amount and the transaction are recorded publicly on the blockchain, which we don't control. We don't collect names, card details or accounts.
Technical data
Our host, Vercel, keeps standard request logs (such as IP address, time and path) under its own retention policy. We use your IP address briefly to rate-limit requests; those counters expire within minutes. We set no cookies and run no analytics or advertising.
Service providers
Vercel (hosting), Upstash (encrypted secret storage), Resend (email delivery, only when requested) and Coinbase (payment settlement). We don't sell or share data for advertising.
Children
ncrypted is not directed at people under 18.
Changes and contact
We'll post changes on this page with a new effective date. Questions or requests: github.com/Seidl-Family/ncrypted/issues.