Questions, short answers.

No. Your browser encrypts each file with AES-256-GCM before upload. We store ciphertext and never receive the key.

A random id, the ciphertext, a padded size, the hour it arrived, when it leaves (rounded up to the hour when that's an hour or more away), its rule and its open count, plus a few technical columns. Each link's “What we know” page prints every column, and our privacy page lists every table.

The recipient clicks Open, their browser decrypts the file, and our server deletes the ciphertext when the download finishes. Reloading shows “This secret already made its exit.” If you didn't open it, someone else did.

No. We keep no backups of files, and we never had the key.

Our host (Hostinger) can take weekly snapshots of the whole server. We haven't switched them off, and we haven't yet confirmed in its panel how long it keeps them. A file that existed when one was taken stays in it, as ciphertext, until that snapshot is rotated out.

No. Opening takes a click. But the preview service now has the full link, so use Link + password or send it to one Tari address for anything sensitive.

No. Links, passwords, once-only, views and expiry are free and need nothing. Tari™ features use tTARI, and we give demo tTARI on the testnet.

Tari is an open-source, proof-of-work privacy blockchain. The Ootle is its layer for applications, where payments are private by default and can carry sealed messages. mutis uses it to deliver keys and move money.

No. It has no monetary value. paid features stay on the testnet until our code is reviewed.

No account and no email. That's not anonymity: our server still sees your IP while you're connected. See what we can't protect you from.

Every exit goes on the public record: we add it to SealLog on the Ootle at the next checkpoint. It proves we said we deleted it, publicly and permanently. It can't prove we kept no copy.

Your locker is gone for good. Nobody can reset it. That's the price of nobody being able to take it.

Your safety code is 12 emoji (96 bits) from your locker's public keys. Compare all 12 with the person, out loud or on a call. For a plain Tari address, compare the first and last 6 characters instead.

Arrivals and amounts. It can't spend, and it can't open files locked to your locker. The exception: a sender can choose “The recipient uses another Ootle wallet”, and those files do open with the view key. Share it only with someone allowed to see what arrives.

Anyone with your Tari address or drop link can. Deliveries never open by themselves, programs get a warning, and you can close a drop link anytime.

without a locker, with a free locker, with rented space.

The live numbers are on Pricing and limits.

It's a fair share of a real disk, recalculated hourly, not a marketing number.

We can't see inside, so we can't scan it either. Only open files you expected. Every viewer warns before saving a program, and our app won't send one without a locker. That rule lives in the app: our server can't see what kind of file it holds, so it can't enforce it.

SRI only pins files to this page; it can't protect you from us. What can: our verify-deploy script and running your own copy.

No analytics, no trackers, no third-party scripts or fonts. Your browser contacts a Tari-run indexer only when you press “Check it on Tari's indexer”. Your key and preferences live in your browser's own storage.

No. See the terms and how to report a link. We remove reported links by id, without needing to see inside.

No. It's an independent open-source project, not affiliated with, endorsed by, or sponsored by Tari Labs, the Tari Council, or the Tari project.