Security and Encryption Notice

Updated 27 October 2026

Security and encryption

Interrobang stores local projects on your chosen device. Optional online functions send selected content. Supported content payloads are encrypted using AES-256-GCM before transmission. Content keys are included in private-link fragments; owner credentials are separate. Operational metadata, such as identifiers, timestamps, link status, request information and payload sizes, is not hidden by content encryption. This is not a blanket end-to-end encryption claim or an independent security certification.

Links, devices and recovery

A full private link can grant access. Keep it, its key, your device and backups secure. Content is readable on authorised devices. Some Alpha/Beta comment caches and Beta editing drafts can persist as plaintext in browser storage. Omega recovery/drafts and Plotbox concepts use encrypted local envelopes; older plaintext copies can remain until migrated or cleared. Recipient copies, screenshots and exports cannot be remotely retrieved. Losing a needed key can make recovery impossible.

Expiry and deletion

Expiry/revocation blocks ordinary recipient retrieval, while owner-authenticated recovery can remain possible before deletion. Active records are scheduled for deletion 24 hours after expiry/revocation, subject to execution delays. A link without expiry stays active until ended. Copying Plotmail into a project does not erase it remotely; Deleted initially marks the message before a further deletion removes the active row. Provider recovery history, logs and independent local copies have separate lifetimes. Maintain independent backups.

A formal switching or exit request made while the relevant records still exist can preserve those records separately from ordinary link expiry or revocation. The owner-only switching process closes recipient access and allows export and retrieval during the transition and for at least 30 calendar days after the transition ends, subject to the applicable Data Portability and Switching Schedule. It does not extend every expired link automatically or restore deleted records. Readable exports downloaded by the owner contain decrypted content and should be stored privately.

Report a vulnerability

Contact [email protected] privately. Describe the affected version/service, impact and safe reproduction steps. Send minimal, redacted evidence. Do not send full private links, owner credentials, decryption keys or other people’s manuscripts. Test only your own data or specifically authorised test material. Stop if another person’s information appears; do not exploit, retain or disclose it. Avoid disruption, social engineering and access outside your permission. We assess reports and coordinate appropriate remediation. No bounty, response-time guarantee, general testing permission or legal immunity is promised.

For the full processing and retention information, read the Privacy Policy. Use the reporting instructions for unlawful-content or rights notices.