Small print
Privacy
The honest version of a privacy policy is usually long because there is a lot to disclose. This one is short for the opposite reason.
What gets stored on the server
One record per share, holding the encrypted payload, the time it was created, the time it expires and, for a file share, the original file name and MIME type. That is the complete list. The database rules reject any record with a different shape.
What never reaches the server
The passphrase, the plaintext, the decrypted file, and any label you give a share for your own list. Encryption and decryption both happen inside your browser.
What stays in your browser
The history of links you created is written to IndexedDB on your device, with a localStorage fallback. Your theme preference is stored the same way. Neither is transmitted, and clearing site data removes both.
Accounts and identity
There are none. Credo does not ask for an email address, does not set an identifying cookie and does not build a profile of anyone.
Analytics and advertising
There is no advertising and no behavioural tracking on this site. The hosting provider keeps standard infrastructure logs, which is the ordinary technical record any web host maintains.
Retention
Every record has an expiry between ten minutes and thirty days, defaulting to thirty. Nothing is retained beyond that ceiling. After the moment passes the database refuses to serve the record and a scheduled cleanup deletes it. Records cannot be edited after they are written.
Third parties
Encrypted records are stored in Google Firestore and the site is served from Vercel. Neither can read the contents of a share, because what they hold is ciphertext.
Children
Credo is not directed at children and collects nothing that would identify anyone, of any age.