Privacy
Last updated 14 October 2026.
kihina is built so that it cannot read what you store, rather than promising not to. This page explains what that means in practice, what the server does keep, and for how long. It is written to be read, not to be impenetrable.
The short version
- Your content, filenames and file types are encrypted in your browser before they reach the server. The server stores ciphertext and a byte count, and holds no key that can read it.
- There are no request logs, no analytics, no trackers, and no third-party scripts. Nothing is sold or shared.
- Your IP address is never written down. Only a one-way fingerprint of it is kept, for a day, so abuse has a ceiling — and it cannot be turned back into your address.
- Drops expire on a timer and nothing is backed up. When a drop is gone, it is gone.
- There is no email, no profile, and no account in the usual sense — a folder is a name, a password and a container of drops.
What the server cannot see
When someone sends to your folder, their browser encrypts the message to your public key using an X25519 sealed box (AES-256-GCM). The filename and file type travel inside that encryption, not beside it. The server receives an opaque block of bytes and records only its size and the time it arrived.
Your private key — the only thing that can decrypt — is itself encrypted in your browser with a key derived from your password (PBKDF2, 600,000 rounds) before it is ever sent. The server stores that wrapped key but cannot unwrap it. We do not receive your password, and there is no password reset, because a server able to reset it would be a server able to read your drops.
What kihina stores, and why
For each folder, the server holds only what it needs to do its one job. The legal basis for each item below is the performance of the service you asked for, except the fingerprint, which rests on our legitimate interest in keeping the service available to everyone.
| What | Why | Kept |
|---|---|---|
| Folder name | To find your folder when you sign in. This is the one piece of user-chosen text stored in the clear, so avoid putting anything sensitive in it. | Until you delete the folder |
| Password verifier | A one-way hash used to check your password. It cannot be reversed to your password. | Until you delete the folder |
| Wrapped private key | Your decryption key, encrypted under your password. Unreadable to the server. | Until you delete the folder |
| Public key & send address | So senders can encrypt to you. The send address is public by design — it is in every link you share. | Until you delete the folder |
| Drops | The encrypted messages and files sent to you, plus each one’s size and arrival time. | 7 days (1 hour for a temporary folder) |
| Session cookie | To keep you signed in within a tab after you unlock a folder. | Until it expires or you sign out |
| Rate-limit fingerprint | A keyed one-way hash of your IP address — not the address itself — so one source cannot flood the service. | 24 hours |
What kihina does not do
- No request logs. The server does not record who connected, or when, or from where.
- No analytics, no trackers, no advertising, no fingerprinting scripts.
- No cookies other than the sign-in session described above.
- No third-party scripts of any kind. What the server sends your browser is its own source, unminified.
- No selling, renting or sharing of data, because there is nothing to sell and no one to share it with.
- No backups, by deliberate choice. Drops are transit, not storage.
Where your data lives
kihina runs on Microsoft Azure in Poland (the European Union). Encrypted drop contents are held in Azure Blob Storage; everything else sits in a single database on the same service. Microsoft acts as our hosting processor; it sees the same ciphertext the server does.
Your rights
Under the GDPR you have the right to access, correct, export, restrict and erase your personal data, and to object to its processing. Two honest notes about how those apply here:
- Erasure is in your hands. Signing in and deleting your folder removes it, its drops and its sessions immediately, and the deletion re-checks your password because it cannot be undone. We would rather you did not have to ask us.
- We often cannot identify you. We hold no email and no identity, only a folder name that many people might share. So for most requests we have no reliable way to connect a person to a folder without the folder’s password — which is the privacy property working as intended, not an evasion.
You also have the right to complain to a supervisory authority. If you are in the EU, that is the data-protection authority where you live or work; our lead authority is the one for the jurisdiction named below.
Children
kihina is not directed at children and does not knowingly process their data. Because it collects no identifying information, it cannot and does not verify age.
Changes
If this policy changes in a way that matters, the date at the top will change with it. There is no mailing list to notify, by design.
Who is responsible
kihina is an independent project and is the data controller for the personal data described on this page. For any privacy question or request, or to report something in a folder, email privacy@kihina.com.
This policy and our handling of your data are governed by the law of Estonia.