Privacy notice

Last updated 10/10/2026

Who we are

Secure Exchange is run by Drotta, a trading name of BRNB Limited, registered in England and Wales, company number 15041952, registered office Mansion House, Manchester Road, Altrincham, Cheshire, England, WA14 4RW. BRNB Limited is the controller of the personal data described here. You can contact us at hello@drotta.com.

What we store

• Secrets. Only an encrypted copy, which we can't decrypt, with the technical details needed to open it and two hashes. We never receive the text, the phrase or the key. A secret is deleted when it's opened, destroyed after five wrong phrases, deleted by its sender, removed after a report, or when it expires, at most 7 days after it was shared.
• Status records. Once a secret is gone, a record of what happened to it and when, kept until a week after its expiry date.
• Reports. If you report a link: the reason, any note you add, and the link's ID. Kept for 90 days.

We don't ask for your name or email address, there are no accounts, and we don't set cookies or use analytics. Anything you choose to write inside a secret is encrypted on your device and is never readable by us.

IP addresses

Your IP address is used in memory to limit how many requests one connection can make, and is passed to Cloudflare Turnstile for the security check when you share a secret or send a report. We don't store it.

Why we use this data

To run the service, keep it secure and deal with misuse. Our lawful basis is legitimate interests: providing a working, secure service that can't easily be abused.

Who else is involved

Cloudflare hosts the service, runs the security check and delivers report emails to us. It processes request data, such as IP addresses, to deliver and protect the service, and may keep it in short-lived logs under its own terms. The database is held in Western Europe. Where Cloudflare processes data outside the UK, its data processing addendum includes the UK's approved transfer safeguards.

Your rights

You have the right to ask for a copy of your personal data, to have it corrected or erased, and to object to how we use it. Because we hold no names, emails or IP addresses, we can usually only find something if you give us the link concerned. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.