Postern

Privacy

Postern sends a password, text, link or file from your phone to your browser. It is built so that nobody but your browser can read what you send, including us.

What we can't see

Everything is encrypted on your phone before it leaves, using a one-time key that only your browser holds (HPKE, RFC 9180: X25519, HKDF-SHA256 and AES-256-GCM). The key never reaches our server: it's in the part of the QR link after the #, which browsers don't send.

What passes through our server

• The encrypted message, held in memory only until your browser receives it, then deleted. Nothing is written to disk. Unclaimed sessions are deleted after 2 minutes.
• A random session ID, which links the phone to the waiting browser.
• Your IP address, used only to limit how many requests one address can make per minute. Postern doesn't log it or keep it.

Our hosting provider, Cloudflare, handles the network traffic under its own privacy policy.

What we don't do

• No accounts, cookies, analytics, ads or tracking.
• We don't sell or share anything, because we don't have anything to share.

The browser extension

The extension stores only your server setting. While a transfer is in progress, the one-time key and what arrived are kept in the browser's memory-only session storage. They are deleted when you use or discard the item, after 3 minutes, or when the browser closes. The extension touches a page only when you open Postern on it, and then only to fill the field you selected.

Offline mode

When you show the encrypted message as a QR code, the laptop's camera reads it locally. The camera picture doesn't leave your computer.

Contact

Questions: info@dahp.io

Last updated 28 October 2026.