'/%3e%3crect%20x='1'%20y='1'%20width='126'%20height='126'%20rx='29'%20fill='none'%20stroke='%23ffffff'%20stroke-opacity='0.14'%20stroke-width='2'/%3e%3c!--%20Letter%20bounds:%20x%2026.5%20to%20101.5,%20y%2026.5%20to%20101.5.%20The%20bar%20leaves%20the%20corner%20as%20one%20continuous%20rounded%20segment%20that%20fades%20along%20its%20length,%20then%20breaks%20into%20dots.%20--%3e%3cpath%20d='M34%2086.5%20H49%20A7.5%207.5%200%200%201%2049%20101.5%20H34%20A7.5%207.5%200%200%201%2034%2086.5%20Z'%20fill='url(%23d1)'/%3e%3cpath%20d='M34%2034%20H94%20L34%2094'%20fill='none'%20stroke='%23ffffff'%20stroke-width='15'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cg%20fill='%23ffffff'%3e%3ccircle%20cx='64'%20cy='94'%20r='7.5'%20fill-opacity='0.56'/%3e%3ccircle%20cx='79'%20cy='94'%20r='7.5'%20fill-opacity='0.4'/%3e%3ccircle%20cx='94'%20cy='94'%20r='7.5'%20fill-opacity='0.26'/%3e%3c/g%3e%3c/svg%3e){kind=small}
Privacy
Zwisper has no server. Nothing you write, read, or store is sent anywhere.
What we collect
Nothing. There is no account, no analytics, no telemetry, no crash reporting, and no advertising. Zwisper makes no network requests of its own. We cannot see your notes, your contacts, the pages you visit, or that you use the extension at all, because none of it reaches us.
What is stored, and where
Everything Zwisper keeps lives in your browser's extension storage on your own device:
- Settings. Your preferences and per-site rules, in local extension storage.
- Contacts vault. One shared key per person. It is encrypted on disk with AES-GCM under a master passphrase you choose, in local extension storage. While the vault is unlocked, the decrypted keys sit in session storage, which is memory-only and cleared when the browser closes or the auto-lock timer fires.
- Inbox. Notes you have opened. This is off by default. When it is off, the inbox lives in session storage and disappears when you close the browser. When you turn it on, it is written to local extension storage so it survives a restart. You can clear it at any time from settings.
Uninstalling Zwisper removes all of it. None of it is synced to any account or server by the extension.
Permissions
Zwisper reads and writes the page you are on so it can underline messages that carry a note, show the note's card, and put the compose pill in the text field you are typing in. That work happens entirely inside your browser tab. Zwisper does not transmit page contents anywhere.
Reveal links
A reveal link carries the message text in the URL fragment — the part after the #. Browsers never
send the fragment to a web server, so the text is decoded by JavaScript in the reader's own browser and this
page never receives it. The password is never part of the link; the reader types it here, and it stays in the
page.
This page
This page is static. It sets no cookies, loads no third-party scripts, and runs no analytics. Whoever hosts it may keep ordinary web server access logs, which would record that the page was requested — never the fragment, and never the note.
Changes
If this policy ever changes, the new version replaces this page and the change is recorded in the project's changelog.
No warranty
Zwisper is free, open-source software provided as is, without warranty of any kind, under the MIT license. It is a privacy tool, not a guarantee: a screenshot of a message destroys the note inside it, some platforms strip the hidden characters when a message is sent, and a platform can tell that a message carries invisible characters even if it cannot read them. You use it at your own risk, and the authors are not liable for how it is used or for any loss that results from using it.
Contact
Questions about privacy go to the project on GitHub: open an issue.