Your message is encrypted in your browser and passed directly between connected browsers. The registry coordinates connections and availability; it does not receive the message or its decryption key.
The full link is the key.
Anyone with the complete link can read while a holder is reachable. Share it with care. The key stays in the link fragment, outside the network request for the page.
Open tabs keep it available.
By default, the creator's original tab must stay connected. Closing it, reloading, or going offline can end the message. The carried-message mode lasts while at least one connected holder remains. The creator can end either message mode from the original session. Groups have no creator-only End control: the final participant leaving ends the room.
One tab per browser profile.
Only one tab in this browser profile can hold a room. Automatic mode produces a different public identity for each room. Creating or restoring a saved identity explicitly uses the same public ID across future messages and rooms, so other participants can recognize it. It stays selected in this browser until changed, signed out, or removed by clearing Held site data. Simple messages carry a verified sender ID inside their encrypted package. Participant IDs are exchanged only over secure peer connections while you hold a message or room. Group aliases and signatures also travel only between peers. Sharing a cross-room proof is optional. Other browsers and private windows are separate unless you restore an encrypted identity backup. Clearing site storage loses the identity without a backup; restoring never recovers old messages or creator control. Your black or white theme preference is also saved only in this browser.
Your voice stays in the attachment.
The microphone starts only when you choose Record. Voice messages use the same encrypted transfer and lifetime as other files. Disguised mode changes the sound in your browser before recording; it does not guarantee anonymity. What you say, speech patterns, and background sounds can still identify you. Anyone who saves a recording can keep their copy.
Peers carry the available history.
New group participants receive messages still held by connected peers: up to 200 messages and 512 KiB of text. History stays in memory and is cleared when a tab leaves or loses its required connection. There is no server archive. Attachments transfer directly between peers. Files are received on request in messages and groups. Participants share verified pieces while connected; every piece must remain held somewhere for a complete download. Received pieces use independent encrypted temporary storage for each room, capped at 5 GB per room subject to available browser storage. They are removed when you leave, cancel, or lose your session. Cache keys stay only in memory. After a browser crash, leftover encrypted files are removed on your next visit. Saved downloads remain yours.
Short links have a deadline.
Shortening stores the destination address on Held until its chosen expiry. It is not encrypted like a message. Visits redirect without click counts, accounts, or added tracking parameters. Expired destinations are removed from server storage. Your latest 100 created links, including their original addresses and expired entries, stay in this browser’s local history until you remove or clear them. That history is never sent to Held. Secret Held message and chat invitations cannot be shortened, so their keys stay in the browser.
Feedback goes to Held’s creator.
Feedback stores the message and any optional reply email in Cloudflare, where Held’s creator can read them until they delete them. It is not encrypted like a Held message. Feedback does not include your current page address, secret invitation key, or signing identity unless you type them into your note. An unsent draft stays only in the current tab and clears on reload. Opening Feedback loads Cloudflare Turnstile, which processes browser and network information to check for spam. The verification token is checked before saving and is not stored with your feedback.
Public activity shows totals.
The registry counts newly created message links and groups, and estimates active peer connections. Public stats contain no room IDs, names, message contents, IP addresses, or signing identities. One person can count as multiple peers.
Ending cannot erase a saved copy.
Ending asks cooperating tabs to clear the message. Recipients can still copy, save, photograph, or modify their client to keep it.
This does not make you anonymous.
Connection services and other browsers may see your IP address. Browser code can access the decrypted message, so privacy also depends on trusting the code delivered by this site and your device.
