DMCA & Abuse Reporting

This has to come first, because it determines what any report can realistically achieve. Inkrypt stores notes as ciphertext encrypted in the user's browser with a password we never receive. We cannot read the contents of any note.

That means we cannot review a note to determine whether it infringes copyright, contains prohibited material, or is being used abusively. We can see that a note exists at a given address, when it was created, and how many times its encrypted payload has been fetched. Nothing more.

If you believe material accessible through an Inkrypt link infringes a copyright you own or represent, send a notice to work.securetext@gmail.com with "DMCA" in the subject line.

To be actionable, a notice should include:

On receiving a valid notice we will remove the identified note. Because notes are encrypted, we cannot verify the infringement claim by inspection — we act on the notice itself, and we will tell you what action we took.

If your note was removed and you believe that was a mistake or a misidentification, you may send a counter-notification to the same address, including your signature, identification of the removed material and its location, a statement under penalty of perjury that you believe the removal resulted from mistake or misidentification, and your contact details with consent to the jurisdiction of the appropriate courts.

To report an Inkrypt link being used for phishing, harassment, malware distribution, or to share unlawful material, email work.securetext@gmail.com with "Abuse" in the subject line and include the exact URL.

Please describe how the link was used and what harm it caused or risked. Since we cannot inspect the note, that context is what allows us to assess the report. Where credible, we will delete the note.

Reports involving an immediate risk of harm to a person should go to law enforcement first. We will cooperate with valid legal process, though the technical reality above bounds what we can produce: we hold ciphertext, not content.

Because we cannot inspect notes, a takedown request is a request to destroy data we cannot evaluate. That makes this process open to abuse — for example, an attempt to destroy someone else's note by falsely claiming infringement.

Submitting a knowingly false notice may carry legal liability under applicable law. We record all notices received and the action taken on each.

We built a system we cannot read, and we think that is the right design for a tool people use to move sensitive information. The unavoidable consequence is that we cannot police its contents in the way a platform hosting readable material can.

What we can offer is a responsive process: a real address that a person reads, prompt deletion where a report is valid, and an honest account of what we are and are not able to determine. We would rather state that limitation clearly than imply a moderation capability we do not have.