OBSCURATRUST CENTER
app status transparency privacy security support

Trust, privacy, status, and support in one place.

OBSCURA is built for zero-knowledge file transfer: files encrypt in your browser, the server stores ciphertext only, and shares expire or burn after the configured limit. This page collects the operational proof, data policy, security posture, and support links people need before trusting it with anything sensitive.

live status public metrics privacy posture security policy support project
service statusloading...
operational degraded outage
Self-reported from incidents.json. Days with no recorded incident are operational.
loading...
transparency reportloading...
created
-
shares uploaded
burned
-
manually purged
expired
-
TTL elapsed
exhausted
-
downloads consumed
shares created · daily retained window -
retained counter days -
none created burned expired exhausted
abuse reports
-
received, cumulative
abuse actioned
-
purges or responses, cumulative
The report shows every retained daily counter, up to 90 days. Counters are daily KV keys with 90-day TTL. They carry no per-share data, no IPs, and no identifiers. Raw JSON: /api/transparency.
privacy and logslast updated 2026-06-14
server sees
ciphertext
R2 blob, total ciphertext size, and short-lived KV metadata.
server never sees
keys
URL fragments and passphrases do not go to the Worker.
accounts
none
No email, identity, cookies, or user profile required.

what OBSCURA stores

  • Ciphertext. Stored in Cloudflare R2 under a random 16-hex-character ID until expiry, burn, or download exhaustion.
  • Per-share metadata. Stored in KV: expiry time, remaining downloads, total ciphertext size, and created timestamp.
  • Aggregate counters. Daily totals for created, burned, expired, and exhausted shares. No identifiers.

what OBSCURA does not store

  • Plaintext. Encryption and decryption happen in the browser.
  • Encryption keys. Normal-mode keys live in URL fragments; passphrase mode wraps the data key client-side.
  • Application access logs. The Worker does not write per-request logs for upload, download, or burn routes.

Cloudflare can still retain platform analytics and security events. A Cloudflare account administrator could correlate IPs to share IDs inside Cloudflare's own retention window, even though the app does not log that itself. Full canonical policy: PRIVACY.md.

security posturepublic source
crypto
WebCrypto
AES-256-GCM with optional Argon2id passphrase wrap.
audit
not yet
No independent third-party security audit has been completed.
regulated data
no
No HIPAA, PCI, CJIS, classified, BAA, SLA, or key recovery posture.

Report vulnerabilities to security@obscr.app. Scope and response expectations are documented in SECURITY.md. Abuse reports go to abuse@obscr.app.

supportfree and open source
tip
Buy Me a Coffee
One-off support for Cloudflare egress, domain renewal, future security review, and project upkeep.
free ways to help
Star, share, audit
Star the repo, share obscr.app, file issues, or read the crypto path and tell us what breaks.
Donations happen on Buy Me a Coffee and Stripe. OBSCURA does not link donations to shares; the app has no accounts and no donation identity surface.
raw transparency JSON · incidents JSON · repo