Typehere

Effective August 12, 2026

Privacy.

Your document stays in your browser by default. With sync, the browser encrypts it before anything is sent.

How data moves

Plaintext stays inside the browser. The relay receives only an encrypted snapshot.

Sync offYour writingStorage in this browserNo document content is transmitted
  1. 01 · writeYour browser

    Plaintext and local history stay here.

  2. 02 · encryptAES-256-GCM

    The snapshot is encrypted before transmission.

  3. 03 · storeRelay

    Holds one encrypted snapshot, never the key.

  4. 04 · openAnother browser

    The access link allows local decryption.

What the relay stores

It does not receive

  • Plaintext
  • The content key
  • The root capability
  • Local history

It stores

  • One encrypted snapshot, up to 1 MiB
  • A derived document identifier
  • A one-way authorization verifier
  • Size, integrity, and expiry data
  • Temporary phone-pairing public data and an encrypted offer, for up to five minutes

Typehere has no accounts, ads, analytics, or document-content logs. Relay application logging is disabled.

The access link

Sync creates a random 256-bit root capability. It sits after # in the access link, a part of the URL browsers do not send in requests. Typehere removes it from the visible address and derives separate encryption, address, and authorization values from it.

The QR code contains the same link and is generated in your browser. Anyone with either can read and change the document. Typehere cannot recover a lost capability.

A computer-pairing QR is different. It contains a random session ID and that computer's temporary public key, not the document capability. An enrolled phone encrypts the capability for that computer before the offer reaches the relay. The temporary pairing record expires after five minutes.

Retention

BrowserThe document and up to 50 revisions remain until you clear site data or the browser removes them.

RelayThe encrypted snapshot expires 30 days after its latest accepted update. There is no immediate remote-delete control.

Limits and infrastructure

Encryption cannot protect an unlocked or compromised device, a malicious extension, clipboard monitoring, or a leaked access link.

Typehere adds no tracking. Vercel serves the app; Cloudflare hosts the encrypted relay and runs the security check used to enable sync. Those providers receive ordinary request data such as IP address, browser details, timestamps, and security signals. Typehere sets no advertising or analytics cookies.