Data storage
What Does the Collogue Server Store?
What the current client implementation stores, and what infrastructure facts cannot be inferred from it.
Published: August 1, 2026
Current implementation boundary
Current Collogue links carry the encrypted payload in the URL. The browser uses Web Crypto API: PBKDF2-SHA-256 with 310,000 iterations derives a 256-bit AES-GCM key from the separately entered password, with a random 16-byte salt and a 12-byte IV. The current client has no application API request for creating, retrieving, or storing messages.
The password is not encoded in the link. The implementation does not provide one-time viewing, server-side deletion, or an expiry timer. Treat the full link as sensitive and share the password through a separate channel.
Further context
Every functioning web service handles data. The useful questions are which data, in what form, for what purpose, and for how long.
Different data has different risks.
Do not leave “usually” in the final table. Replace every cell with a product fact.
Encrypted content is less useful to an attacker who lacks the key. It is not equivalent to storing nothing.
- approximate payload size;
- the existence of a message;
- timing;
- protocol version;
- expiration choice;
- repeated structural metadata.
Good encryption should hide the content, not the fact that an encrypted object exists.
Applications often log errors, request paths, status codes, and timing. Poorly designed logging can also capture request bodies or sensitive identifiers.
- create request bodies are logged;
- message identifiers appear in URLs;
- decryption failures include payload data;
- exceptions are sent to a third-party service;
- client telemetry contains route details;
- full URLs are recorded.
Sensitive content should never be added to logs merely because debugging is convenient.
An application may not explicitly log IP addresses while its reverse proxy, load balancer, CDN, or hosting platform does.
- proxy access logs;
- CDN logs;
- serverless invocation logs;
- firewall logs;
- abuse-prevention systems;
- rate-limit stores;
- hosting dashboards.
The privacy page should not say “no IP logging” because the application code lacks console.log.
Infrastructure exists even when it is absent from the frontend repository.
That is not as dramatic as “vanishes without a trace.” It is much more informative.
These behaviors have different failure modes.
Exact language prevents false expectations.
The best field to protect is the field that was never collected.
It is usually cheaper than promising to defend a larger dataset forever.
Answer from infrastructure evidence, not frontend code. Proxies and hosting services may record request metadata even when the application does not.
Legal classification depends on context and jurisdiction. From a security perspective, ciphertext and associated metadata should still be treated as data requiring protection.
Create a private Collogue link when you need to send a password, token, recovery code, or another short piece of sensitive text.