# Hemmelig.app privacy rating

Secret sharing service that encrypts text and files in the browser and deletes them after a set number of views or an expiry time. Supports passwords, IP restrictions, webhooks and self-hosting.

## Summary

Hemmelig.app scores 59 out of 100 (grade D) on the secret sharing criteria. It meets 4 of 8 criteria: open source, no ads or data sales, TLS configuration and security headers. It partly meets no trackers or telemetry. It does not meet independent audit, transparency report and tells users about requests. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://hemmelig.app
- Source code: https://github.com/HemmeligOrg/Hemmelig.app
- Home page trackers: none found
- Category: [Secret sharing](https://privacyratings.com/secret-sharing/)
- Grade: D (59/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | All code is public under the source-available O'Saasy license, which bans competing hosted offerings and is not OSI-approved. | https://github.com/HemmeligOrg/Hemmelig.app/blob/v7/LICENSE |
| No trackers or telemetry | Partial | No third-party trackers, but the hosted service records page visits with first-party analytics using hashed visitor IDs; only instance administrators can turn it off. | https://hemmelig.app/privacy |
| No ads or data sales | Yes | Free service without ads, supported by donations. The privacy policy lists only the minimal data stored to run the service. | https://hemmelig.app/privacy |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=hemmelig.app&hideResults=on |
| Security headers | Yes | Grade A+ (135/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=hemmelig.app |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/secret-sharing/hemmelig-app/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/secret-sharing/hemmelig-app.md