Security by design

Vibe content is encrypted in the browser before transmission. The server stores the encrypted envelope and only lifecycle metadata required for operation.

Local encryption

MinuteVibe uses Web Crypto, HKDF-SHA-256 and AES-256-GCM with distinct keys and nonces. Reading secrets remain in the URL # fragment.

Private replies

Blocking reasons are encrypted for the emitter with a dedicated reply key. The server does not store these reasons in plaintext.

Limitations

MinuteVibe does not protect against a compromised device, screenshots, deliberate copying by a recipient, or network metadata observation by transport infrastructure.

What remains visible

The server also receives the Aligned, Blocked or Neutral choice in plaintext and technical timestamps. Objections are encrypted for the creator. The control secret is presented to the server to authorize actions; it is not a decryption key.

Keep your control links private

These are your access links to the decision dashboard. Copy control link copies an administration link to keep to yourself, not the link intended for your colleagues.

What does this browser store?

If you opted to remember the Vibe, the browser keeps the control link in an encrypted local vault. This link contains the secrets needed to read and control the Vibe. It would therefore be inaccurate to say that no secret key is retained on this device.

The participant link is not saved separately, but the reading key is also contained in the control link. Never send that control link to your colleagues. Local encryption does not protect against a compromised device or a malicious script running on this site.

The visible registry stores only identifiers, dates and local status. It stores neither the message text nor objections.

Two links, two responsibilities

The participant link lets someone discover the question and respond. The control link also allows viewing results and deleting the Vibe. Its fragment contains secrets and must remain private. A shorter link or noise in a URL does not make sharing a secret safe. Check the recipient before sending and never test a private link in a public diagnostic tool.

Protections that work together

Encryption protects content before transport. HTTPS protects the connection. Site headers limit script sources and framing by other sites, among other things. Rate limits reduce some forms of abuse. These measures have different roles: none alone proves that a browser, host or application is invulnerable.

Your browser is part of the protection

Keep your browser up to date and limit the extensions you trust. A compromised device, malicious extension, screenshot or deliberate copy can defeat expected confidentiality. The local vault makes secrets less directly readable at rest, but does not defeat a malicious script running on the same origin.

Report without exposing secrets

Report unexpected behaviour clearly: page, browser, approximate date and steps to reproduce. Hide personal data in screenshots. Do not send control links, keys or passwords. The public contact channel is available; a Canary statement is not a support channel.

Contact

Your local access links and copies

My Vibes remains local, with no account or server synchronization. The JSON inventory holds metadata without access links or keys and cannot restore access. A separate backup protects selected control links with a passphrase, using PBKDF2-HMAC-SHA-256 and AES-256-GCM in the browser. You can explicitly preview and import it in another browser; it does not extend a Vibe or include its messages or responses. The file, passphrase and imported links are not sent to the service. A compromised device or site script can access secrets in use. A manually added link uses a locally declared deadline, not a server-verified one.

The file stays on your device until you remove it. It does not extend a Vibe or recover a lost link. We cannot reset its passphrase. A compromised device or script remains a risk.

My Vibes