Security
Minotrace is built for people who handle sensitive investigations. This page says plainly what is protected, and what isn't.
On this page
Your boards on your device How sharing works What we can and can't see What encryption doesn't protect Good practice Reporting a vulnerabilityYour boards on your device
Your boards stay in your browser, as Privacy explains. Anyone who can use your browser profile can open them, so protect your device as you would any work file.
Back up your work. Clearing browser data deletes your boards. Use ☰ → Save to file (Ctrl+S) regularly, and keep the file somewhere safe.
How sharing works
When you click Share:
- Your browser compresses the board and encrypts it with AES-256-GCM, using a new random key for every share.
- Only the encrypted data is uploaded to
share.minotrace.comand stored on Cloudflare R2. - The key goes into the link, after the
#. Browsers never send the part after#to servers, so Minotrace never receives the key.
The link looks like minotrace.com/#share={id},{key}. Whoever opens it gets an editable copy in their own browser; your original is never changed.
What we can and can't see
| Minotrace | |
|---|---|
| Your boards (not shared) | ✗ never leave your browser |
| Content of a shared board | ✗ encrypted, we don't have the key |
| That a share exists, its size and creation date | ✓ See Privacy |
| Technical data such as IP address, processed by Cloudflare to serve the site and limit abuse | ✓ (not stored with your shared board) |
| Anonymous usage events (which features are used, no board content, no user ID) | ✓ See Privacy |
What encryption doesn't protect
- Anyone with the link can open the board. Treat a share link like the file itself. Send it only through channels you trust.
- Some apps store full links. Chat apps, email services, and link previewers may keep a copy of the whole link, including the key. So can your browser's history, and browser sync if it's on. On sensitive cases, prefer channels you control.
- Shared links can't be revoked yet. If a link leaks, email us the link without the part after
#, and we'll delete the encrypted data. A shared board is also deleted 12 months after you create it, but until then a leaked link keeps working. Deleting it doesn't remove copies that someone has already opened. - Your device and browser. Malware or a malicious browser extension can read what's in the page. Use a clean browser profile for sensitive work.
- Exported images and files (PNG,
.minotrace) are not encrypted. Store them like any other case file.
Good practice
- Save to file regularly, and keep backups encrypted at rest.
- Share only what's needed: you can create a new board with just the relevant part.
- Never paste real case data into feedback emails or AI tools you don't control.
Reporting a vulnerability
If you find a security issue, please email [email protected] with details. We'll acknowledge it within a few days, and we ask you not to disclose it publicly before it's fixed.