Privacy & sharing

Uniport is built so we can’t read your encrypted files, and your money never passes through us. By default your browser encrypts your documents, sheets, shops and orders before they reach us. The key travels after the # in your link, and our servers never see it. Your browser talks only to uniport.sh, with no ads, no analytics and no cookies until you sign in. We do see your email if you make an account or turn on payment emails, when and from where you sign in, file sizes and times, sharing settings, payment amounts, and anything you send us unencrypted, such as a PDF for signing or a request to the assistant. What we store lists what we keep for your account and files, and each feature’s section adds its own. Uniport and Uniport Sign are run by Paperfoot AI Pte. Ltd., Singapore.

Encrypted documents

New documents and spreadsheets use end-to-end encryption by default. Your browser encrypts their text, titles, cells, comments, cursor information and the names you give their sharing links before sending them to Uniport. A link name saved by an earlier version of Uniport is encrypted the next time the file’s owner opens the file; until then Uniport can read it. Only people with the complete link can decrypt the content.

You can choose standard storage in Settings. Standard files are readable by the service. Existing files keep their original privacy setting; use “Make an encrypted copy” to create an encrypted version of a standard file.

Encryption doesn’t protect against a compromised device or altered code served from uniport.sh. AI drafting and the assistant send the parts they use outside the encryption.

Files and folders

Any file you keep in Uniport as it is, such as a PDF, a photo or a zip, is encrypted in your browser before it uploads, whatever your setting for new files. Each file has its own key and goes up in parts of up to 8 MB, padded to set sizes. Its name, type, size and folder are encrypted in your account’s file list. Uniport sees how many parts a file has, their padded sizes, when they arrived and which account’s space they use, never a name, a folder or what is inside. The folder you have open is named after the # in the address, which your browser doesn’t send.

Moving in reads your folder or zip in your browser. Word, text and web-page files become Documents and CSV and Excel files become Spreadsheets, stored like any new file under your setting for new files; everything else is kept as a file. The list of what a move found, with names, sizes and how far it got, stays in this browser.

Files in Trash count toward your space. Deleting a file forever deletes its parts.

Your account

Your file list and document keys are encrypted before they are saved to your account. Your password unlocks them in your browser. Keep your recovery key somewhere private: it resets your password if you forget it. Without your password or recovery key, Uniport cannot recover your encrypted workspace.

New accounts get a recovery key that is separate from the key that encrypts your workspace; older accounts can create one in Settings. A new recovery key replaces the previous one, which can then no longer reset your password. On an older account the previous key still decrypts your saved file list, so keep it private or destroy it. Changing your password or email, or creating a recovery key, signs out your other devices.

Signing in adds the files already opened in that browser to your account, and doesn’t change the name people see in documents.

A passkey you add in Settings › Security unlocks Uniport with Face ID or your device’s own lock. Uniport stores the passkey’s public key and your workspace key sealed under it; only your device’s passkey can open it. Changing your password or email, creating a recovery key, recovering your account or signing out everywhere removes your passkeys.

Deleting your account in Settings › Profile deletes its sign-in, sessions, saved file list and the files, shops and payments pages it owns, and ends Pro.

What Uniport can’t do

Uniport can’t read an end-to-end encrypted file, a shop’s products and orders, or what a payment is for. Your browser encrypts them before sending them, and the key that opens them travels in your links, after the #, and is never sent to Uniport. With an account, your file list and keys are saved encrypted, and your password unlocks them in your browser. What Uniport can read is what you send it unencrypted, as each section below says: a standard file, a PDF you send for signing, an invoice or contract you send by email, a payment’s amount and reference, and what you send to AI drafting and the assistant.

Uniport can’t spend from your wallet, and your money never passes through it. USDC and USDT go from the payer’s wallet straight to yours, and a bank transfer goes to your own account. Uniport stores the addresses that receive crypto payments and holds no key that can spend from them.

Only a signer can sign: Uniport Sign takes a signature only through the signer’s own link, never the sender’s, with the name they type, the signature they draw, type or upload, and their agreement to sign electronically.

What we store

We store your account name and email, document and shop identifiers, sharing permissions, the names of sharing links in standard files, whether each shop is taking orders, timestamps and encrypted data sizes. Each file also has a feature level, the oldest version of Uniport that opens it without losing content, which stops an outdated tab or agent library from saving over it. In an encrypted file, the level can show which kinds of content it uses, such as images, but not the content. Each signed-in session records its IP address and browser type. Signing out deletes the session; a session that expires, 14 days after it was last used, is deleted when that browser next connects. To limit abuse, creating files and shops, placing shop orders, sending contact requests, wrong shop passwords, restoring shops from backup words, reading a shop’s stock, joining a supplier with a reseller link, AI drafting, signing in and account changes are counted per IP address; assistant requests per IP address and per account; contact requests and wrong shop passwords also per customer link; and stock and reseller changes per shop. These counts are stored under a hash of the address, account or link and deleted after they expire. To enforce daily assistant limits, Uniport totals each account’s assistant requests, tokens and cost per day, deleted after 90 days, and the cost from each IP address per day, stored under a keyed hash of the address and deleted after a day; the totals contain no messages or file content. For each file, Uniport keeps the time the assistant last read it, including a file you dropped for it to file and the file it made from one, and the time an AI app last read it through uniport.sh/mcp, and nothing about what was read or which app read it, so the file lists can show them to anyone with a link to the file.

What you send through Support, and the email address you add for a reply, is kept for 180 days and read only by Uniport’s team. A problem you tell Uni about is kept the same way, with your account, the kind of page you were on (never a file’s link or key) and the app’s version. What you tell Uni about yourself is encrypted in your browser, like your chats with it.

What we use it for

We use what we store and see to run Uniport for you: to sign you in, keep and sync your files, send the emails and signing requests you ask for, run the AI features you use, take payment for Pro, answer support requests and limit abuse. We show no ads and don’t sell your data. The services below receive only what each needs for that.

Services Uniport runs on

Vercel hosts Uniport and Uniport Sign and runs their servers. Every request passes through it with its IP address and browser type.

Neon runs the database that holds everything listed under What we store. Encrypted files, their images and saved versions, and shops are stored there as your browser encrypted them.

Amazon Web Services stores the files you keep as they are, described under Files and folders, in the United States, as your browser encrypted them, and your mail as it was sealed.

Amazon SES receives the mail sent to your Uniport address, described under Mail, and sends Uniport’s and Uniport Sign’s email: the code that confirms your address, one email per payment, the new-order emails a shop’s owner turns on, the invoices and contracts you send by email, the links to secure messages you have it email, the mail you send from your Uniport address to outside addresses, and Sign’s signing links and verification codes. With Signal connected it also sends the email that says a Signal account was connected or changed, and the one that says Signal notices are paused.

Google’s Gemini API runs AI drafting and the assistant, on the terms described under Assistant.

Stripe takes payment for Uniport Pro on its own page; Uniport receives no card numbers. Uniport stores your Stripe customer and subscription ids, the email you paid with, your plan’s price, whether it is monthly or yearly, its status and its current period.

TypeSafe AI reads the words you type in a Uni message and tells Uniport whether it is a quick change, as described under Uni.

Amazon Web Services runs Uni’s Signal server in London. Signal carries the messages between you and Uni.

To see USDC and USDT arrive, Uniport reads public blockchains through public nodes, which see the wallet addresses it asks about. Exchange rates come from Frankfurter, which publishes the European Central Bank’s rates, or from open.er-api.com; those requests carry nothing about you.

AI drafting

Descriptions you submit for AI drafting when creating a contract, invoice or other business document, and instructions entered in a contract’s Ask AI, are sent in readable form to Uniport and to Google’s Gemini API, on the terms described under Assistant. In an end-to-end encrypted file, that text leaves the encryption. The rest of the document and its keys are not sent. Opening a template, editing contract fields and editing a file don’t use AI. Drafted documents follow your storage setting: end-to-end encrypted unless you chose standard storage.

Assistant

The assistant in documents, spreadsheets, invoices and other business documents, and a shop’s manager needs a Uniport account. In an end-to-end encrypted file or a shop it asks for your consent before its first request, once on each device. Your consent is kept in this browser.

With each request the assistant sends your message and the chat so far: your earlier requests in it, its replies, and a record of the changes it made, with what it wrote and what that replaced. It also sends today’s date and time with your time zone and language setting, your display name, the file’s title and your selection, and, when your request names them, the display names of others in the file at that moment (in a spreadsheet, with the cell each is on). It also sends the file’s content: all of it when it fits the assistant’s size limit, otherwise an outline of all of it and the part around your cursor or selection, and any other cells or text it reads. That content includes formatting, a document’s pages, open comments with their authors’ names, and pending suggestions. In an end-to-end encrypted file, those parts leave the encryption for that request; the file’s key stays in your browser.

From an invoice or other business document, those parts are its fields, lines and totals. From a shop, they are its settings, products with their options and stock counts, discount code names and percentages, its outside suppliers and their costs, its Uniport suppliers’ and resellers’ names and the resellers’ terms, and each order’s customer name, items, totals, note and tracking. Customers’ contact details and addresses, the discount codes customers type and the shop’s links are never sent.

Uniport’s server passes each request to Google’s Gemini API, which Uniport uses as a paid service. Under Google’s terms for paid services, Google doesn’t use prompts or responses to improve its products and keeps them for 55 days only to detect and prevent abuse; authorized Google staff may review content flagged for abuse, and Google may store or cache the data transiently in any country where it or its agents have facilities. Uniport doesn’t store or log messages, file content or replies; it keeps only the counts and daily totals listed under What we store, and the time the assistant last read each file. No other service receives them. A message typed to Uni also reaches one more service, described under Uni.

The assistant works on a copy of the file in your browser and applies its changes together when it finishes, as one step you can undo. When the assistant changes a document, note or spreadsheet, the file keeps a short record with it for anyone who can open it: your name, the time, the first 140 characters of your request and one line saying what changed, encrypted with the file when it is end-to-end encrypted. A request that deletes a sheet, removes most of the file, or changes a shop’s prices, availability, discount codes, paid orders, or how its customers pay or get in touch waits for you to apply it. A cell someone else changes while the assistant works keeps their value. A request unrelated to the open file goes to Gemini with the conversation so far and the same parts of the file. On a view-only link the assistant answers questions and can’t change the file. The owner can turn the assistant off for a file; Uniport then hides it for everyone who opens that file, but anyone who can open a file can still copy its content elsewhere.

People

People is put together in your browser from your own files: the clients on your invoices, the parties to your contracts, who your signing requests went to, your shops’ customers, and the guests and bookings in your calendar. To show who a signing request went to, your browser opens the request with its own link. None of it is sent to Uniport. What you add yourself, such as people, tags and deals, is kept in one end-to-end encrypted file in your account; Uniport sees its size and when it changes. The list is also kept on this device, encrypted with your account’s key.

Sharing

Anyone with a complete sharing link can use its permissions. Owners can create edit or view-only links, name and rename them, set an expiry date, and revoke individual links. Revocation stops new access through that link; it cannot erase downloaded copies or remove keys people already received. People in a file, including through view-only links, see your display name while you have it open.

A secure message and its files are encrypted in your browser with a key made from its link and a passphrase your browser picks, and replies to it are encrypted in the recipient’s browser to a key made from your account, so Uniport stores them only encrypted and sees when each was sent, opened and answered. If you have Uniport email the link, it sees the link and the address it goes to, never the passphrase.

Signing

Preparing a document for signing keeps the PDF in your browser. Creating the signing request uploads a readable PDF to Sign. Signing PDFs are not end-to-end encrypted; they are deleted according to the retention period chosen for the request. Sender links are kept in the browser that created the request and, when you’re signed in, in your account, encrypted with your account’s key so only you can read them.

The completed PDF ends with a signing record: each signer’s name, when and how they signed, whether through a private link or a verified email address, and the SHA-256 of the original PDF. The sender and every signer can download a receipt of the signing, signed with Sign’s key.

Shops

Your browser encrypts your shop before upload: its name, description, products, prices, photos, pickup and delivery details, chat link and payment details. It puts the key in each customer link, after the #, and signs the shop so customers’ browsers open only what you published. Anyone with a customer link can see all of it, including hidden products and your wallet address. Customers can’t list your discount codes.

Each order is encrypted in the customer’s browser to your shop’s keys, so only you and the managers you add can read it: the items, prices, discount, total, payment choice, and the customer’s name, contact, address and note. If you choose contact requests instead of publishing a chat link, each request is encrypted the same way, so only you can read the customer’s phone number, email or username and their message. Which orders are paid, done or seen, which requests you have handled, your link names and your discount-code list are encrypted with the same key. The owner key is created in your browser and travels only in your shop’s owner link, after the #, which is never sent to Uniport. Without an account, that link and your shop’s backup words are the only ways back to it; Uniport keeps the backup encrypted with a key made from the words, which never leave your browser, and sees when you make, replace, delete or restore from one, and the IP address a restore comes from. With an account, the owner link is also saved in your encrypted file list.

Managers you add in Settings › Managers get their own keys; someone you remove can’t read the orders that arrive afterwards. If you turn on order emails, Uniport stores the shop’s name with your account and emails you “New order <reference> in <shop name>” for each order, and nothing else about it. A supplier with order emails on also gets “New reseller order to ship in <shop name>” when resellers’ orders are sent to it, without their references.

Uniport sees which account, if any, saved each shop, when you change the shop or mark orders, which orders you mark shipped, when you pause or resume orders, and roughly how large the encrypted data is; every order and every photo is stored at the same size. It sees when each order arrives and which customer link it came through, but not the link’s name, the customer’s details or what they ordered. It sees when each contact request arrives, and every request is stored at the same size; the link a request came through is used to limit how many arrive and isn’t stored with it.

Revoking a customer link stops it from opening the shop; anyone who had it can read the shop again if they get another link to it. Your shop’s owner link is the full address of the page where you manage it, and it contains the owner key. Anyone who has it can manage the shop and read its orders, so keep it private. Deleting an order or a contact request erases its contents from Uniport’s database at once; deleting a shop also removes its products, photos, orders, contact requests and links. The parts of resellers’ orders a supplier was sent stay with those resellers’ orders for 90 days after the supplier deletes its shop, so each reseller can see which orders it must ship itself. Encrypted copies can remain in database backups until they expire.

You can set a shop password in Settings. Customers then need both their link and the password: your browser encrypts the shop again with a key made from the two, and the password is never sent to Uniport. Uniport stores a check value it can’t turn back into the key and limits wrong guesses at each link, but someone who has a customer link and a copy of Uniport’s database could guess the password without that limit, so use a long one. You can also set an owner password, which your owner link then needs; anyone who has that link can try passwords without limit. Owner links copied before you set it still work without it. Uniport sees whether a shop has a password and when it changes.

USDC payments on Base are public: anyone who knows your wallet address, including every customer, can see each payment’s amount, time and sending wallet, and match payments to order times. Use a wallet only for this shop.

If you turn on Track stock, Uniport stores a count for each item you track under a code made in your browser that it can’t match to a product, whether the item keeps selling when it runs out, and how many of each item every order took, how long they are held, when you first see an unpaid order, and the payment link the order waits for, and, while an order’s items are held, a keyed hash of the network it came from and of its wider IPv6 network, to limit unpaid holds; it never sees the items’ names or prices. Anyone with a customer link can see how many of each counted item are left.

If you turn on Resellers, Uniport sees which shops are linked as supplier and reseller, whether dropshipping and order review are on, and when each order for the supplier is placed, paid, sent and shipped, all stored at the same size. The supplier’s part of each order, its items and ship-to, and the terms the supplier gives each reseller are encrypted so only the two shops can read them; the rest of the order and the reseller’s markup only the reseller can read. For an order paid through Uniport Pay, the supplier also sees how much the customer paid, so it can tell when a payment doesn’t cover its part. If a shop sells to resellers only, Uniport knows that, so it can refuse the shop’s other links. When a reseller’s browser checks a supplier’s part against its own order, Uniport keeps whether it matched, so the supplier sees it. The supplier’s statement of what each reseller owes, with its bill, is encrypted so only the two shops can read it and stored at the same size; Uniport sees only that one exists and when it changed. While a supplier keeps a statement for a reseller, Uniport keeps the record that the two shops were linked, at most 400 days after the link ended.

A shipping address, and a phone number when the shop asks for one, are encrypted with the order; a supplier receives only the ship-to name, address and that phone, never the customer’s email or other contact, and the carrier and tracking a shop or supplier adds are encrypted so only the shops and the customer can read them.

Ordering from a shop

Your browser encrypts your order, or your request to be contacted, so only the shop can read it. Uniport sees your IP address, browser type and when you visit, order or ask to be contacted, but not what you order or your details. Your browser also makes a random code for each order and keeps it with your receipt; Uniport stores only a hash of it, so this browser can still read the order’s status after the shop’s link stops working. If you’re signed in to Uniport in the same browser, Uniport can tell which shops your account visits. The Tell button sends only the order reference through your messaging app; sending the whole order by message shares its items, total and contact details with that app. Instagram, Facebook and TikTok can read pages opened in their built-in browsers. Your cart, a pending order and your last order stay in this browser until you remove them; the details you type, and the key made from a shop’s password, stay until you close the tab. The password itself isn’t stored.

Payments

When you ask for a payment, your browser encrypts what it is for (the title, lines, note, due date and your name and logo as the payment page shows them) and puts the key in the payment link, after the #, which is never sent to Uniport. Uniport stores the amount, currency, status, reference and expiry of each link, the addresses that receive crypto payments, and how each payment was made: the card brand and last 4 digits, the PayPal or Stripe payment id, the blockchain transaction and the address that sent it, or, for a payment you mark as paid or refunded, the method and reference you type. That method and reference are readable to Uniport and reach your webhooks and payment emails; a payment link shows them only as a common method name, such as Bank transfer. Your payments profile’s owner link holds its key the same way.

Card payments are made on Stripe’s page and PayPal payments on PayPal’s, into your own accounts there; Uniport receives no card numbers or PayPal logins. USDC and USDT go straight to your wallet, and their transfers are public on their blockchains. If you turn on payment emails, Uniport stores your email address and sends one email per payment with its amount, method, reference and date. Webhooks you add receive each payment event, signed with a secret shown to you once.

Calendar

Your calendar is end-to-end encrypted, whatever your setting for new files: its events, titles, times, places, notes, guests, attached files and booking pages are encrypted in your browser with keys made from your account, and Uniport stores them only encrypted. Uniport sees that your account has a calendar, its size and when it changes.

When you invite guests, your browser sends Uniport the invitation email for each guest, with the event’s title, time, place, your note and a link to each file you put in the invite, without an encrypted file’s key, and an encrypted copy that only the guests’ links open. Uniport sends the emails through Amazon SES and keeps the encrypted copy and a check value for each guest’s answer link, not their addresses. Guests’ answers are encrypted to your calendar, and only your browser reads them.

Email reminders are stored as a time and a link to the event. The event’s title and Join link are in the reminder only if you turn on Show titles and Join links in Settings › Notifications, and never a Join link with a # in it. Uniport keeps reminders for the next 30 days.

A subscribe link is off until you create one. While it is on, Uniport stores your events’ titles and times, and whether each is busy, readable, so other calendar apps can fetch them; anyone with the link can see them. Turning it off deletes that copy.

A booking page’s details are encrypted with a key in its link, after the #. Uniport sees which 15-minute periods it offers only as values made with a key from your account, which it can’t turn back into times, and stores each booking encrypted to your calendar. To send the confirmation, Uniport reads the booker’s name, email and booked time once and deletes them after sending. A paid booking uses a payment link as described under Payments.

Tasks

A task list is end-to-end encrypted, whatever your setting for new files: its tasks, notes, due dates, labels, comments and the people who have opened it are encrypted in your browser, and Uniport stores them only encrypted. Tasks and the tasks in your calendar are put together in your browser from your own lists.

When you assign a task to someone who has opened the list, Uniport emails them that you assigned them a task. For that, your browser tells Uniport who is assigned and in which file; the email carries your name and a link to Tasks, never the task or the list’s name. Uniport keeps no record of it beyond the counts that limit how many such emails an account can send.

A reminder for a task with a due date is stored the way a calendar reminder is: when to send it, the due day and time, and a link that names the file and the task. The task’s title is in the reminder only if you turn on Show titles and Join links. Tasks due on the same day share one reminder, which holds how many there are and no file or task.

With Signal connected and Tasks switched on there, the same two notices reach you on Signal: that a task was assigned to you, and that one is due.

Uni

Uni is the assistant, with a page of its own. What it sends to Google’s Gemini API is described under Assistant: your message and the chat so far, and the files, events and parts of files it reads to answer, across your workspace. That includes a payment link’s amount, description, and whether and when it was paid, and a signing request’s title, its signers’ names and email addresses, who has signed and when, and its activity; a request made from an end-to-end encrypted file shows only its kind and numbered signers until you allow Uni to read encrypted files. A reseller link you paste reaches Gemini only as a stand-in, so its keys stay in your browser. A change Uni makes to a shop applies at once, with Undo on its card. Photos, files, videos, audio and links you add to a message are prepared in your browser and sent with it; Uni reads a link’s page only through Uniport, which fetches it without your cookies or address. Uni asks once for your account before reading end-to-end encrypted files; your answer is saved encrypted in your account, and Settings › Privacy can change it. A file whose owner turned Uni off stays off.

Drop a PDF, a photo or a chat export on All files and Uni files it. Your browser reads the file’s text, or draws a scan’s pages as pictures, and sends that to Google’s Gemini API as it does a file you add to a message; Uni asks once before reading files you drop. While it files, Uni can make the record, save the person or company in People and keep the file. It can’t open your other files, change or delete anything else, or send anything. The file you dropped is kept encrypted, as described under Files and folders.

Uniport also sends the words you type in a Uni message, and only those, to TypeSafe AI, which tells Uniport whether the request is a quick change with every value given, so Uni can finish it sooner. TypeSafe runs in the United States. Your files, events, attachments and earlier messages never go to TypeSafe. TypeSafe doesn’t train or fine-tune AI models on them and shares them only with its own service providers. Uniport logs only how the check went and how long it took, never the words, and counts the checks per account to limit abuse.

Your chats with Uni on its page are saved in your account, encrypted in your browser with your account’s key, so they follow you to your devices and Uniport can’t read them. Uniport sees how many chats you have, their sizes and when they change. Deleting a chat deletes it from your account.

API and AI apps

With your API key, programs and AI agents use Uniport’s agent library, uniport.mjs. It encrypts and decrypts on the computer it runs on, with the keys in the links you give it, as your browser does, so Uniport’s server sees what it sees when you use the app.

The Uniport extension for Claude Desktop and the local MCP server (node uniport.mjs mcp) keep your links on your computer: in ~/.config/uniport/links.json, which only your user can read, and links you paste into the extension in Claude Desktop’s keychain. The AI app sees each file’s label and what its tools read from your files, which it handles under its own terms; the links you stored and their keys never reach it or Uniport. A link it makes for you to send, such as a sharing or payment link, reaches it with its key.

An app you connect at uniport.sh/mcp, such as claude.ai or ChatGPT, works through Uniport’s server, which holds no keys: it refuses links to encrypted files and sees only what Uniport Sign and standard documents already show the server. What its tools return, such as a document’s text or a signing request’s signers, goes to that app and its AI, which handle it under their own terms. Uniport stores the app’s name and sign-in addresses, and its tokens only as their SHA-256; it doesn’t give the app your email address. Disconnect in Settings › API keys ends one app’s access, and Sign out all devices ends every app’s.

Uniport counts how many PDFs each account sends for signature from AI apps each month. Uniport emails the signers of such a request their links from uniport.sh in your name, with replies going to your email, and keeps the request’s sender token, encrypted with a key on its server, until everyone has signed, the request is canceled or it closes, then deletes it; with it, Uniport emails you and the signers it emailed once everyone has signed, with the signed PDF attached if your email address is confirmed and a link to it if not. It keeps when each such request was sent and signed for 90 days, to count how many are signed and how fast. A send past the Free plan’s monthly sends waits as a draft at Uniport Sign, and Uniport keeps that request’s sender token, encrypted with a key on its server, until the request is sent or closes, then deletes it. It keeps the request’s title and first signer’s name for the emails about it, deleted with the token, and the dates of each step from connecting an app to Pro, to count how many people reach each one. Stop these emails in such an email ends them for the account.

A signing request a program sends appears in your Signatures: the program encrypts it to a key only your account’s browsers hold, and Uniport keeps that copy until one of them opens it, 30 days at most.

Programs can also invite guests, make booking pages and turn on the subscribe link, with keys that Copy owner link writes into your encrypted calendar; Uniport stores and sends what it does when you use Calendar.

Signal

Connect Signal and Uni sends you the notices you choose. A notice says only what Uniport already knows: that an order or message arrived and in which shop, that a payment came in (and its amount, if you turn amounts on), that a reseller order is ready to ship, that a booking was made and when. It links to Uniport, which opens on your device; what an order contains stays encrypted until you open it there.

Uniport stores your Signal account’s ID and profile name, never your phone number, with the notices you turned on.

Messages between you and Uni are end-to-end encrypted between your Signal and Uni’s Signal server, which reads them to answer. Status questions are answered from what Uniport already knows. Anything else runs in a Uniport tab you have open and unlocked, or opens on your phone, unlocked with your passkey, and runs there. Either way it runs the way Uni runs in Uniport, with your keys, which never leave your devices. A request waiting for you is encrypted so only your devices can open it, and is deleted once it runs or after two hours. A reminder you set on Signal is kept by Uni’s Signal server until it is sent.

Mail

Your Uniport address and its aliases receive mail through Amazon SES in London. Mail from anyone else is sealed on arrival to the key of the address it reached, and we can’t read your stored mail. Your browser makes each address its own key from your account and opens your mail with it; Uniport keeps only their public halves, so no two of your addresses share a key and your recovery key brings your mail back. Before sealing, a message is readable to Amazon Web Services and to Uniport’s server for the seconds sealing takes. One that fails to seal waits in storage in London until a later try seals it, and is deleted within two days either way. Mail that fails the virus check is deleted unread. Mail only between Uniport addresses stays end-to-end encrypted. A message that also goes to an outside address is opened once by Uniport’s server to send it, and leaves Uniport readable, as all email does.

Uniport sees which of your addresses a message reached, and keeps that address with the message, how many each has received, when it arrived, its padded size, its folder, whether it is read or flagged, and the spam, virus, SPF and DMARC results that send it to Spam. Once a message you receive is sealed, Uniport never sees its sender, subject or body. Mail counts toward your space. An address you remove is never given to anyone else. Mail to a plus address (name+tag@) is refused unread.

Senders you block are kept as keyed hashes: Uniport can check whether a sender is blocked, never list who you block, and the list itself is sealed so only your browser shows it. Blocking a Uniport address blocks every address of that account, and its sender isn’t told. Mail from a blocked sender is deleted unread, and so is mail past one sender’s daily allowance; to tell new senders from known ones, Uniport keeps a keyed hash of each sender for 90 days. The keys of Uniport addresses you write to or hear from are pinned in your account, sealed so only your browser reads them. For mail you send outside, Uniport counts how many addresses it went to and how many bounced or reported it as spam, which can pause your sending, and keeps a keyed hash of each address that bounced or reported it so it stops mailing them. Your own domain, its records’ state and the addresses you make on it are kept with your account. File with Uni sends the message or attachment you choose to Uni, read as described under Uni. Uniport sends no email about new mail. With Signal connected and Mail switched on there, the notice says only “New mail”.

On your device

Your browser remembers recently opened files and their complete links. To recover unsaved work after a connection interruption, standard files keep a readable copy on this device and encrypted files keep an encrypted copy. Signing drafts are encrypted on this device with a temporary key kept in the tab’s session. They expire after one hour.

Your assistant chats are kept in this browser for each file and account, the newest 30 per file, with what each change replaced, so Undo still works after the page reloads. They are encrypted with the file’s key in an encrypted file, and with a key kept in this browser for a standard file or a shop. Uniport doesn’t store them; each request sends the chat so far as described under Assistant. Undo, and a request that only asks to undo the latest change, put it back in your browser and send nothing.

Signing out, or “Clear this device” in Settings, removes saved file and signing links, a stopped move’s place, payments owner links, shop carts and order receipts, your display name, assistant consent and chats, local copies and verification sessions, and closes open document sessions in other Uniport tabs on this browser. It doesn’t clear browser history or address bar suggestions, which can contain complete links. If your session ends elsewhere, for example when you sign out all devices or change your password, this browser removes the files it knows are saved to your account when it next checks your session. Files opened while your workspace was locked stay until you clear this device. On shared devices, use a private window or a separate browser profile.

Your choices

Your account and its files stay until you delete them. You can download a file from its File menu, delete any file, revoke any sharing link, disconnect any app in Settings › API keys, clear this device in Settings, and delete your account in Settings › Profile, which deletes its sign-in, sessions, saved file list and the files, shops and payments pages it owns. Copies in database backups expire with the backups. For anything else about your data, write to Support.

Version history

Uniport keeps the newest 40 checkpoints you save. Open an earlier version as a separate copy without changing the shared document. Encrypted checkpoints are created in your browser.