Terms of Service

These Terms govern access to and use of Secretus, including the website, browser extension, APIs, account features, and one-time secret-sharing modes. Read them together with the Privacy Policy and Refund & Cancellation Policy.

Operator

MUNTEANU C. D. MIHAI PERSOANĂ FIZICĂ AUTORIZATĂ, trading as Secretus, ONRC F2026008193001, CUI 53962936, EU VAT (VIES): RO54197611, with its registered address at București, Sector 1, Bulevardul Bucureștii Noi, Nr. 136, Cod poștal 012366, România. Email: support@secretus.app. WhatsApp contact is available through the link in the Contact section below.

Acceptance

You accept these Terms by ticking the legal-acceptance box and creating an account, or by otherwise accessing or using the service. A recipient who uses a share or request link accepts the provisions that apply to that use. If you act for an organisation, you confirm that you have authority to bind it.

Consumers and business users

A consumer is a natural person acting mainly outside their trade, business, craft, or profession. A business user acts for commercial or professional purposes. Clauses expressly limited to business users do not apply to consumers. Nothing in these Terms removes mandatory consumer rights.

Order of documents

A signed Enterprise agreement or Data Processing Agreement (DPA) that is incorporated into a Business customer's order or accepted by an authorised Business customer prevails only for the data-processing subject it expressly covers. Otherwise these Terms apply. Marketing copy, FAQs, and security materials describe the service but do not create guarantees beyond the contract or mandatory pre-contract information.

Minimum age

You must be at least 16 years old and legally capable of entering this agreement. Secretus is not directed to children.

Account access

Accounts may use email/password authentication or Google sign-in through AWS Cognito. Multi-factor authentication may be available or required. You are responsible for your devices, credentials, recovery factors, authenticated sessions, API keys, and activity carried out through your account unless caused by our breach of duty.

Accurate information

You must provide accurate information, keep it current, and must not impersonate another person or organisation or create duplicate accounts to evade product, security, or payment limits.

Security incidents

Notify support@secretus.app promptly if you suspect unauthorised account access, a compromised share link, or misuse of an API key. We may invalidate sessions or credentials where reasonably necessary to protect the service.

Secretus is a transfer tool, not an archive, escrow service, backup, password manager, or guaranteed-delivery service. Keep an independent copy of anything you cannot afford to lose.

Client-side cryptography

Supported secret content is encrypted or divided into shares in the browser. Decryption keys and Team Split share material are placed in URL fragments, which browsers ordinarily do not send to our servers. Endpoint compromise, malicious extensions, copied links, recipient conduct, and an incorrectly compared P2P safety number remain outside that protection.

Standard mode

The browser encrypts content and uploads ciphertext. Our EU-hosted infrastructure stores the ciphertext and delivery metadata until first successful claim, revocation, or the selected expiry (up to 30 days). Claim metadata is invalidated as part of one-time delivery; object deletion is then requested on a best-effort basis and is also covered by a 37-day storage lifecycle backstop. The decryption key remains in the link fragment.

Maximum/P2P mode

Content is transferred over an authenticated WebRTC session and is not stored as a payload by Secretus. Signalling and, where required, TURN relay infrastructure may carry encrypted traffic and process connection metadata. Users must compare the displayed safety number over a trusted independent channel before the sender can transmit. The custom P2P protocol is not represented as a third-party-audited standard protocol or as proof of post-compromise recovery.

Team Split mode

Shamir shares are created and reconstructed client-side. Secretus does not store the shares through the Team Split workflow, but copied fragment links may persist in browsers, messages, logs, or other systems controlled by users. Expiry is enforced client-side and does not erase copies already made elsewhere.

One-time and deletion behavior

Expiry, revocation, invalidation after access, and the inability to recover a missing key are intended features. Network, browser, storage, or third-party failures may prevent delivery or delay physical cleanup. We do not promise that a recipient has not copied content or that every residual backup, cache, or user-controlled copy disappears instantly.

Metadata and network exposure

We process account, security, billing, usage, audit, and delivery metadata needed to provide and protect the service. Peers, internet providers, cloud providers, payment providers, and other intermediaries may observe data within their respective roles. See the Privacy Policy for details.

Technical requirements and interoperability

The web service requires a current browser with JavaScript, Web Crypto, local/session storage, and TLS support. P2P additionally requires WebRTC and a network that permits direct or TURN-relayed connectivity; some enterprise networks, extensions, privacy controls, or old devices may block features. Supported text and files are transferred as encrypted bytes; Secretus does not guarantee compatibility with every browser, assistive technology, file viewer, password manager, or third-party system.

No absolute guarantee

No technical system guarantees absolute secrecy, availability, legal compliance, vulnerability-free operation, or successful delivery. Security descriptions are statements about the documented design and current controls, not warranties against every attack or user error.

Secretus offers subscription plans and may offer separately negotiated Enterprise services. The checkout page shows the final price, billing interval, taxes, renewal terms, and merchant details before you place an order.

Free trial

New accounts may receive a 14-day trial without a payment card. A trial does not automatically convert into a paid subscription. When it ends, paid features require a purchase. The trial is offered once per email address.

Deleting your account during a trial

If you delete your account while a trial is running, any remaining trial days are given up at that moment and are not restored. For 90 days after deletion we keep a one-way cryptographic digest of your email address — not the address itself — so that the same address does not receive a second trial. You may create a new account with that address at any time and use Secretus normally, including on a paid plan; only the free trial is unavailable until the 90 days have passed. The digest is used for nothing else, and is deleted automatically when the period ends. The Privacy Policy explains the legal basis and your right to object.

Merchant of record

Self-serve purchases use Stripe Managed Payments, with Link (Sold through Link, LLC) acting as merchant of record for the transaction. Your statement may show a "LINK.COM*" descriptor. Link/Stripe handles payment collection, applicable transaction taxes, receipts, and payment support under the checkout terms. Secretus remains the provider of the digital service under these Terms.

Subscription and renewal

Paid subscriptions renew monthly or annually, as selected at checkout, until cancelled. You may cancel before the next renewal; access normally continues until the end of the paid period. The Refund & Cancellation Policy explains withdrawal, refunds, and exceptions.

Prices and tax

Marketing pages may show base prices. The checkout displays the total price and applicable VAT, sales tax, or GST before purchase. Price changes apply only to a future billing period after reasonable advance notice; you may cancel before the new price takes effect.

Failed payments and entitlements

Failed or reversed payments may lead to retries, suspension, or loss of paid features after any applicable notice or grace period. Plan, seat, file, expiry, API, audit, and anti-abuse limits may be enforced technically.

Teams

Business-plan team access is derived from the owner's subscription and ends when that subscription ends, a member leaves or is removed, or the team is dissolved. If an owner with two or more members deletes their account, ownership must first be transferred to a selected member. The former owner's subscription is not transferred; the new owner receives a seven-day Business continuity period and must activate their own Business subscription before it ends to maintain paid team access. An owner with one member may delete their account without a successor; that team is dissolved and the member returns to a standalone account. The owner can see limited membership information needed to administer seats.

Order steps, correction, and contract record

Before paying, you can review and correct the selected plan, interval, billing details, price, tax, and total in Stripe's hosted checkout. A paid contract is concluded when the order and payment are accepted and confirmed on a durable medium by Link/Stripe. The receipt and billing portal provide the transaction record; the applicable Terms remain available on this site and may be saved or printed. No consumer deposit is required and we impose no premium-rate communication charge.

Codes of conduct

Secretus is not currently subject to a voluntary code of conduct for this service. This does not affect mandatory professional, consumer, privacy, or platform obligations.

Ownership

As between you and Secretus, you retain rights in content you submit. You grant us only the limited, worldwide, non-exclusive right to host, transmit, secure, and otherwise process encrypted content and associated metadata as technically necessary to provide, protect, and comply with law in relation to the service. This permission ends when the relevant processing lawfully ends.

Your responsibility

You decide what to share, with whom, and under what lawful basis. You must have all rights, notices, consents, and authorisations needed for content and recipient data and must use an appropriate channel for the risk involved.

Prohibited content and conduct

You must not use Secretus for malware, phishing, credential theft, fraud, extortion, harassment, exploitation of children, unlawful surveillance, intellectual-property infringement, unlawful disclosure of personal data, sanctions evasion, or any content or conduct prohibited by applicable law.

Technical misuse

You must not disrupt or overload infrastructure, bypass access or rate limits, scrape abusively, probe or exploit systems without written authorisation, introduce malicious code, misrepresent origin, or use the service to attack users or third parties.

Sensitive and regulated uses

Do not rely on Secretus as the sole control for emergency, life-safety, medical, financial-market, classified, export-controlled, or other use requiring a specific certification, regulated repository, guaranteed retention, guaranteed recovery, or binding SLA unless a signed agreement expressly supports that use. You remain responsible for sector-specific compliance.

Export and sanctions

You must comply with applicable export-control, trade-sanctions, and embargo laws and must not use the service where doing so would cause us or a provider to violate them.

Because Standard mode temporarily stores user-provided ciphertext, we provide an electronic notice channel. Encryption may limit our ability to assess content without information supplied by the notifier or a lawful authority.

Notice channel

Send notices concerning allegedly illegal content to legal@secretus.app. Include the exact Secretus URL or identifier, a sufficiently substantiated explanation of why the content is illegal, your name and email except where law permits anonymity, and a good-faith statement that the information is accurate and complete. Do not include unnecessary sensitive data or the decryption key unless legally necessary.

Handling

We assess sufficiently precise notices in a timely, diligent, objective, and non-arbitrary manner. We may request clarification, preserve legally required evidence, disable access, remove ciphertext, restrict an account, or decline action where the notice is insufficient or the content is not shown to be unlawful.

Reasons and challenge

Where applicable and legally permitted, we provide affected users a statement of reasons and a way to challenge a restriction by contacting the legal address. We may withhold details where disclosure is prohibited, creates a security risk, or would facilitate abuse.

No general monitoring

We do not undertake a general obligation to monitor plaintext content. We may use metadata, rate limits, reports, and other proportionate measures to enforce these Terms and comply with law.

Availability

We aim to operate Secretus securely and reliably, but may patch, maintain, rate-limit, modify, suspend, or discontinue functions for technical, security, legal, capacity, or commercial reasons. Interruptions may be planned or unplanned.

No uptime commitment

Unless a signed Enterprise agreement expressly says otherwise, there is no guaranteed uptime, response time, resolution time, data-recovery objective, performance level, or service credit.

Support is best effort — no SLA

Operational email and WhatsApp support is provided on a reasonable, best-effort basis. We do not guarantee that we will respond or resolve an issue within any particular time. "Priority support" means reasonable queue prioritisation, not a contractual SLA. Only a separately signed Enterprise agreement can create a binding SLA. This does not alter a statutory deadline for refunds, privacy-right requests, illegal-content notices, incidents, or consumer remedies.

Third-party dependencies

The service depends on providers including AWS, Google, Stripe, and Link. Their outages, policies, or lawful restrictions may affect Secretus. We remain responsible to the extent required by mandatory law and will use reasonable care in selecting and managing providers within our control.

Force majeure

We are not responsible for delay or failure caused by events beyond our reasonable control, including major network or cloud failures, attacks, labour disruption, natural disaster, war, epidemic, governmental action, or widespread utility failure, provided this does not limit rights that mandatory law makes non-excludable.

Our materials

Secretus software, branding, interface, documentation, and site content are owned by us or our licensors and protected by applicable law. Open-source components remain subject to their own licences.

Limited licence

We grant you a limited, non-exclusive, non-transferable, non-sublicensable right to use the service during the contract for its intended purpose and in compliance with these Terms.

Feedback

You may provide feedback voluntarily. You permit us to use it without restriction or payment, but you do not transfer ownership of your confidential information or pre-existing intellectual property.

By you

You may stop using Secretus, cancel a subscription, or delete your account through the available controls. Account deletion may immediately cancel a subscription, revoke API keys, and remove the active profile and sign-in account. For a team with two or more members, the owner must first transfer ownership; the successor receives seven days to activate an independent Business subscription, while the former owner's subscription is cancelled and is never transferred. A team with one member is dissolved on owner deletion and that member becomes standalone. Account deletion does not erase records that must be retained or encrypted payloads already subject to their expiry and cleanup cycle.

By us

We may restrict, suspend, or terminate access for material breach, non-payment, security risk, illegal activity, repeated abuse, provider or legal requirement, or to protect users and infrastructure. Where appropriate and safe, we give notice and an opportunity to cure. Serious, urgent, repeated, or unlawful conduct may justify immediate action.

Service modifications

We may update features, limits, security controls, or providers for valid technical, security, legal, or commercial reasons. For a paid consumer digital service, we will not make a modification beyond what is necessary to maintain conformity if it materially and adversely affects access or use without the notice, continued-access, termination, refund, or other remedies required by mandatory law.

Discontinuation

If we discontinue a paid service before the end of a prepaid term, we will give reasonable notice where practicable and provide any refund or remedy required by applicable law. You are responsible for exporting account records made available to you before closure.

Survival

Payment obligations already due and provisions concerning intellectual property, liability, disputes, confidentiality, and any terms that by nature should survive continue after termination.

Conformity

Consumers are entitled to a digital service that conforms to the contract and to mandatory updates, remedies, and information under applicable consumer law. Depending on the circumstances, remedies may include bringing the service into conformity, a proportionate price reduction, or termination and reimbursement.

Withdrawal and cancellation

EEA consumers may have a 14-day statutory withdrawal right for distance contracts. The online function at https://secretus.app/withdrawal is available after sign-in to identify the contract securely; an unequivocal email to billing@secretus.app is always an alternative. The Refund & Cancellation Policy explains the period and process. The function accepts the statement without requiring a reason and provides a time-stamped confirmation that can be retained. Contractual cancellation rights may be more generous and do not reduce statutory rights.

Complaints and ADR

Contact support@secretus.app first if you want us to resolve a complaint. Romanian consumers may also use the ANPC alternative dispute resolution system at https://reclamatiisal.anpc.ro/. Use of ADR is voluntary unless mandatory law says otherwise, and the discontinued EU ODR platform is not presented as available.

Service basis

Subject to mandatory law, the service is provided "as is" and "as available". We do not warrant that every feature will always be available, error-free, secure against every threat, or suitable for a particular regulatory purpose not expressly agreed in writing.

Business-user exclusions

For business users, to the maximum extent permitted by law, neither party is liable for indirect or consequential loss, loss of profit, revenue, business opportunity, goodwill, anticipated savings, or data, except where the loss forms part of a third-party claim covered by an express indemnity.

Business-user cap

For business users, our aggregate liability arising from the service in any 12-month period is limited to the fees paid or payable for the affected service in that period. If the service was free, the cap is EUR 100. This cap does not apply where liability cannot lawfully be limited.

Consumer standard

For consumers, we are responsible for loss caused by our breach where that loss was foreseeable when the contract was made, subject to mandatory law. We are not responsible for business losses suffered by a consumer or for loss caused by the consumer's misuse, compromised endpoint, disclosed link, ignored warning, or failure to keep a necessary copy, to the extent we did not cause or contribute to it.

Non-excludable liability

Nothing excludes or limits liability for fraud, fraudulent misrepresentation, wilful misconduct, death or personal injury caused by negligence, breach of obligations that data-protection or consumer law makes non-excludable, or any other liability that cannot lawfully be limited. Nothing limits a data subject's statutory rights or a supervisory authority's powers.

Business-user indemnity

If you are a business user, to the maximum extent permitted by law, you will defend, indemnify, and hold harmless MUNTEANU C. D. MIHAI PERSOANĂ FIZICĂ AUTORIZATĂ, trading as Secretus, its owner, and its personnel from and against third-party claims, demands, proceedings, judgments, settlements, losses, liabilities, damages, and reasonable external costs and legal fees, together with fines or penalties only to the extent they are lawfully indemnifiable, arising out of or related to: (a) your use or misuse of the service; (b) your breach of these Terms or applicable law; (c) any secret, text, file, audio, personal data, recipient information, instruction, or other material you submit, transmit, request, or process without the rights, notices, consents, authorisations, or lawful basis required to do so, including a claim involving intellectual-property, privacy, confidentiality, data-protection, or other third-party rights; (d) malware, phishing, credential theft, fraud, extortion, unlawful surveillance, or unauthorised access, probing, testing, or attack carried out by or for you; or (e) your violation of a third party's rights. This obligation applies only to the extent the claim or loss was caused by your act or omission and does not apply to the extent caused by our breach, negligence, wilful misconduct, or unlawful act.

Business-claim procedure

We will give reasonable notice of an indemnified claim; delayed notice relieves you only to the extent it materially prejudices the defence. At our option, we may assume exclusive control of the defence with counsel reasonably selected by us, and you will provide reasonable information and cooperation at your cost. You may not settle a claim in a way that admits fault by us, imposes an obligation on us, fails to provide us an unconditional release, or affects our rights without our prior written consent, which will not be unreasonably withheld. We may participate in a defence with our own counsel.

Consumers

If you are a consumer, the business-user indemnity and duty to defend above do not apply to you. You remain responsible under applicable law for direct harm caused by your intentional, fraudulent, or unlawful misuse of the service or your violation of another person's rights. These Terms do not create strict liability, require a disproportionate payment, transfer our legal responsibilities to you, or make you responsible for a loss you did not cause. Any reimbursement, legal cost, fine, penalty, or damages claimed from a consumer is recoverable only where, and to the extent, permitted and determined under applicable mandatory law. We retain the remedies that applicable law provides against deliberate or unlawful abuse.

Mandatory rights and external claims

This section allocates responsibility only between the contracting parties. It does not restrict a third party, data subject, regulator, or public authority from exercising a statutory right or power; reduce our duties under consumer, data-protection, or other mandatory law; or exclude liability that cannot lawfully be limited. The business-user indemnity and liabilities already accrued under applicable law survive termination.

Applicable law

Romanian law governs these Terms. If you are a consumer habitually resident in another country, this choice does not deprive you of protections that cannot be excluded under the law that would otherwise apply.

Good-faith resolution

Before starting court proceedings, either party should send a written description of the dispute to legal@secretus.app and allow 30 days for good-faith discussion, unless urgent relief is needed. This voluntary step does not suspend or shorten a statutory limitation period or prevent a consumer from using mandatory remedies.

Courts

For business users, the courts competent for Bucharest, Romania have exclusive jurisdiction, unless a signed Enterprise agreement states otherwise. Consumers may bring claims in any court available under mandatory consumer-jurisdiction rules and are not restricted to Bucharest.

Updates to these Terms

We may update these Terms for legal, security, technical, provider, or product reasons. We will publish the new text and effective date. For material changes affecting registered users, we will provide reasonable advance email or in-product notice where practicable and obtain renewed acceptance where required. Changes do not retroactively alter accrued rights.

Assignment

You may not assign this agreement without our consent. We may assign it as part of a sale, reorganisation, or transfer of the service, subject to applicable notice and consumer rights and without reducing mandatory data-protection obligations.

Severability and no waiver

If a provision is invalid, it is enforced to the maximum lawful extent or severed, and the remaining provisions continue. A delay in enforcing a right is not a waiver.

Entire agreement

These Terms, the Privacy Policy, Refund & Cancellation Policy, and any signed order, Enterprise agreement, or DPA constitute the agreement for their respective subjects and supersede prior promises about them.

Language

The service, these Terms, and the core consumer policies are offered in English only. The English text is the controlling version. This language choice does not waive or reduce any mandatory consumer right.

For personal-data processing, see our Privacy Policy.

For cancellation and refund details, see our Refund & Cancellation Policy.