Private from the first capture.

No. Addresses that lead to loopback, private, link-local, carrier-grade NAT or unique-local space are refused, and every redirect is checked again, as is every address a sitemap names. Captures run separately from your request, in a fixed pool with a memory limit.

Yes. Scripts are removed when the page is saved, and archives are shown on an isolated origin with scripts and forms refused, so a captured page cannot read your session or act in your account. The saved file also carries its own rule against network access.

• Passwords are hashed with argon2id at 64 MB, each with its own salt.
• Sessions are stored only as digests, so a copy of the database gives no usable session.
• Authenticator secrets are encrypted at rest.
• Passkeys are bound to our domain, so a look-alike site cannot use them.
• Sign-in and registration are protected by a proof-of-work check, and unknown addresses take as long as real ones.

For each capture, only its SHA-256 fingerprint is sent to DigiCert for the timestamp. Your pages, their addresses and your account details are not shared. What we store and for how long is in the privacy policy.

Yes. Settings lists every signed-in session, and you can end any of them without changing anything else.

Yes, from Settings. You can erase every snapshot and schedule and keep the account, or close the account entirely. Both need your password, and deleting a single snapshot needs it too.