Captured markup is treated as hostile input.

A service that fetches addresses on request and later shows the result in your browser has two problems to solve: it must not become a way into our network, and a captured page must not be able to act inside your account.

Outbound: what we will fetch

Loopback, private, link-local, carrier-grade NAT and unique-local addresses are refused.
Every redirect hop is screened again, not just the address you typed.
Addresses named by a sitemap get the same check before they are queued.
Captures run away from your request, in a fixed worker pool under a memory cap.

Inbound: what an archive may do

Captured markup is served on an opaque origin, with scripts and forms refused.
Scripts are stripped at capture, and the saved file carries its own policy against network access.
An archive cannot read a cookie from your session.
Preview images are served the same guarded way.

Three ways to sign in, none of them a password alone

Emailed code

The default

Your password, then a six-digit code sent to your address. Five attempts per code.

Authenticator app

No mailbox involved

Any standard app. Ten single-use recovery codes, and no emailed fallback to weaken it.

Passkey

No password, no code

A fingerprint, face or device PIN. Bound to our domain, so a look-alike site cannot use it.

Behind the sign-in page

argon2id password hashing at 64 MB, with a unique salt.
Session tokens stored as digests, so a copy of the database yields no usable session.
Sessions listed in Settings, each revocable on its own.
Proof-of-work on sign-in and registration, solved by the page itself.

Authenticator secrets encrypted at rest.
No account enumeration. Unknown addresses take as long as real ones.
Every query scoped to its workspace, and every change checks your role.
Deleting takes your password and is rate limited.

Nothing is public

Storage is private and no signed URL is ever handed out. Every file streams from behind a signed-in session, so a link to an archive is worthless to anyone outside the workspace, unless you send them a share link that expires.

Timestamps send a digest only. The authority never sees the page, its address or you.
Leaving is self-service. Erase every snapshot, or close the account, from Settings.
What we store and for how long is set out in the privacy policy.