# Armadoc

> Secure document sharing service that lets users send private files via expiring, end-to-end encrypted links — without requiring recipients to create an account.

Armadoc solves a recurring friction in personal and professional document sharing: email was never built for sensitive files — an attachment is copied across every mail server between sender and recipient, sits unencrypted in inboxes indefinitely, can be forwarded to anyone, and offers no way to expire it or verify who opens it. Cloud-storage tools are built to store files, not send them — a shared document sits in a drive the provider can read until the sender remembers to revoke it, and the secure way to share pulls the recipient into an account they never wanted. Armadoc lets the sender share securely while the recipient simply receives — verification is handled via a one-time code sent to email or phone, and the file decrypts in their browser. After the link expires, the file is automatically and permanently deleted.

## Why email isn't safe for sensitive files

Email is the default way most people send documents, and it is the wrong tool for anything private:

- **Stored in the clear**: attachments rest unencrypted on every mail server they pass through — servers the sender and recipient neither see nor control.
- **They never expire**: once sent, a copy lives in every inbox and backup indefinitely. The sender cannot take it back or make it disappear.
- **Anyone can forward it**: nothing verifies who actually opens the file, and nothing stops it from being passed on to an unintended party.

Armadoc closes each gap: files are encrypted in the browser before upload, every recipient is verified with a one-time code, and the encrypted file is permanently deleted when the link expires.

## Core pages

- [Homepage](https://armadoc.link/): Product overview, six-step walkthrough, pricing, and FAQ. Tagline: "Send a file only they can open."
- [How it works](https://armadoc.link/how-it-works): Three-step send flow, the lockbox model, and the two ways to share. Tagline: "Send anything. Worry about nothing."
- [Security](https://armadoc.link/security): End-to-end encryption explained, key custody, passwordless sign-in, what Armadoc can and cannot see, four-layer protection model, and where files live. Tagline: "Privacy isn't a setting. It's the product."
- [Privacy](https://armadoc.link/privacy): Privacy policy in plain English — what is collected and why, sub-processors, retention schedules, and how to exercise access/correction/export/deletion rights.
- [Terms](https://armadoc.link/terms): Terms of service in plain English — account rules, plan and billing terms, acceptable use, abuse reporting, disputes, and the lawyer-grade disclaimers.
- [About](https://armadoc.link/about): Origin story, why the product is built by a single person, and the founder's on-record commitments. Tagline: "Built by one person — because the fewer hands on your private files, the better."

## How it works

The product flow is described in two complementary forms:

- **Six clicks from your file to their screen** (homepage walkthrough): drop in your file → add the recipient → set how long it lives → send the secure link → they verify their identity → you get notified when they open it.
- **Three steps** (how-it-works page): sign in with email or phone (no password) → choose a file and a recipient → they open it.
- **The lockbox model**: the sender seals the file on their device using a lock that fits only the recipient's key. Armadoc carries the sealed package across the room but cannot see what's inside and does not hold the key.

### Two ways to share

- **Send to anyone**: if the recipient is new to Armadoc, they tap the invite link, sign in, and set up their own lock. Once their lock exists, the file is sealed for them and delivered.
- **Send to a contact**: if the recipient is already on Armadoc, their lock is already on file. The sender seals and delivers instantly.

## Core capabilities

- End-to-end encryption: files are encrypted in the sender's browser with a one-time symmetric key, which is then sealed with the recipient's public key; only the recipient's private key — which never leaves their browser — can unseal it. The server never holds a key that can decrypt the file.
- Per-account keypair: every account has its own lock (public) and key (private). The private key never leaves the device, and is never stored or transmitted by Armadoc.
- Recipient verification: a 6-digit one-time code sent to email or phone proves the recipient's identity on every access. No account required on the receiving end.
- Passwordless sign-in for senders: one-time codes via email or SMS — no long-lived passwords stored anywhere, hashed or otherwise. Codes expire quickly to prevent guessing.
- Device/key loss: the private key lives only on the device and is never escrowed, so it cannot be recovered. Signing in on a new device lets the user reset to a fresh keypair; files sent to the old key can no longer be decrypted, so after resetting the user is reminded to ask senders to re-send anything still needed. The account itself is unaffected.
- Self-destructing links: the encrypted blob is permanently deleted from storage when the share expires — no archive, no trash folder, no recoverable copy.
- Single-use, short-lived download links protect the encrypted blob during retrieval.
- Read-receipt notifications: sender is notified when the recipient decrypts and views the file (Pro plan only).
- Supported file formats: PDF, XLS/XLSX, DOC/DOCX, JPG, PNG, HEIC.

## What Armadoc can and cannot see

**Cannot see**: file contents, private keys, decrypted previews/thumbnails/text, or a password (the system doesn't use one).

**Does see**: the recipient identifier (email or phone), basic file metadata such as the filename the sender chose and the optional description, the timestamps when a share was created and opened, and the sender's email or phone for sign-in purposes. The description is optional and can be left blank; if a filename is itself sensitive, the security page advises renaming it before sending.

## Pricing

- **Free** ($0/month): 5 sends per month, 1 file per send, 10-day automatic expiry, end-to-end encryption, supported file formats listed above.
- **Pro** ($5.99/month): 25 sends per month, up to 15 files per send, custom expiry from 1 to 30 days, read-receipt notifications, everything in Free.
- Pro is billed monthly in US dollars and auto-renews until cancelled. Cancellation takes effect at the end of the paid period; no refunds for partial billing periods. No free trial — the Free tier serves that purpose.

## Use cases

Armadoc is designed for any scenario where a sensitive file changes hands and email feels inappropriate. The homepage groups these as:

- **Freelancers**: signed contracts to clients, invoices and receipts, final assets without Dropbox links.
- **Accountants and bookkeepers**: requesting and receiving tax documents, sending returns to clients, exchanging financial statements.
- **Small businesses**: employment paperwork, NDAs and term sheets, sensitive vendor documents.
- **Healthcare and legal**: sharing records with verified parties, delivering case files with audit trails, avoiding email-based PHI exposure.
- **Real estate**: disclosures and inspections, buyer financials, closing documents without portal logins.
- **Independent landlords**: receiving W2s, tax returns, and pay stubs from prospective tenants, and sending leases to renters they may never meet in person.
- **Anyone, really**: passport scans to family, medical records to a parent, any personal paperwork where email feels wrong.

## Security and privacy posture

- All files encrypted in transit (TLS) and at rest.
- Decryption keys never touch Armadoc servers — full end-to-end encryption.
- No administrative access to file contents (Armadoc engineers and admins cannot read what users send; this is enforced by architecture, not policy).
- Automatic, unrecoverable deletion after link expiry (no archive, no trash folder).
- Identity verification on every recipient access via email or phone OTP.
- One session cookie for sign-in; no third-party analytics, advertising pixels, or cross-site trackers.
- IP addresses are retained only briefly against rate-limit windows, then automatically purged. Cloudflare sees request IPs as part of edge routing.
- Operational logs contain no personally identifiable information and are rotated every two weeks.
- Sub-processors are limited to AWS (US hosting, storage, transactional email, logging), Cloudflare (edge networking and request validation), and Stripe (Pro-plan billing only — card data never touches Armadoc servers).
- All application data is stored in the United States; EU/UK transfers are covered by the standard contractual clauses Stripe and AWS already maintain.
- On HIPAA, GDPR, and similar compliance regimes: **Armadoc is not formally certified under any of these regimes, and no BAA is in place.** That said, the architecture (end-to-end encryption, verified recipients, automatic deletion, no admin access) reflects the same principles those frameworks care about around data minimization and access control.
- Privacy rights (access, correction, export, deletion) honored regardless of jurisdiction; GDPR, CCPA/CPRA, and similar laws explicitly acknowledged on the privacy page. Deletion requests are processed manually within seven business days.

## On-record commitments

Armadoc publicly commits, on the About, Privacy, and Terms pages:

- Never to train machine-learning models on user files.
- Never to sell, share, or rent user data, contact lists, or usage patterns. There is no advertising business beneath the product.
- Never to add a server-side preview feature that requires decrypting user files. The encryption boundary stays where it is.
- Never to quietly weaken these guarantees as the product grows.

## Legal posture

- Operator: Waimun Inc., New York, NY (United States).
- Eligibility: 18 years or older; one account per person.
- Governing law: State of New York; the UN Convention on Contracts for the International Sale of Goods does not apply.
- Dispute resolution: 30-day informal resolution period (email hello@armadoc.link) before filing. If unresolved, disputes are filed in state or federal courts in New York County.
- No class actions or representative proceedings — claims must be brought individually.
- Liability cap: greater of fees paid to Armadoc in the prior 12 months or $100 US dollars.
- Service is provided on an "as-is," best-effort basis. No SLA.
- Material changes to the Terms or privacy policy are announced by email before the effective date.

## Contact

- General, privacy, deletion, correction, or security reports: hello@armadoc.link
- Abuse reports: abuse@armadoc.link

The reply comes from the same person who builds and maintains the service.

## Origin

Armadoc is built and maintained by Waimun Yeow, an independent software engineer based in New York with fifteen years of experience across healthtech, edtech, and financial services. The product began as the secure-sharing tool he wished existed for his own paperwork: end-to-end encrypted, recipient verified by a one-time code, no signup required on the receiving end, and gone from the servers when the link expires. Armadoc is funded entirely by Pro subscriptions — no investors, no acquisition target, no growth team optimizing for engagement metrics.