Private Notes: Send One-Time Messages by Email

Private Notes creates an encrypted message and gives you a link to share by email. The recipient reads it in a browser without signing up. Use it for a password, a private detail or the text of a longer email.

Create and send a private note

1. Open Tools → Private Notes. Guests complete a security check before entering the message.
2. Enter 1–4,000 characters. A blank message is not accepted. Notes support plain text; formatting, files and clickable links are not included. Code is shown as text and does not run.
3. Open Note settings. Choose one reading or repeated access until a time limit. The available expiry periods are 1 hour, 24 hours and 7 days; your account may offer a shorter maximum.
4. Keep opening confirmation enabled for email. It helps stop link previews and security scanners from using the note before the recipient.
5. Add a password if needed, then select Create private link. Copy the complete link into your email. Share the password through a different channel.

For a one-time note, the link stops working when the message is retrieved. A timed note can be reopened until its expiry or revocation. If the first opening fails after retrieval, a one-time note cannot be restored.

Add a note from webmail

In the full composer, select Private note beside the send controls. For an inline reply, use Pop out first.

Private part keeps your ordinary email and adds a note card before the signature. Entire email body moves the authored text and current quoted reply into a plain-text note. The subject, recipients, attachments and required domain signature stay in the email. The usual free-account footer still applies. Converting a saved draft cannot erase older copies.

Preview opens a neighbouring tab without using the real note. Keep the sender tab open: reloading it loses the temporary preview text. Edit settings can change confirmation, the receipt preference, the reference name or a shorter expiry. To change text, password or deletion mode, create a new note and revoke the old link. Remove removes the card from the draft; it does not revoke the link.

Before sending or scheduling, check that the note will still be available. An opened, expired or revoked note must be recreated. Keep the scheduled send time before expiry.

What the privacy protection means

Your browser encrypts the note before uploading it. The note service receives encrypted text. Email providers can see the complete link. Without a separate password, someone who has that link can read the note. Use a separately shared password when the email itself must not be enough to open it.

The subject, addresses and ordinary attachments remain visible in email. A recipient can copy or screenshot the note. Deleting it from the service does not erase those copies. Keep the reader page open until you finish; refreshing it loses the information needed to reopen the message.

Receive a deletion notification

Sign in and verify your account email, then enable Email me when the note is deleted. Notifications go only to your own verified account address, never an address entered for someone else. Signing in with only a mailbox password does not enable this option.

The notification reports opening and deletion, expiry or revocation. It does not identify the reader or prove they read the message. You may add a reference name of up to 80 characters to recognise the note; keep secrets out of it. The notification contains no message text, password or share link. Delivery is best effort. You can manage these emails in notification preferences.

White Label and automation

A White Label note opens on the brand’s webmail domain with its name, logo and colours. The reader does not promote TrekMail or link to a creation page the brand has not published. Administrators can disable notes or receipts and shorten expiry; domain rules cannot relax account limits.

API and MCP let an authorised app or agent create notes, inspect their status, edit settings and revoke links. Creating a note does not send an email: sending still uses the normal email permissions. Each connection manages its own notes. The optional reference below is for developers; you do not need it to use the tool.

import { encryptNote } from '@trekmail/mcp-server/private-notes';
const { envelope, fragment } = await encryptNote(text, separatePassword);
// POST /api/v1/private-notes
const input = {
  envelope, policy: 'once', expires_in: 86400,
  confirm_open: true, notify_self: false,
  idempotency_key: crypto.randomUUID(), domain_id: allowedDomainId
};
// After creation: const shareUrl = result.data.reader_url + '#' + fragment;