Home › Guides › How Cluerow links work

How Cluerow links work

Cluerow has no server-side storage for transaction data. The transactions you ask about travel inside the link itself, encrypted, and the answers travel back the same way. Here is exactly what that means, including the limits.

What's in a question link

A link looks like https://cluerow.pages.dev/r/v1#…. Everything after # is the fragment. Browsers don't send the fragment to the website when they load a page, so our server receives only /r/v1. The fragment holds:

• a random 256-bit key created in your browser for this request, and
• the request itself, compressed and encrypted with AES-256-GCM using keys derived from that random key (HKDF-SHA-256): your name, the client's name, your message and due date, the category labels, and for each transaction its date, description and amount.

Your account names, account codes and bank account names are not in the link. A checksum at the end lets the page tell a link that was cut off apart from one that was altered.

Who can open it

Anyone who has the link can open it. The key travels with the data, so the encryption protects against our servers and logs, not against someone who receives or intercepts the link. That includes email providers, company email security tools that scan links, and anyone your client forwards the email to. Treat the link like an email that contains the same transactions. Don't put anything in it you wouldn't put in an email, and ask clients not to forward it.

How answers come back

When the client taps “Send answers”, their browser encrypts the answers with a key derived from the request key and creates a reply link (/a/v1#…) or a small .cluerow file. The reply doesn't contain the key. Your browser kept it when you created the request, so the reply opens in your Cluerow app (or anywhere you've imported your backup). The reply can also be read by someone who has both the reply and the original question link.

Why links are split at about 30 transactions

Older desktop versions of Outlook cut links longer than 2,084 characters; newer builds accept 8,192. Since you can't know which version a client uses, Cluerow aims for links under about 1,800 characters, which leaves room for link-scanning services that wrap the URL. That is usually about 30 transactions. Larger requests become several links (“link 1 of 3”), and any link that would still be too long is split again. If you know your client uses current email apps, you can choose larger links of up to 100 transactions.

Email link scanners and “%23”

Some link scanners, such as Microsoft Defender Safe Links, have been reported to re-encode the # as %23 or %2523. The browser then treats the encrypted part as part of the page address and sends it to the website. Cluerow repairs these links in the browser so they still open, and shows the client a note that it happened. Our own code doesn't run for these addresses and our usage counter doesn't record them, but our hosting provider processes them like any page request. If a client's email system strips the part after # entirely, the page says so; send the link by text message instead.

What the client page does and doesn't do

• Shows text only: no images, no clickable links and no formatting from the request.
• Labels every free request “Sender not verified” and warns never to enter passwords, card numbers or bank account numbers. It warns when a note looks like a card number.
• Saves answers in the client's browser as they type (for up to 30 days), so they can come back later.
• Doesn't use cookies, analytics or third-party scripts, and doesn't send answers anywhere by itself. The client chooses to email, share or download the reply.