readme

README.md

@@ -1,10 +1,108 @@
 ---
 title: Paper
-emoji: 🏃
-colorFrom: gray
-colorTo: yellow
+emoji: 📝
+colorFrom: purple
+colorTo: pink
 sdk: docker
 pinned: false
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Paper ✨
+
+A minimal, secure notepad for temporary notes. Zero tracking, zero accounts — just encrypted notes.
+
+## Features
+
+- 🔐 **Client-side encryption** — Your password never leaves your browser
+- 🗑️ **Auto-delete** — Notes removed after 2 days of inactivity
+- 🌐 **Access anywhere** — Same password = same note, from any device
+- 🚫 **No tracking** — No cookies, no analytics, no accounts
+
+## How It Works
+
+```
+┌─────────────────┐         ┌─────────────────┐
+│     Browser     │         │     Server      │
+├─────────────────┤         ├─────────────────┤
+│                 │         │                 │
+│  Password ──────┼─► SHA-256 Hash (16 char)  │
+│        │        │         │        │        │
+│        ▼        │         │        ▼        │
+│  PBKDF2 Key     │         │  File ID        │
+│  (250k rounds)  │         │  (no password)  │
+│        │        │         │                 │
+│        ▼        │         │                 │
+│  AES-GCM        │         │                 │
+│  Encrypt/Decrypt│◄───────►│  Store/Load     │
+│                 │         │  Encrypted Blob │
+└─────────────────┘         └─────────────────┘
+```
+
+**Key points:**
+- Password → PBKDF2 → AES-256-GCM key (client only)
+- Password → SHA-256 → File identifier (sent to server)
+- Server stores only: encrypted content + random salt
+- Server never sees: password or decrypted content
+
+## Architecture
+
+```
+Paper/
+├── index.html      # Single-page app (HTML + CSS + JS)
+├── main.py         # Flask backend
+├── Dockerfile      # Container setup
+└── requirements.txt
+```
+
+### Frontend (`index.html`)
+- Single HTML file with embedded CSS and JavaScript
+- Crypto API for AES-GCM encryption and PBKDF2 key derivation
+- Auto-save with debounce (1.5s after typing stops)
+- Dark theme with colorful accents
+
+### Backend (`main.py`)
+- Flask server with CORS support
+- Two endpoints: `/api/load` and `/api/save`
+- File-based storage (configurable via `DATA_DIR`)
+- Auto-cleanup: files older than 2 days or when storage exceeds limit
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `DATA_DIR` | `/tmp` | Storage directory |
+| `AGE_LIMIT_DAYS` | `2` | Days before auto-delete |
+| `MAX_TOTAL_SIZE_MB` | `100` | Max storage size |
+| `MAX_CONTENT_SIZE_MB` | `10` | Max note size |
+
+## Run Locally
+
+```bash
+# Install dependencies
+pip -r requirements.txt
+
+# Start server
+python main.py
+```
+
+Open http://localhost:7860
+
+## Deploy
+
+### Docker
+```bash
+docker build -t paper .
+docker run -p 7860:7860 paper
+```
+
+## Security Notes
+
+- All encryption happens in your browser
+- Password is never transmitted or stored
+- Server cannot decrypt your notes
+- Use a strong, memorable password
+- No password recovery possible
+
+## License
+
+MIT