What this can and cannot do
A tool that oversells itself is worse than one that is plain, so this is the whole picture. The second list is not an appendix to the first. It is the same size on purpose, because the things a system cannot do are usually what decides whether you should be using it at all.
What holds
Each of these is a property of how the thing is built, rather than a policy that somebody has to remember to follow.
Every version is a separate, permanent copy
Publishing writes new copies and then moves a pointer to them. It never edits a file in place. A reader who is part way through a download can never be handed two versions spliced together, and the author's most ordinary gesture, overwriting the document, cannot break a link that has already been handed to a reader.
The redirect is temporary, deliberately
Your link resolves through a redirect that browsers are told not to cache, and it is never a permanent one. A permanent redirect is cached by a browser essentially forever, which would quietly weld a reader to whichever version they happened to open first and keep them there.
The secret in your link is never sent to a server
It sits after the # in the address, and browsers do not transmit that part of a URL. It appears in no request that a server or an intermediary could see, and neither does the name of the document it opens.
Nothing about a reader is recorded
The service stores one field per reader: a nickname the author typed. The code that answers your request holds no permission to write a log at all, and the network in front of it has request logging switched off, so an unexpected error fails silently rather than writing your address into a file somewhere. There is no counter behind any of this, no read receipt, and no analytics of any kind at any point in the process.
One link per reader, and it can be switched off alone
Revoking deletes a single record. No shared password is rotated, and nobody else's link stops working. That is the whole reason each reader gets their own link instead of one link being passed around.
Revoking also closes the copies already opened, within fifteen minutes
While you read, your browser holds a short pass that the network checks on every request for document content. The pass says only when it expires, so every reader holding one at the same moment holds identical bytes and it can never turn into an identifier. It lasts fifteen minutes and is renewed only while a reader is still authorized, so revoking someone stops the renewals and the versions they had already opened stop opening too.
A wrong link, a malformed one, and a revoked one get the same answer
The same status, the same headers, the same empty body. A link cannot be used to find out whether a document exists, whether it once existed, or whether it was taken away from you specifically.
A download is checked against its own fingerprint before it opens
The document publishes the exact fingerprint of its PDF, and the page compares the bytes it received against it before handing you the file. A corrupted or substituted copy fails outright, rather than opening quietly and looking entirely correct.
What is not true, said with the same weight
Nothing in this list is coming later. Each one is the shape of the design rather than a gap somewhere in it.
Nothing expires
A link works until somebody deliberately revokes it. There is no countdown anywhere in this system, no timer running against your link, and no surface here will ever tell you one is about to run out, because none of them do.
A forwarded link works
Whoever holds a link reads what its reader could read. Forwarding is not detected and is not prevented. The answer is that the author can switch off that one link afterward, which is containment after the fact rather than prevention, and the difference matters.
A file you downloaded cannot be recalled or updated
Once a copy is on your device it is frozen and it is yours. No web application can reach back for it, on any phone, and no future version of this one will be able to either. That is why the version is in the filename and on the first page, and why the download control tells you all of this before you press it.
Sending a link through a chat application discloses it to that application
Messaging clients fetch a URL to build a preview card. The card they get back carries no title, no excerpt, and no content, but the application has seen the address. This is a real limit of every link-based system and it is named here rather than quietly accepted.
Your link is in your own browser history
And in browser sync, clipboard managers, and chat backups, if you use them. Nothing on this side can reach into any of those, and a link that leaks through one of them leaks completely.
The author cannot tell whether you read it
This is not a read receipt being politely withheld. Nothing is recorded, so there is nothing to show anyone, including the person who wrote the document. If you want them to know that you read it, you will have to be the one who tells them.
There is no offline reading, no search, no comments, and no version history to browse
Absent on purpose rather than pending. Offline reading is the interesting one: the risk it carries is serving a reader a stale document with no way to tell, which is the exact failure this whole design exists to refuse, so it does not get added until it can announce its own staleness.
What your own browser keeps
All three stay on your device and none of them is transmitted anywhere. Clearing this site's data in your browser removes every one.
The fifteen-minute pass
A cookie scoped to this site alone, holding an expiry time and a signature over it. There is nothing in it that identifies you or the device you are on.
Which update notices you dismissed
So the same offer does not come back every ninety seconds once you have already declined it.
Any PDF you downloaded through the page
Kept so a second download does not have to fetch it again, and checked against its published fingerprint every time it is used.
What no web application can do
True of this one, and true of every web application you will ever open.
Vouch for the code it just served you
The page that reads a document comes from the same place the document does. A compromised server could serve different code, or a different document. Content addressing means a copy you already hold can be checked against its own published fingerprint, but nothing can vouch for a version you have never seen. This is the fundamental limit of every guarantee delivered through a browser, and no website can prove otherwise to you.
Protect a device somebody else controls
Malware, a malicious browser extension, or a shared machine can read a document the moment it is on the screen. No web application anywhere can do anything at all about that.
The short version: this makes a link permanent and a reader anonymous. It does not make a link secret from whoever you hand it to, and it cannot follow a file off the device it landed on.