Instar is built by Beetlix. This page says exactly what the server holds. It is short because there is little to say.
What is stored
Each letter is one database row: a random token, the time the letter may open, and two encrypted blobs. One blob is the letter and its photos. The other is what the tracking page draws: route, courier, addressee. Both are encrypted in the sender's browser with AES-GCM-256 before they are sent, and padded to fixed sizes so the row does not reveal how long a letter is.
What Instar cannot read
The encryption key is generated in the sender's browser and travels in the link after the #. Browsers never send that part of a URL to any server. Instar, its logs and a stolen copy of its database cannot read the letter, the names, or the route. A breach would learn when letters were due to open. Nothing else.
The wait
The server refuses to return the letter or its photos before the opening time. This is enforced on the server, not hidden on the page.
The public sky
Showing a flight on the sky is a choice the sender makes per letter, off by default. It records two cities, the courier's name and two timestamps, with no link back to the letter. Never the names, never the words.
No accounts, no tracking
There are no accounts and no login. Letter pages carry no analytics, no ads, and no third-party scripts. IP addresses are not logged on letter pages. Links are shared by the sender; Instar never emails or messages anyone.
Deletion
Letters are deleted thirty days after they open. Either the sender or the recipient can delete a letter earlier from its page, which removes it outright and logs nothing.
Contact
Questions go to Beetlix at beetlix.com.