Burn Note keeps as little as it can, and for as short a time as it can.
The text of a note, in the server's memory only, from the moment you make the link until the first Reveal click or 24 hours, whichever comes first. Then it is deleted. Nothing is written to disk or a database, and a restart of the server deletes every unread note.
After a note is gone we keep only its random id, so that a second visitor can be told it burned rather than that it never existed. The id says nothing about the note.
A note is not encrypted while the server holds it, so anyone who can read the server's memory during those minutes or hours could read the note. Do not use Burn Note for something you could not bear to have seen.
The service runs on Render, whose infrastructure sees the usual connection metadata (your IP address, the time, the path requested) in ordinary server logs. The path of a note link is in those logs; the note text never is.
Whoever you send the link to can, of course, copy the note once they have read it.