Am I missing something here? "Your private link" is what you pass around for others to download see the linked to document/data. Anyone who has the link (or is first to use it) has your password/sensitive data.
There's no mention of authentication or encryption, whatsoever. Other than the obvious problems with putting plaintext secrets at a publicly-accessible URL, the whole security model seems to be "we promise to delete your stuff, trust us."
I find it really ironic that this is coming out right after the whole Snapchat scandal. (This is like Snapchat for documents.)
No, you're not missing anything. We built Torpedo to be a step-up from the way most of our clients and other people we worked with sent us stuff: files via Cloud links that sit around forever, and passwords in emails.
There are certainly more secure ways to send both of those things than Torpedo, but we wanted to make something that was more secure to send those things, while keeping it just as (or more) convenient.
We've got a few ideas that we're considering that'll offer more security, just trying to sort out how to keep it simple enough for our parents to use it.
Potentially true if you've chosen to upload with the 'one download' expiry time set, and then whomever you've shared the link with does not use it within 30 days (at which point it is expired & deleted). With the 'two days' option, the link does not become less secure than it was at generation because it (and the content) is deleted forever after 48 hours.
Or, if you want to calculate probabilities, assume that a billion urls are used (this is an astronomic overestimate). That's 10^9 urls. The chance of hitting one of those with a random guess is 0.00000000000014% (if I counted the 0s right). Not very likely.
Now if the url is observed in transit - that's a completely different thing. Just don't think that random guessing is going to reveal this. It's similar to people thinking you can guess your way to product keys for software (hint: you can't).