# Send a private message Send a reply privately. They read it on their page with a code sent to their address, not in their email, and you can withdraw it. Private things · Updated October 12, 2026 · https://userookery.com/help/private-messages/ Some things shouldn't sit in someone's inbox forever, like account details or a private note. Send them **privately** instead. The email only says you've written and links to their page, and the message itself stays with you. ## Send a private message 1. Open the conversation and write your reply, or start a **New email**. 2. Turn on **Send privately**: in a reply it's in the **…** menu (More send options) beside Send; in a new email it's the lock button. The line that appears says: "Sends privately · Dana reads it on their page with a code, not in their email. You can withdraw it." 3. Choose how long it **Works for**: 1 day, 7 days or 30 days. The default is 7 days. 4. Click **Send privately**. You still get the usual 20-second undo. In the `/` menu it's **Send privately**, and **Send as a normal email** turns it off again. ## What they get An email from you and your business, like "Maya Okafor · Northwind Law", with the subject **A private message from Northwind Law**. It never carries your subject or your words. It reads: > Hi Dana, > > Maya Okafor at Northwind Law has written to you privately. The message isn't in this email, so it doesn't stay in your inbox. > > Read it here: (the link to their page) > > When you open it, we'll send a 6-digit code to dana@example.com. You don't need an account, and we'll never ask for a password. It stays there until Tue 20 Oct. > > Not expecting this? Don't click. Call Northwind Law on a number you already have, or reply to ask Maya. Please don't put private details in a reply: replies by email aren't private. Your signature follows, then one line: "Sent privately with Rookery". The business name is your workspace's name. Without one, it's the organisation in your inbox's address (billing@northwind.example becomes Northwind), and only at a free mail provider the inbox's own name. It's worth telling them to expect it, in a call or an earlier email: "I'll send the documents privately; you'll get a short code by email to open them." People trust what they were told to expect. ## What they see 1. Their [private page](https://userookery.com/help/client-portal/) with your business: your business's name and the address the email came from at the top, open on **Conversations** with this conversation. 2. They click **Email me a code**. The code arrives from your address, with the subject "123456 is your code for Northwind Law". They enter it and click **Continue**. 3. The conversation, the way your own thread shows it: your messages to them and theirs to you, with names, times, earlier quoted text folded away, and files that open in a viewer (photos and PDFs, with any links in a PDF shown safely). Your private message says **Private message from** and your name. They never see your notes, tags, what the helpers did, or anyone else's mail. 4. **← Conversations** lists every private conversation they have with you, newest first. Their documents to send are under **To do**, and the meetings they booked with you under **Meetings**, in their own time zone. 5. If they open the link again in the same browser while they're still signed in, the conversation opens straight away, with no new code. For the person on the other side, there's [Got a private message from a business?](https://userookery.com/help/got-a-private-message/), linked from the bottom of their page. ## How they reply 1. They write in the box under the conversation, with the same editor you use: bold, italic, underline, links, lists and quotes. They can **Attach files**: PDFs, photos or Office files, up to 25 MB each and 10 files. 2. They click **Send to** and your first name. Under the button: "It goes from this page, not by email." The page says **Sent to** you, and their message appears in the conversation straight away, marked **Sent from your page**. In your thread it shows with their formatting. 3. While they write, the reply is saved on their device, so a closed tab doesn't lose it. It's cleared when they send it or sign out, and never saved on a shared computer. 4. **Email me a note that I replied** is ticked unless they untick it. The note comes from your address, from you and your business, with the subject "You replied to Northwind Law from your page". It says who they replied to and when, with the link to their page. It never includes what they wrote, the subject or file names, so nothing private ends up in their inbox. It also tells them what to do if they didn't send the reply. ## Using a shared computer - **Sign out** is at the top of the page. It ends their session on every device and clears what the page kept in the browser, with their unsent replies, then says **Signed out and cleared from this browser**. The page is never cached, so Back doesn't show the conversation afterwards. Someone who reopens the link from the browser's history needs a new code sent to the reader's inbox. - At the code step they can tick **Using a shared or public computer?**. Then nothing is kept in the browser: no sign-in cookie and no saved reply. Refreshing or closing the tab signs them out. - At the bottom, **Clear this page** closes it and removes what it saved in that browser. - Even on their own device, the session ends when they close the browser, after 10 minutes without doing anything, and 30 minutes after the code at most. A minute before, the page says **You'll be signed out in 1 minute**, with **Stay**. Signed out, it says why, and a new code opens it again. ## How you know a reply is really from them A reply written on their page shows a quiet ✓ beside their name and the line **Sent from their private page.** It says which address confirmed a code, and when. Only someone who can read that inbox gets the code. These replies don't arrive by email, so they have no sender checks or headers. **Show original** lists how the reply arrived instead, and there's no .eml file to download. An email that only claims to come from their page never gets the ✓: Rookery decides from where it stored the reply, never from anything written in the message. ## Withdraw it 1. Find the message in the conversation. It says **Sent privately** and how long it's there, like "until Tue 20 Oct". 2. Click **Withdraw**. The link stops working right away and opens nothing. On their page, the message shows as withdrawn, without its words. If it was the only private message in that conversation (say it went to the wrong person), the conversation leaves their page altogether, subject and all. ## When it has expired An expired link no longer opens anything by itself: it offers **Email me my page link**, which sends their page's link to the address it went to. On their page, the message shows as expired, without its words, with **Ask** you **to send it again**. That adds a line to the conversation ("asked you to send a private message again") and brings it back to your inbox. Send them a new private message. Once every private message in a conversation has expired or been withdrawn, replies there close, and the page gives them your address instead. ## Good to know - The message shows whether it was opened, like "Opened 2 times" or "Not opened yet". - Each code works once, for 10 minutes. After 5 wrong tries, they need a new code. - Codes go only to the address you sent the message to. That's what keeps it private if the email is forwarded. Anyone who can read that inbox can get a code, so we never tell them "only you can read it". - Their page and the email say plainly that we never ask for a password, and how to check it's really from you. - A private message goes to one person, so you can't use Cc. - "Private" here means the message stays out of their email. It doesn't hide it from your team: a private message from a team inbox is in the team's conversation like any reply. A [private inbox](https://userookery.com/help/private-inbox/) is the thing your team can't see.