Update README formatting and content

Author: casablanque-code

README.md

@@ -1,32 +1,33 @@
-# 🔐 BurnAfterRead
+# BurnAfterRead
 
 **Privacy-first, end-to-end encrypted, self-destructing data sharing.**
 
 Share sensitive text or files via links that expire after being read. No accounts. No tracking. The server never sees your decryption key.
 
 https://burnafterread.casablanque.com
 
-Check crypto - https://burnafterread.casablanque.com/security
+Security details:
+https://burnafterread.casablanque.com/security
 
 ---
 
-## ✨ Features
+## Features
 
-- 🔐 **End-to-end encryption (AES-GCM 256)** — encrypted in your browser before upload
-- 🔑 **Zero-knowledge architecture** — server never sees the decryption key
-- 💣 **Burn after read** — data is destroyed after access
-- 📁 **File support** — up to 5 MB
-- ⏳ **TTL expiration** — 1 hour, 24 hours, or 7 days
-- 🔁 **Limited views** — 1, 3, or 10 reads
-- 🗑️ **Revoke anytime** — delete a drop before it's read using the delete token
-- 🕶️ **Paranoid mode** — always deletes on first access, returns `not_found` instead of `expired`/`burned`
-- 🧠 **Atomic reads** — Durable Objects prevent double-reads under concurrent requests
-- 🚦 **Rate limiting** — 20 requests per IP per 60 seconds on all API routes
-- ♻️ **Automatic cleanup** — expired drops purged from D1 and R2 every hour
+- **End-to-end encryption (AES-GCM 256)** — encrypted in your browser before upload
+- **Zero-knowledge architecture** — server never sees the decryption key
+- **Burn after read** — data is destroyed after access
+- **File support** — up to 5 MB
+- **TTL expiration** — 1 hour, 24 hours, or 7 days
+- **Limited views** — 1, 3, or 10 reads
+- **Revoke anytime** — delete a drop before it's read using the delete token
+- **Paranoid mode** — always deletes on first access, returns `not_found` instead of `expired`/`burned`
+- **Atomic reads** — Durable Objects prevent double-reads under concurrent requests
+- **Rate limiting** — 20 requests per IP per 60 seconds on all API routes
+- **Automatic cleanup** — expired drops purged from D1 and R2 every hour
 
 ---
 
-## 🧠 How it works
+## How it works
 
 ```
 plaintext → AES-GCM encrypt (browser) → ciphertext → Cloudflare R2
@@ -51,10 +52,10 @@ https://burnafterread.casablanque.com/d/<id>#k=<base64url-key>
 
 ---
 
-## 🏗️ Architecture
+## Architecture
 
 | Layer | Technology |
-|---|---|
+| --- | --- |
 | Frontend | React, Web Crypto API |
 | Backend | Cloudflare Workers |
 | Metadata | Cloudflare D1 (SQLite) |
@@ -65,7 +66,7 @@ https://burnafterread.casablanque.com/d/<id>#k=<base64url-key>
 
 ---
 
-## 🔁 Read lifecycle
+## Read lifecycle
 
 1. `GET /api/drops/:id` hits the Worker
 2. Worker checks rate limit (DO-based, per IP)
@@ -81,7 +82,7 @@ https://burnafterread.casablanque.com/d/<id>#k=<base64url-key>
 
 ---
 
-## 🗑️ Revoke lifecycle
+## Revoke lifecycle
 
 1. Sender calls `DELETE /api/drops/:id` with `{ delete_token }`
 2. Worker delegates to `DropAccessCoordinator` DO
@@ -93,7 +94,7 @@ https://burnafterread.casablanque.com/d/<id>#k=<base64url-key>
 
 ---
 
-## 🚀 Local development
+## Local development
 
 ```bash
 npm install
@@ -106,11 +107,15 @@ npm run build
 npx wrangler dev
 ```
 
-Open `http://localhost:8787`
+Open:
+
+```
+http://localhost:8787
+```
 
 ---
 
-## 🧪 API
+## API
 
 ### Create drop
 
@@ -154,7 +159,14 @@ Response:
 }
 ```
 
-Errors: `404 not_found`, `410 expired`, `410 burned`, `429 too many requests`
+Errors:
+
+```
+404 not_found
+410 expired
+410 burned
+429 too many requests
+```
 
 ---
 
@@ -169,11 +181,15 @@ Content-Type: application/json
 }
 ```
 
-Response: `{ "ok": true }`
+Response:
+
+```json
+{ "ok": true }
+```
 
 ---
 
-## 🧰 CLI
+## CLI
 
 Send and receive drops directly from your terminal. Same zero-knowledge guarantees as the web app.
 
@@ -202,7 +218,7 @@ burnafter send archive.zip --paranoid
 Options:
 
 | Flag | Description | Default |
-|---|---|---|
+| --- | --- | --- |
 | `--text <text>` | Send text instead of file | — |
 | `--ttl <seconds>` | Time to live | `86400` |
 | `--views <n>` | Allowed reads | `1` |
@@ -222,17 +238,17 @@ The URL must be passed as a quoted string to prevent the shell from stripping th
 
 ---
 
-## ⚠️ Security notes
+## Security notes
 
 - Encryption is **client-side only** — the server stores ciphertext, never plaintext
 - The decryption key is in the **URL fragment** — it is never sent to the server by the browser
 - **No authentication** — the link itself is the only access control; guard it accordingly
 - **Losing the link means losing the data** — there is no recovery mechanism
-- `ttl_seconds` is bounded to 60s–7 days; `views` to 1–10
+- `ttl_seconds` is bounded to 60 seconds–7 days; `views` to 1–10
 - All API responses include `Content-Security-Policy`, `X-Frame-Options: DENY`, and `Referrer-Policy: no-referrer`
 
 ---
 
-## 📜 License
+## License
 
 MIT