Your browser generates a one-time key.
The assets sit in a noncustodial escrow contract, bound to that key. The recipient opens the link, signs in with email (Privy spins up a wallet for them) or connects their own, and claims.
Unclaimed after expiry? You refund yourself. We never hold your keys or your funds.