Earlier quoted context omitted.
Just encrypt the data and pass the key in the url, like so: https://bitf.ly/1b4b7ee4fe39312afbfffbe47d831f99#someaeskey That way, the server never sees the key (it's client-side and fragments don't get sent), but nobody except the recipient can decrypt the data.
that only works if you have a way to assure the JS has not being modified every time the page is ever loaded everywhere. That only works on a content addressed protocol like IPFS
You can trivially ensure that by just downloading the page. These things are usually a single HTML page you can run locally.