How the private fragment works
The endpoint receives the draft for validation and returns a URL whose # fragment carries the draft to the browser. Browsers do not include that fragment in the HTTP request to Invoity, and this endpoint does not persist the submitted payload.
The data is still present in the link itself. Treat it like a draft: do not paste passwords, card data, bank credentials, Social Security numbers, or unrelated sensitive information, and share the link only with intended reviewers.