Encryption is done with JavaScript on the client. The decryption key is attached as hash to the download URL on the client side as well.
When visiting the URL, the key never reaches the server because the hash-part of an URL is never sent and is a local-only thing. So there's no need to strip logging. The client downloads the encrypted blob, and decrypts it on the client.
