Status
Reviewed by counsel.
The short version
Do not use our storage to distribute material that is illegal, that harms people, or that you have no right to share. We cannot read what you upload, and we are not going to pretend that makes us indifferent to what it is.
What must not be shared
- Material that sexually exploits or abuses children. There is no context in which this is acceptable, and reports of it are handled before everything else.
- Malware, ransomware, exploit kits, credential harvesters, or anything designed to gain unauthorised access to a system.
- Material that facilitates terrorism or mass violence.
- Non-consensual intimate imagery, or material intended to harass, stalk, threaten or expose a person against their will.
- Material intended to defraud — phishing kits, forged documents, fake credentials.
- Anything you do not have the right to distribute.
What you must not do
- Circumvent the size, lifetime, download or rate limits, including by splitting content across links or automating share creation.
- Attempt to enumerate share identifiers, or to reach a share you were not given the link to.
- Attack this service or the infrastructure it runs on, or use it to attack anyone else.
- Resell or rebrand the service as your own hosting product.
How this is enforced, honestly
The encryption is not a marketing claim, and it genuinely constrains us. We would rather set out what that means than let you infer something more comfortable.
We cannot scan or review content. The key never reaches us, so there is no automated scanning, no matching against known-illegal material, and no human review of uploads. None of those are possible against ciphertext we cannot open. Any service offering end-to-end encrypted sharing that also claims to scan content is doing one of those two things badly.
So we act on reports rather than inspection. Someone tells us about a specific link; we assess what we are told; we cannot verify it by looking. For the most serious categories we accept that we will sometimes remove something we could not confirm. That is the right trade, and we would rather state it than have it inferred.
What we can do is delete. Removal needs only the identifier, never the contents — which is the whole reason a service that cannot read its own storage can still be run responsibly. Being unable to inspect does not mean being unable to act.
Why a report does not delete anything by itself
Reports of child sexual abuse material and of malware are flagged for a person immediately and take priority over everything else. What they do not do is remove the file automatically.
That restraint is deliberate. A share identifier is not secret the way the key is: it travels in the path of the link, so it is visible to proxies, to referrer headers, and to every chat client that fetches a link preview. If naming an identifier were enough to destroy it, we would have handed a delete button to every intermediary the link ever passed through. Removal is a human action taken with an operator credential.
We answer a report identically whether or not the identifier was ever real. A form that confirmed existence would be a way to enumerate shares.
If you break these rules
We delete the link. There is no account to suspend, because there are no accounts. Repeated abuse from a network may lead to that network being blocked from creating links, which is a blunt instrument and is why it is a last step. Because there are no accounts, blocking is necessarily approximate and temporary: we can make a route harder for a while, but we cannot ban a person.
Where we are legally obliged to report something to an authority, we will.
What we can give law enforcement
Set out plainly, so that nobody’s expectations are formed by television.
| Asked for | What we can do |
|---|---|
| The contents of a share | Nothing. We do not hold the key and cannot obtain it. That is a property of how the feature is built, not a policy we could be pressured into changing. |
| Filename, file type, plaintext size | Nothing. There are no such fields. |
| The address that created a share | Nothing. We do not store one, and the rate-limiter hash is salted and not reversible by us. |
| That an identifier existed, its size, its timestamps | This we can provide, for as long as the record exists — at most 24 hours plus the sweep interval. |
| Abuse reports about an identifier | These we retain, including the stated reason and the reporter’s description. |
Reporting something
Every recipient page carries a report link, and you need no account, name or email address to use it. The abuse policy sets out how to report by email, what to include, and what happens next.