Status
Abuse reports go somewhere else; the abuse policy says where.
Reviewed by counsel.
What this service is
There are two parts to this product, and the difference matters legally as well as technically.
The editor — merging, splitting, rotating, watermarking, compressing, redacting, OCR — runs as WebAssembly inside your own browser tab. Your document is not transmitted to us. We do not receive it, store it, or process it. If you never create a share link, no document of yours ever reaches our servers.
Sharing is the exception, and the only one. If you choose to create a share link, an encrypted copy of your document is uploaded so the person you send the link to can fetch it. Nothing else in the product uploads anything.
There are no accounts
No sign-up, no login, no email address. We do not ask who you are and have no way to connect a share to a person.
That cuts both ways, and you should know which way. Because there is no account, we cannot verify that you are the person who created a share. There is no recovery. If you lose the means to revoke a link, it stays up until it expires.
What we can and cannot see
A shared document is encrypted in your browser before upload. The key is placed in the fragment of the link — the part after the # — which browsers never send to a server. We do not hold it and cannot decrypt what we store.
For each share we hold an opaque identifier, an expiry time, a remaining download count, the size of the encrypted blob, a hash of a revocation token, and a creation time. There is no field for the filename, the file type, the page count, the plaintext size, or the key. Not withheld — absent.
We do not store the address a share came from. Rate limiting has to tell senders apart, so the address and the network are hashed together with a secret held only by the deployment, and the hash is what is stored. It counts; it does not identify, and we cannot reverse it.
Limits
We may change these, and may refuse or throttle requests that exceed them.
| Limit | Value |
|---|---|
| Maximum size, without a licence | 25 MB, encrypted |
| Maximum size, with a Pro licence | 250 MB, encrypted |
| Link lifetime | 1, 6, 12 or 24 hours — 6 by default |
| Maximum lifetime | 24 hours. There is no longer option. |
| Downloads per link | Up to 10, or unlimited until expiry, at your choice |
| Rate limit | 20 shares and 200 MB per sender per hour |
Retention and deletion
Every share expires. Twenty-four hours is the ceiling and it is not extendable — a service that will hold something for only a day is close to useless for distributing anything durably, which is the point.
Expired shares are swept on a recurring schedule. Once a share has expired or run out of downloads, the blob and its record are deleted and neither we nor you can recover them. Keep your original: this is a way to hand someone a file now, not storage.
Abuse reports outlive the shares they concern. A report about a link that has already expired is often the only remaining record that it existed, which makes it the one most worth keeping.
Revoking a link
When you create a share, your browser keeps a revocation token in its local storage and we keep only a hash of it. Presenting the token revokes the share at once.
Because we hold the hash and not the token, we cannot revoke on your behalf and cannot restore a token you have lost. Clearing your browser storage costs you the ability to revoke early; the share still expires on schedule.
Your responsibilities
You are responsible for what you upload and for who you send links to. By creating a share you confirm you have the right to share the material and that doing so is lawful. The acceptable use policy forms part of these terms.
Anyone with the link can open the file, because the link carries the key. Forwarding a link forwards the access, and we cannot tell who used it. If the link will travel over a channel you do not control, use the optional passphrase.
Removal and suspension
We may remove any share, without notice, where we reasonably believe it breaches the acceptable use policy or the law, or where a competent authority requires it.
We can do this because removal works on the identifier alone and needs no access to the contents. It also means we cannot review what we are removing. Our judgement rests on what a reporter tells us and on the surrounding circumstances, and we would rather say so than imply a diligence we cannot perform.
We may also block requests, apply rate limits, or withdraw sharing entirely.
Warranty and liability
The service is provided as it is and as available, without warranty of any kind. It is tested — the suite is public — and it will still sometimes be wrong. Some tools destroy information deliberately: redaction removes content permanently, filling a form locks the answers in, cleaning a scan replaces the page with an image. Each says so before you export, and afterwards the original is the only way back.
We do not warrant that shares remain available for their full stated lifetime. Do not use this or any other software as the only copy of something that matters.
To the extent the law allows, we are not liable for indirect, incidental, special or consequential loss, nor for lost data, profits or goodwill. Nothing here attempts to exclude liability that cannot lawfully be excluded, including for death, personal injury or fraud.
Changes, and where to argue about them
We may revise these terms; material changes are noted on this page with the date, and continuing to use the site after that is acceptance. With no accounts there is nobody for us to email, which genuinely constrains how we can notify you.