Terms of Service
Please read these terms carefully
1. Agreement
By using tmp0.cc, you agree to these Terms. If you don't agree, don't use the service.
2. Service Description
Privacy-focused temporary file sharing with multiple encryption modes:
- End-to-End Encrypted (E2EE — recommended): Password-protected files are encrypted in your browser before upload. Built-in password generator and entropy enforcement (min. 50 bits). The server cannot decrypt these files.
- True Zero-Knowledge: E2EE plus zero server-side processing. The server treats your upload as an opaque encrypted blob — no metadata stripping, no virus scan, no hash check.
- Server-Encrypted: Files without password are encrypted at rest on the server. A warning is displayed because the server briefly processes plaintext. E2EE is recommended instead.
All files auto-delete after expiration. No accounts, minimal metadata, HMAC-hashed IPs only.
Paste (Code & Text Share): Dedicated editor at tmp0.cc/paste. Share text and code with syntax highlighting. Pastes are stored in ephemeral memory (cleared on restart), support password protection and burn-after-reading, and auto-delete after expiration.
P2P Transfer: Direct browser-to-browser file transfer via WebRTC. The server acts only as a signaling relay - no file data is stored, transmitted through, or logged by the server.
Dead Drop Chat: End-to-end encrypted ephemeral chat. Messages are AES-256-GCM encrypted client-side with keys in the URL fragment (never sent to the server). In ephemeral mode, messages are only relayed and never stored. In buffered mode, up to 100 encrypted messages are temporarily stored as opaque ciphertext the server cannot read. Chat rooms and all messages auto-delete after expiration.
3. Security Measures
- Virus Scanning: All uploads scanned with ClamAV antivirus (except E2EE/ZK files — server cannot access plaintext)
- Hash Blocklist: Known malicious content automatically blocked
- At-Rest Encryption: AES-256-GCM server-side encryption for all files
- End-to-End Encryption (recommended): Argon2id + AES-256-GCM with enforced password strength (min. 50 bits entropy)
- True Zero-Knowledge: Optional mode — no server-side processing of encrypted uploads
- HMAC-SHA256 IP Hashing: Keyed hashing prevents IP reverse-engineering
- Abuse Detection: Score-based suspicious pattern detection with auto-blocking
- Transparency Log: Certificate Transparency style audit log (hashes only, no personal data)
- Signed URLs: HMAC-SHA256 time-limited secure download links
- P2P Transfer: WebRTC DTLS-encrypted direct transfer with TURN fallback, zero server storage
- Dead Drop Chat: AES-256-GCM E2E encrypted chat, key in URL fragment, zero-knowledge relay, ephemeral by default
We reserve the right to block, flag, or remove any content that violates our policies.
4. User Responsibilities
- - Don't upload illegal content
- - Don't upload copyrighted material without authorization
- - Don't upload malware or harmful software
- - Don't circumvent security measures
5. Prohibited Content
- Child sexual abuse material (CSAM)
- Non-consensual intimate imagery
- Terrorist/violent extremist content
- Malware, ransomware
- Stolen data/credentials
- Copyrighted material
6. Delete Links
- - Each upload generates a secret delete link
- - You are responsible for keeping this link secure
- - Anyone with the link can delete the file
- - Deleted files cannot be recovered
7. Paste (Code & Text Share)
- - Max 10,000 lines or 500 KB per paste
- - Total paste storage limited to 100 MB server-wide
- - Pastes stored in ephemeral memory (cleared on server restart)
- - Optional password protection with client-side encryption
- - Brute force protection: 5 failed password attempts = paste deleted
- - Delete tokens work the same as for files
- - All prohibited content rules apply to pastes
8. P2P Transfer
Direct browser-to-browser file transfer via WebRTC. The server acts exclusively as a signaling relay and never processes, stores, or logs file data.
- - Both sender and receiver must be online simultaneously
- - Signaling rooms expire after 10 minutes from creation
- - Maximum 5,000 concurrent rooms server-wide
- - No file size limit (constrained only by peer bandwidth and browser memory)
- - Connection encrypted with DTLS (TLS 1.2+ over DataChannel)
- - NAT/firewall may block connections; TURN relay fallback available when configured
- - If connection drops, the entire transfer must restart (no resume)
No server-side protections: Because the server never sees P2P-transferred files, ClamAV virus scanning, metadata stripping, hash blocklist checking, and content moderation do not apply. All prohibited content rules still apply, but enforcement is technically limited to signaling-level controls (rate limiting, room limits). Receivers accept files at their own risk.
9. Dead Drop Chat
End-to-end encrypted ephemeral chat rooms for 1:1 or group conversations.
- - Messages encrypted with AES-256-GCM client-side; encryption key in URL fragment (never sent to server)
- - 2 to 50 participants per room
- - Room expiration: 1 hour to 7 days
- - Ephemeral mode (default): Messages relay-only, never stored on server
- - Buffered mode: Up to 100 encrypted messages stored temporarily for late joiners
- - Text-only (no file uploads through chat)
- - Max 10,000 characters per message, 30 messages/minute rate limit
- - No forward secrecy — link compromise exposes all room messages
Zero-knowledge: The server relays opaque ciphertext it cannot decrypt. In ephemeral mode, no message data is ever written to disk. Participant identities are tracked only as in-memory WebSocket session counts — no IPs, names, or aliases are stored.
10. Abuse Prevention
To prevent abuse, we implement multi-layered protection:
- - Rate limiting per HMAC-hashed IP (different limits per operation type)
- - Brute force protection — 5 failed password attempts = file auto-deleted
- - Abuse detection — scoring system tracking suspicious patterns (failed auth, rapid uploads, scanning behavior, rate limit hits)
- - Auto-blocking — IPs exceeding the abuse threshold are blocked for 15 minutes
10. Age Requirement
You must be at least 13 years old to use this service. If you are under 18, you should have parental consent.
11. Service Availability
We do not guarantee uninterrupted service. The service may be modified or discontinued at any time without notice.
12. Disclaimer of Warranties
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED.
We make no warranties regarding reliability, accuracy, availability, security, or fitness for any particular purpose. We do not warrant that files are virus-free, safe, legal, or free from harmful content.
13. Limitation of Liability
YOU USE THIS SERVICE AND DOWNLOAD FILES ENTIRELY AT YOUR OWN RISK.
- We are NOT liable for any damages, losses, or harm caused by files downloaded from this service
- We are NOT liable for viruses, malware, ransomware, or any malicious content
- We are NOT liable for copyright infringement by users
- We are NOT liable for data loss, corruption, or unauthorized access
- We are NOT liable for any direct, indirect, incidental, consequential, or punitive damages
- We are NOT liable for any illegal content uploaded by users
In no event shall we be liable for any claims, damages, or losses exceeding the amount you paid to use the service (which is zero).
14. User-Generated Content
We are a neutral hosting platform. We do not control, endorse, or take responsibility for any content uploaded by users. Users are solely responsible for their uploads.
Our only commitment is to review and remove content upon receiving valid abuse reports or legal requests (DMCA, law enforcement, etc.).
15. Indemnification
You agree to indemnify, defend, and hold harmless the service operator from any claims, damages, losses, or expenses (including legal fees) arising from your use of the service, your uploaded content, or your violation of these terms.
16. Safe Harbor
As a hosting provider, we operate under applicable safe harbor provisions (such as DMCA Section 512). We respond to valid takedown requests but bear no liability for user-uploaded content.
17. Changes to Terms
We may update these terms at any time. Continued use of the service constitutes acceptance of any changes.
18. Governing Law & Jurisdiction
Icelandic Law
These Terms of Service are governed exclusively by the laws of Iceland. Any disputes arising from or relating to these terms, the service, or your use thereof shall be subject to the exclusive jurisdiction of the courts of Iceland.
Iceland is a member of the European Economic Area (EEA), providing strong legal protections for privacy and data protection under GDPR-equivalent standards.