Terms of Service
Please read these terms carefully
1. Agreement
By using tmp0.cc, you agree to these Terms. If you don't agree, don't use the service.
2. Service Description
Privacy-focused temporary file sharing with multiple encryption modes:
- End-to-End Encrypted (E2EE — recommended): Password-protected files are encrypted in your browser before upload. Built-in password generator and entropy enforcement (min. 50 bits). The server cannot decrypt these files.
- True Zero-Knowledge: E2EE plus zero server-side processing. The server treats your upload as an opaque encrypted blob — no metadata stripping, no virus scan, no hash check.
- Server-Encrypted: Files without password are encrypted at rest on the server. A warning is displayed because the server briefly processes plaintext. E2EE is recommended instead.
All files auto-delete after expiration. No accounts, minimal metadata, HMAC-hashed IPs only.
Code Snippets: Share text and code with syntax highlighting. Snippets stored in ephemeral memory (cleared on restart), support password protection, and auto-delete after expiration.
P2P Transfer: Direct browser-to-browser file transfer via WebRTC. The server acts only as a signaling relay - no file data is stored, transmitted through, or logged by the server.
3. Security Measures
- Virus Scanning: All uploads scanned with ClamAV antivirus (except E2EE/ZK files — server cannot access plaintext)
- Hash Blocklist: Known malicious content automatically blocked
- At-Rest Encryption: AES-256-GCM server-side encryption for all files
- End-to-End Encryption (recommended): Argon2id + AES-256-GCM with enforced password strength (min. 50 bits entropy)
- True Zero-Knowledge: Optional mode — no server-side processing of encrypted uploads
- HMAC-SHA256 IP Hashing: Keyed hashing prevents IP reverse-engineering
- Abuse Detection: Score-based suspicious pattern detection with auto-blocking
- Transparency Log: Certificate Transparency style audit log (hashes only, no personal data)
- Signed URLs: HMAC-SHA256 time-limited secure download links
- P2P Transfer: WebRTC DTLS-encrypted direct transfer with TURN fallback, zero server storage
- API Keys: Optional authentication for higher rate limits
We reserve the right to block, flag, or remove any content that violates our policies.
4. User Responsibilities
- - Don't upload illegal content
- - Don't upload copyrighted material without authorization
- - Don't upload malware or harmful software
- - Don't circumvent security measures
5. Prohibited Content
- Child sexual abuse material (CSAM)
- Non-consensual intimate imagery
- Terrorist/violent extremist content
- Malware, ransomware
- Stolen data/credentials
- Copyrighted material
6. Delete Links
- - Each upload generates a secret delete link
- - You are responsible for keeping this link secure
- - Anyone with the link can delete the file
- - Deleted files cannot be recovered
7. Code Snippets
- - Max 10,000 lines or 500 KB per snippet
- - Total snippet storage limited to 100 MB server-wide
- - Snippets stored in ephemeral memory (cleared on server restart)
- - Optional password protection with client-side encryption
- - Brute force protection: 5 failed password attempts = snippet deleted
- - Delete tokens work the same as for files
- - All prohibited content rules apply to snippets
8. P2P Transfer
Direct browser-to-browser file transfer via WebRTC. The server acts exclusively as a signaling relay and never processes, stores, or logs file data.
- - Both sender and receiver must be online simultaneously
- - Signaling rooms expire after 10 minutes from creation
- - Maximum 5,000 concurrent rooms server-wide
- - No file size limit (constrained only by peer bandwidth and browser memory)
- - Connection encrypted with DTLS (TLS 1.2+ over DataChannel)
- - NAT/firewall may block connections; TURN relay fallback available when configured
- - If connection drops, the entire transfer must restart (no resume)
No server-side protections: Because the server never sees P2P-transferred files, ClamAV virus scanning, metadata stripping, hash blocklist checking, and content moderation do not apply. All prohibited content rules still apply, but enforcement is technically limited to signaling-level controls (rate limiting, room limits). Receivers accept files at their own risk.
9. Abuse Prevention
To prevent abuse, we implement multi-layered protection:
- - Rate limiting per HMAC-hashed IP (different limits per operation type)
- - Brute force protection — 5 failed password attempts = file auto-deleted
- - Abuse detection — scoring system tracking suspicious patterns (failed auth, rapid uploads, scanning behavior, rate limit hits)
- - Auto-blocking — IPs exceeding the abuse threshold are blocked for 15 minutes
- - API key authentication — optional, provides higher rate limits for legitimate automated usage
10. Age Requirement
You must be at least 13 years old to use this service. If you are under 18, you should have parental consent.
11. Service Availability
We do not guarantee uninterrupted service. The service may be modified or discontinued at any time without notice.
12. Disclaimer of Warranties
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED.
We make no warranties regarding reliability, accuracy, availability, security, or fitness for any particular purpose. We do not warrant that files are virus-free, safe, legal, or free from harmful content.
13. Limitation of Liability
YOU USE THIS SERVICE AND DOWNLOAD FILES ENTIRELY AT YOUR OWN RISK.
- We are NOT liable for any damages, losses, or harm caused by files downloaded from this service
- We are NOT liable for viruses, malware, ransomware, or any malicious content
- We are NOT liable for copyright infringement by users
- We are NOT liable for data loss, corruption, or unauthorized access
- We are NOT liable for any direct, indirect, incidental, consequential, or punitive damages
- We are NOT liable for any illegal content uploaded by users
In no event shall we be liable for any claims, damages, or losses exceeding the amount you paid to use the service (which is zero).
14. User-Generated Content
We are a neutral hosting platform. We do not control, endorse, or take responsibility for any content uploaded by users. Users are solely responsible for their uploads.
Our only commitment is to review and remove content upon receiving valid abuse reports or legal requests (DMCA, law enforcement, etc.).
15. Indemnification
You agree to indemnify, defend, and hold harmless the service operator from any claims, damages, losses, or expenses (including legal fees) arising from your use of the service, your uploaded content, or your violation of these terms.
16. Safe Harbor
As a hosting provider, we operate under applicable safe harbor provisions (such as DMCA Section 512). We respond to valid takedown requests but bear no liability for user-uploaded content.
17. Changes to Terms
We may update these terms at any time. Continued use of the service constitutes acceptance of any changes.
18. Governing Law & Jurisdiction
Icelandic Law
These Terms of Service are governed exclusively by the laws of Iceland. Any disputes arising from or relating to these terms, the service, or your use thereof shall be subject to the exclusive jurisdiction of the courts of Iceland.
Iceland is a member of the European Economic Area (EEA), providing strong legal protections for privacy and data protection under GDPR-equivalent standards.