Acceptable use

Draft. This policy is a starting point and has not been reviewed by a lawyer.

shhnote.com (“this site”) exists so people can hand a password, a key or a file to someone else without it living on in a chat log or an inbox. Everything is encrypted in your browser before it is uploaded, and we cannot read it. That design is the whole point, and it also means we can only act on what we are told, not on what we see.

What you may not do

Do not use this site to share:

• content that is illegal where you or the recipient live, including material that exploits or endangers children;
• malware, exploits aimed at third parties, or credentials that are not yours to share;
• stolen data, or personal information about people who have not agreed to it being passed on;
• anything intended to harass, threaten, defraud or deceive.

Do not use this site as:

• a general file host, a download mirror or a backup target; links are meant to be opened once or a few times by a known recipient;
• a relay for automated traffic that circumvents the rate limits, including through many addresses or many API keys;
• a target for probing, scanning or load testing without written permission from the operator.

How enforcement works

We cannot look inside a secret, and we do not keep records of who created or opened one. Enforcement therefore works like this:

• Reports. Anyone who holds a link can report it. If the secret is still active, it is removed at once. We count how many reports arrive each day, nothing else; there is no record of which secret was reported.
• Limits. Rate limits and size limits apply to everyone equally and are enforced automatically.
• Removal on notice. When we receive a valid legal notice about a link, we remove the secret it points to, if it still exists. We cannot identify its creator or its recipients, because that information is never stored.

Because secrets expire or destroy themselves on their own, most of what this policy describes resolves itself within days without anyone’s involvement.

Changes

We may update this policy. The current version is always at this address.

Contact

Questions about this policy go to [email protected]. Security issues go to [email protected].