Terms & acceptable use

1. What this is

A free, no-accounts, end-to-end-encrypted one-time secret sharing service operated by My Tiny Rocket LLC. Your secret is encrypted in your browser; we store only opaque ciphertext. The decryption key never reaches our server — it stays in your browser and is rebuilt from a passphrase you share on a separate channel, and the link itself carries no key. We therefore cannot read, decrypt, scan, verify, index, or proactively moderate what you share.

2. No warranty

The service is provided "as is" and "as available", without warranty of any kind — express, implied, or statutory — including merchantability, fitness for a particular purpose, security, accuracy, or non-infringement. We do not warrant that it will be uninterrupted, secure, or error-free, or that the encryption is unbreakable.

3. Limitation of liability

To the fullest extent permitted by law, My Tiny Rocket LLC is not liable for any indirect, incidental, special, consequential, or exemplary damages, or for loss of data — including a secret that is leaked, read by the wrong person, lost, expired, or unrecoverable. The service is free; our aggregate liability is limited to what you paid for it (nothing).

4. Ephemeral — not storage

Secrets are held in memory only, self-destruct on first read or when their timer expires, and are lost if the service restarts. This is not storage or backup; we do not guarantee retention, delivery, or recovery. Once a secret is gone, it cannot be recovered. Shared files are held as encrypted blobs by our storage provider, are deleted once the link has been opened (and shortly after their timer expires in any case), and are likewise not a backup.

5. Acceptable use

You agree not to use the service to create, share, or link to:

• unlawful content, or anything that facilitates illegal activity;
• child sexual abuse material, or non-consensual intimate imagery;
• malware, ransomware, exploits, or phishing;
• spam, bulk or automated abuse, or attempts to evade rate limits;
• another person's private or financial data, stolen credentials, or leaked databases;
• harassment, threats, or incitement of violence;
• material that infringes copyright, trademark, or other rights;
• impersonation, or anything that attacks, overloads, or probes the service.

6. Your content is your responsibility

You are solely responsible for what you share and for any consequences of it. We do not endorse, monitor, or guarantee user content and are not responsible for it.

7. Reporting & removal

Because we cannot read content, moderation is reactive. To report abuse or illegal material, email support@oncepad.com with: (a) the secret's exact link or ID; (b) a clear explanation of why it is illegal or breaches the acceptable-use list above; (c) your name and a contact email; and (d) a statement that your report is accurate and made in good faith. We may remove (purge) a reported secret by its ID. We cannot retrieve or disclose content we are unable to decrypt.

8. Suspension, banning & rate limiting

We may, at our discretion and without notice, rate-limit, block, suspend, or permanently ban any user or IP address, or refuse service, for any reason — including suspected abuse.

9. Privacy

We require no account, cannot read your secrets, keys, or passphrases, and never link your IP address to a secret. We process client IP addresses only to apply rate limiting and abuse controls; we do so because it is necessary for our legitimate interest in keeping the service available and preventing abuse — where the GDPR or an equivalent data-protection law applies to you, that is our lawful basis under Art. 6(1)(f) or its local equivalent. This processing is transient — rate-limit counters reset each minute, temporary bans last at most 24 hours, and we keep no persistent IP-to-secret log. We also keep one anonymous, in-memory acquisition total: a visit to a public page carrying the exact utm_source=chatgpt.com tag increments a counter, without retaining the URL, query, IP, referrer, user agent, or timestamp; the total resets on restart and is visible on the transparency page. The data controller is My Tiny Rocket LLC (Wyoming, USA); for privacy questions or to exercise your rights (access, erasure, objection) email support@oncepad.com, and, where local law provides for one, you may lodge a complaint with your data-protection supervisory authority. We use Cloudflare to deliver and protect the service; it processes connection data (including your IP) as our processor. If you share a file, it is stored as an encrypted blob by Cloudflare R2 acting as our processor, which receives your IP address, the file's size and the time of transfer — never its contents, its name, or the passphrase, all of which are encrypted before the file leaves your browser. The service is therefore not "zero-log".

10. Changes & governing law

We may update these terms; continued use means you accept the changes. These terms are governed by the laws of Wyoming, USA. Contact: My Tiny Rocket LLC — support@oncepad.com.