Terms of Service
Hushbox is a private file-sharing service: files delete themselves on a timer, and links can be password-protected. Privacy here is a tool for people who care about controlling who has access to their files and for how long — not a way to dodge responsibility for illegal content. Below, briefly and plainly: what's allowed, what isn't, and what we do with data.
About the service
Hushbox lets you upload a file, get a link to it, and set a time after which the file is deleted permanently. The link can be password-protected so that only the person you gave it to can download the file. An account isn't required — you can upload anonymously, with tighter limits on size and frequency.
Prohibited content
Regardless of whether you're signed in or not, it is strictly forbidden to use the service to host:
- child sexual abuse material in any form;
- material promoting terrorism, or instructions for preparing violent attacks;
- malware intended to attack third parties;
- other people's personal data obtained and distributed without their consent (doxxing);
- copyrighted content, when distributed in bulk or commercially;
- material organizing trafficking in weapons, drugs, or people.
Every uploaded file gets a digital fingerprint (hash). Once a file is flagged as violating these terms, re-uploading the same file — including by a different user — is blocked automatically.
Anonymity — what it means and what it doesn't
Using a VPN or Tor, or uploading without an account, is not a violation and not grounds for an automatic block. We do not attempt to uncover your real IP around protections you deliberately turned on.
Anonymity protects your identity from outsiders. It does not exempt you from these terms and does not stop us from responding to violations — through hash blocking, reports from other users, and cooperation with lawful investigations.
Links and passwords
The link is the only way to get the file. Whoever has the link (and the password, if one is set) can download it. Only share the link with its intended recipient — the service can't tell "the right person" apart from anyone else if the link ends up in the wrong hands.
Tip. For sensitive files, always turn on a password and send it to the recipient through a separate channel — not in the same message as the link.
Self-destruct
A file's lifetime is set once, at upload time, and can't be extended afterward. Once the timer runs out, the file is deleted from our servers permanently — it cannot be recovered after that, including at your own request.
What data we keep
We log technical data for every request to the service: IP address, browser and device details, the time of the event, and what happened (upload, download, an access attempt with the wrong password). This is standard data your browser already sends to any website.
- file contents are not analyzed or manually reviewed outside of report-driven moderation;
- the technical event log is kept indefinitely;
- the file itself is deleted once its timer runs out — the log record that it existed remains.
Law enforcement requests
If we receive a lawful, official request from an authorized body, we hand over the requested data — to the extent the request covers. This applies to both registered and anonymous users: anonymity protects you from outsiders, not from a lawful investigation.
Reports and blocking
Every public link has a "report" button. Reports are reviewed manually; once a violation is confirmed, the file is blocked and its hash is added to a blocklist to prevent it from being re-uploaded.
Liability
The service is provided "as is," with no guarantee of continuous availability. We do not pre-screen file contents and are not liable for content uploaded by users until a violation is identified through a report or other means.
Changes to these terms
We may update these terms as the service grows. The date of the last update is always shown at the top of this page. Significant changes are announced in advance.
Contact
Which address you use depends on what you're reaching out about — it gets your message to the right person faster.
For sensitive inquiries that require encrypted correspondence, a PGP key will be published separately on this page.