Terms of Service
Last updated: September 26, 2026
1. What FilePass does
FilePass transfers files directly between two browsers over a WebRTC DataChannel. The Cloudflare Worker signaling service relays only connection setup messages (SDP offers/answers and ICE candidates). File contents never go through the signaling server.
Signaling is STUN-only with no TURN relay by design. If a direct peer-to-peer path cannot be established (restrictive NAT, firewall), the transfer fails.
2. Encryption model
WebRTC encrypts the peer-to-peer channel in transit (DTLS). FilePass adds no separate password protection or additional application-layer encryption. Do not use FilePass for data that requires extra access controls.
3. Network disclosure
Establishing a direct connection exposes network metadata — typically your public IP address and port — to the other peer via ICE/STUN. Only transfer with parties you trust.
4. Share links
Each transfer uses a cryptographically random 128-bit room ID in the link fragment (#room). Anyone with the full link can join as the receiver while the room is active. Treat links as bearer tokens and do not post them publicly.
Rooms are ephemeral: in-memory only, no database, and expire after 30 minutes idle. There is no account, no file hosting, and no resume after interruption.
5. Acceptable use
You agree not to use FilePass to share content you have no right to share, malware, or content that violates applicable law. Receivers should only connect to senders they trust and scan received files before opening them — you are asked to accept before any file is downloaded.
Invalid or oversize signaling messages are dropped. A second connection with the same role in the same room is rejected (HTTP 409).
6. Integrity, availability
Transfers are chunked (64 KiB) with incremental SHA-256 verification and filename sanitization, but delivery is best-effort: no uptime guarantee, no TURN fallback, no resume, and large files may fall back to in-memory buffering where OPFS is unavailable.
7. No warranty, limited liability
The service is provided "AS IS" without warranties of any kind, to the maximum extent permitted by law. The open-source code is separately licensed under MIT (see LICENSE). To the maximum extent permitted by law, the operators are not liable for indirect, incidental, or consequential damages arising from use of the service.
8. Changes and contact
These terms may be updated by updating this page; continued use constitutes acceptance. For abuse reports or questions, contact: esmeraldoinciso.work@gmail.com.