Terms of service

cordium is a public HTML-sharing service. These rules apply to uploads through the website and API, including automated clients.

Share responsibly

Only upload content you own or have permission to publish. Do not publish illegal content, malware, phishing, scams, harassment, or other people's private information. Do not use the service to attack systems, bypass limits, or impersonate others.

Public means public

Every published page can be opened and shared by anyone with its link. A random link is not access control. Do not upload passwords, API keys, confidential information, or other secrets.

Your content and removal

You keep ownership of your content and permit cordium to store and serve it to visitors. Uploads cannot be edited or deleted by the uploader. Publish a new page to make changes. The administrator can remove content, including abusive content or content that must be removed by law.

Limits and availability

The current limits are 10 MiB of HTML per project and 50 upload attempts per IP per hour. Storage limits also apply. Automated clients are welcome and must respect error responses and Retry-After. The service is provided as available; links, storage, uptime, and backups are not guaranteed. Keep your own copy of your work.

Privacy policy

cordium does not require an uploader account. Anonymous publishing does not mean network activity is untraceable.

What the service stores

For each project, cordium stores its HTML, title, generated ID, size, and creation time so it can host the page. These records remain until the administrator removes them. Deleted project IDs remain reserved so an old link cannot be reused for different content. The project database does not attach an uploader account or IP address to a project.

Security and operational data

cordium processes your IP address to enforce rate limits. The rate-limit database stores a hashed value derived from the address, limit category, and time window, together with a request count and expiry. These hashes are keyed with a server secret to reduce the risk of recovering IP addresses from a database copy. Expired entries are cleaned up during subsequent rate-limit checks.

Server access logs record request information such as paths, times, response codes, user agents, and the connecting proxy address. Logs rotate when configured size limits are reached. The administrator can access stored projects and operational data to maintain the service and address abuse.

Your browser and other services

cordium saves your theme preference in your browser's local storage. You can clear it in your browser settings. The application does not add advertising or analytics trackers. The admin area uses an HTTP-only session cookie and a temporary server-side session record, expiring after 30 minutes. Ordinary uploaders do not need this cookie.

Traffic passes through Cloudflare for delivery and security. Cloudflare processes connection data under its privacy policy. Uploaded pages may contain third-party scripts, images, forms, or links that make their own network requests. Their authors and providers control those requests; avoid entering sensitive information into untrusted pages.

Changes

This page describes cordium's current behavior. Service rules and this notice may be updated as the service changes.