Terms of service

Effective August 31, 2026

These terms are an agreement between you and Onetime auth ("we", "us"), the operator of onetimeauth.app. By using the service you agree to them. If you do not agree, do not use the service.

The service

Onetime auth lets you share secrets, such as passwords, login details, and two-factor authentication codes, through links that can be read a limited number of times before they are destroyed, and lets you request secrets from others the same way. Everything you share is encrypted on your device before it reaches us. We store only sealed ciphertext, and the keys travel inside your links, so we cannot read, recover, moderate, or restore anything you share. That is the design, not a limitation we can waive for you.

Your content

What you share stays yours. You grant us only the limited right to store and transmit the encrypted form of your content so the service can work. We claim no other rights to it.

Acceptable use

You agree not to use the service to:

• Share credentials or other secrets you are not authorized to share.
• Store or distribute content that is illegal where you or your recipient live, including stolen credentials or data.
• Distribute malware or use the service in connection with attacks on other systems.
• Impersonate someone else, including using secret requests to trick people into handing over credentials they would not knowingly give you.
• Send spam or unsolicited links, or abuse email features to message people who did not ask to hear from us.
• Probe, overload, disrupt, or circumvent the service's security or rate limits, or access it by automated means at abusive volume.

We may revoke links, disable accounts, or block access without notice when we believe these rules are being broken. Because we cannot read content, enforcement is based on behavior and reports, not on inspection of your secrets.

Accounts

Accounts are optional and use email sign-in links. You are responsible for the security of the email address you register: anyone who controls that mailbox can sign in as you. Keep your management and pickup links private; anyone holding them can use them.

Burning, expiry, and loss

• Destroyed means destroyed. When a secret burns, is revoked, or expires, its ciphertext is erased and we cannot bring it back.
• Lost links are unrecoverable. The only keys live in your links. If you lose a link, we cannot regenerate it or decrypt what it protected.
• Recipients can keep what you show them. Burning destroys our copy. It cannot stop a recipient from copying, screenshotting, or remembering a secret they were shown. Share only with people you trust.
• This is not a backup service. Do not use it as the only home of anything you cannot afford to lose.

The service is provided as is

The service is free and provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We do not guarantee the service will be uninterrupted, error-free, or secure, or that any secret will be delivered, remain available until it expires, or burn at an exact moment.

Limitation of liability

To the fullest extent permitted by law, we will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for lost profits, data, or business, arising from your use of the service. Our total liability for any claim relating to the service is limited to the greater of fifty US dollars or the amount you paid us for the service in the twelve months before the claim.

Indemnity

If your use of the service breaks these terms or the law and that causes a claim against us, you agree to defend us and cover the resulting costs.

Changes and termination

We may change or discontinue the service, or update these terms, at any time. If a change to the terms is material, we will post the updated version here with a new effective date, and your continued use is acceptance. You can stop using the service at any time; we may suspend or terminate access for abuse or legal reasons.

Governing law

These terms are governed by the laws of the State of Texas, USA, without regard to conflict-of-law rules. Disputes will be resolved in the state or federal courts located in Texas, and you consent to their jurisdiction.

Everything else

If part of these terms is found unenforceable, the rest stands. Our not enforcing a term is not a waiver of it. You may not assign these terms; we may assign them in connection with a merger, acquisition, or sale. These terms and the privacy policy are the entire agreement between us about the service.

Contact

Questions about these terms: support@onetimeauth.app