Terms & Privacy

1. Terms of Use

By using ttl.space (the “Service”), through the website or the command-line tool, you agree to these terms. If you do not agree, do not use the Service.

The Service

ttl.space offers end-to-end encrypted, time-limited file transfer. Files are encrypted on your device before upload; the server only ever sees encrypted data and cannot read your content. Every file is deleted automatically when its lifetime ends. The Free plan needs no account. Orbit is a paid subscription with larger files, longer lifetimes, permanent files and more storage.

Your responsibility

You alone are responsible for what you upload and share: you must have the right to share it and you must comply with applicable law. You must be at least 16 years old to use the Service. Keep your Orbit key private: you are responsible for its use. You must not use the Service for:

• Malware, phishing or stolen data
• Child sexual abuse material (CSAM) or any form of child exploitation
• Pirated or copyright-infringing content
• Selling or promoting illegal drugs or controlled substances, gambling or money laundering
• Content produced by or promoting organisations designated as terrorist by the EU or by any EEA or OECD member state
• Attacking or overloading the Service, or getting around its limits
• Any other illegal content, or anything that facilitates the above

How we run the Service

We may remove or block content we believe is illegal or against these terms, without prior notice, and suspend or end the access of anyone who breaks them. We may change, suspend or discontinue the Service or any feature; if we discontinue Orbit altogether, we refund the paid, unused part of your subscription pro rata.

No warranty

The Service is provided “as is” and “as available”, with no warranty that it will be uninterrupted, error-free or fit for a particular purpose. Files are not backed up: keep your own copy of anything important. If you lose a password, the files it protects cannot be recovered.

Limitation of liability

To the fullest extent permitted by law, we are not liable for indirect, incidental or consequential damages, or for any loss of data, profits or reputation, arising from the use of or the inability to use the Service. If we are held liable for any damage, the total we pay cannot exceed €50 or, if higher, the amount you paid for Orbit in the 12 months before the claim. These exclusions and this limit do not apply to intent, gross negligence or any liability that cannot be limited by law.

Indemnity

To the extent permitted by law, you agree to indemnify us and hold us harmless against any third-party claim, including reasonable legal fees, arising from content you upload or from your breach of these terms or of the law.

Changes and governing law

We may update these terms: the date at the top of this page shows the latest version, and we tell Orbit subscribers about significant changes by email. Using the Service after an update means you accept the new terms. These terms are governed by the laws of the Republic of Türkiye, and the courts and enforcement offices of Bursa have jurisdiction over any dispute. If you are a consumer, the mandatory consumer protections of your country of residence still apply. If any part of these terms is invalid, the rest remains in force. If a translation differs from the English text, the English text prevails.

2. Privacy

In short

No accounts, no cookies, no tracking, no profiling. We cannot see your files, their names or their passwords. We never sell your data. We process only the minimum needed to run the Service, prevent abuse and meet our legal obligations.

Controller

The data controller is the operator named in the Legal notice below. For any privacy request, write to support@ttl.space.

What we process

• Files: only the encrypted content and the technical record needed to serve it (link, size, times, settings, download count, key hashes).
• Server logs: for each upload, download, deletion and extension, the IP address and port, the time, browser details and language, the action, the file’s link and size, and the IP address’s approximate location and network, looked up in databases on our own server. IP addresses are stored only hashed and encrypted, and are decrypted only for an abuse investigation or a valid legal request.
• Abuse reports: what you send with the “Report abuse” button or the notice form (the reason; for a formal notice, your name, email address and explanation; optionally the file’s password, stored encrypted) and your IP address, as above.
• Problem reports: what you send with “Didn’t work? Let us know” (the answer you choose and an optional note) and the technical details the page adds: page, error code, link ID, size range, network type, browser and languages, approximate country and network, and a hash of your IP address. For some errors caused by the site, the page sends the same technical details on its own.
• Orbit: your email address, subscription and customer IDs, and an encrypted copy of your API key. We never see your card details.
• Browser notifications: only if you turn them on, your browser’s push subscription, encrypted.
• Visit statistics: our self-hosted Umami counts visits in aggregate only and stores no personal data.
• In your browser: your language, Orbit key and recent uploads stay in your browser’s storage; they reach the server only when a request needs them, and file names never do.

Purposes and legal bases

• Providing the Service and Orbit: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Security, abuse prevention and fixing problems: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). You may object to this processing.
• Law No. 5651, the DSA and requests from authorities: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
• Browser notifications: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)), which you can withdraw at any time in your browser’s settings.

How long we keep data

• Files: deleted automatically when their lifetime ends (at most 7 days on the Free plan, 30 days on Orbit), and burn-after-reading files within 10 minutes after the first download. Permanent Orbit files are kept until you delete them or until 48 hours after the subscription ends. A notification subscription is deleted with its file; a file request a day after it expires.
• Server logs, abuse and problem reports: kept for two years and then deleted.
• Reported files: a file reported for a reason other than copyright, and any password added to a report, are kept for 30 days after the latest such report, solely to hand them over on a valid legal request. They are never opened and are then deleted automatically.
• Orbit subscriber records: kept after the subscription ends, for disputes and legal claims, until you ask us to erase them.

Who receives data

• Dodo Payments (merchant of record): payments, taxes and invoices.
• Resend: delivers our emails (your API key, the notices you turn on, and copies of the reports sent to us).
• Cloudflare Turnstile: protects key recovery and the report forms against bots; when it loads, it sends your IP address and browser details to Cloudflare.
• Your browser’s push service (Google, Mozilla, Apple or Microsoft): delivers the notifications you turn on, encrypted.
• Our hosting and storage provider in the EU: runs our servers and stores the encrypted files.
• Authorities: only when required by law or on a valid legal request.

Some of these services process data outside the EU under their own privacy policies and appropriate safeguards. IP location data comes from local copies of the IPinfo and MaxMind databases; no address is sent to either. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Your rights

Under the GDPR and KVKK you have the right to access your data, to have it corrected, erased, restricted or ported, to object to processing and to withdraw consent. You can also complain to the data protection authority of your country (in Türkiye, the Personal Data Protection Authority). Write to support@ttl.space to exercise your rights; we answer within 30 days.

Server location

Our servers are in Germany and the encrypted files are stored in the European Union; the operator is based in Türkiye.

3. Payments, Cancellation & Refunds

Orbit is a monthly subscription that renews every month until you cancel it. Payments are collected by Dodo Payments as merchant of record, which also applies any VAT or sales tax due where you live.

• Cancellation: cancel at any time from the Orbit dashboard; you keep Orbit until the end of the paid period and are not charged again. When the period ends, your API key stops working: permanent files are deleted 48 hours later, and uploader-only files can no longer be downloaded. Subscribing again does not bring old files back.
• Refunds: there are no refunds for partial periods, except when we discontinue Orbit (see section 1). If you believe you were charged in error, write to support@ttl.space within 14 days of the charge; we review your request and refund justified claims to your payment method through Dodo Payments. Your statutory rights as a consumer are not affected.

4. Notice & Takedown

Files are end-to-end encrypted, so we cannot see their content: we decide on the reports themselves. This procedure follows the EU Digital Services Act (DSA) and Turkish Law No. 5651.

• How to report: use the “Report abuse” button on the file’s page, the notice form, or write to abuse@ttl.space. A formal notice must include the link to the file, why the content is illegal, your name and email address (not required when you report child sexual abuse material), and a statement that the information is accurate and given in good faith.
• What happens next: reports from different people can lead to a warning on a link or to its automatic disabling; reports of child sexual abuse material take priority. Copyright claims are handled only through a formal notice. We can disable or restore a link at any time. We confirm each formal notice and tell its sender our decision; if a file uploaded with Orbit is restricted, we email its owner the reason. You can appeal our decision at abuse@ttl.space.
• Point of contact: authorities and users can reach us at abuse@ttl.space, in English or Turkish.

5. Legal notice (Impressum)

This service is operated from Türkiye, hosted in Germany, and registered with the BTK as a hosting provider under Law No. 5651.