Acceptable-use policy
Host documents, mockups, and reports — not malware, phishing, or illegal content. Untrusted HTML is sanitized on ingest, so no scripts run and interactive apps are frozen to static, and every doc renders under a strict CSP on an isolated origin, view.ilolink.com.
ilolink turns pasted Markdown or HTML into a shareable page. You are responsible for what you publish. This page covers what is allowed, what is not, and how we act on reports. It sits alongside the terms.
What you can host
Anything you have the right to share and that is safe to open: landing-page mockups, design comps, docs, memos, reports, and other output from an AI chatbot or your own work. CSS is kept so mockups still look right. Uploads are capped at 15 MB per doc.
What's not allowed
- Malware and phishing. No pages built to steal credentials, impersonate a login, install software, or trick a reader. Scripts never execute by default, but a static page can still deceive — that is banned regardless.
- Illegal content. No child sexual abuse material, no content that infringes copyright or trademark you don't hold, and nothing whose distribution breaks applicable law.
- Abuse and harm. No harassment, threats, doxxing, or incitement to violence. No spam or bulk deceptive content.
How moderation works
There is no upfront review — you paste, you get a link. The security model does the first pass automatically: on ingest we drop javascript:, data:, and vbscript: URLs, strip anything that would run JavaScript, make forms inert, and serve the result sandboxed under default-src 'none' on view.ilolink.com. That contains technical attacks, not deception or illegal content — those we act on after a report.
Reporting and takedown
Anyone can flag a page. Use /report with the ilolink.com link and a short reason. We review reports and remove docs that break this policy. We don't need to reach the publisher first — we hold only the email on their account and no other profile — so removal may be the only action available.
Enforcement
Confirmed violations get the doc taken down. Where a link points to a clear, ongoing threat, we may remove it before finishing a full review. We keep no personal profile of publishers or readers, so enforcement acts on documents, not identities.
Questions
- Do you review pages before they publish?
- No. Publishing is instant. The sanitizer strips scripts and sandboxes the render automatically on ingest; policy violations like phishing or illegal content are handled after a report.
- How do I report a page?
- Go to /report, paste the ilolink.com link, and give a short reason. We review and take down docs that break this policy.
- Can a hosted page run code against a reader?
- Not by default. Every doc renders on the isolated origin view.ilolink.com under a strict CSP with default-src 'none', so uploaded JavaScript is frozen to static and forms are inert. If you mark an HTML doc trusted at publish time, its own scripts run — but sandboxed inside an opaque-origin frame on that same isolated origin, so they still can't touch cookies, storage, or other docs. A static mockup can still try to deceive, which is why phishing is banned outright.
- What happens to a doc that breaks the rules?
- It gets removed. For a clear, ongoing threat we may take it down before finishing a full review.
Try it on your own doc
Paste Markdown or HTML, get a link. Readers need no account.