Terms of use

What this service is

A shared CORS proxy run by a single Cloudflare Worker with a small D1 database and an R2 cache. There is no SLA, no support commitment and no uptime target: the service may be slow, rate-limited, changed, suspended or shut down at any time without notice. Anything you depend on deserves its own deployment.

Prohibited uses

• Phishing, malware, ransomware, fraud or deceptive content.
• Content that is illegal wherever it can be reached, including child sexual abuse material.
• Spam, credential stuffing, account takeover or automated abuse of a target site.
• Denial-of-service, stress testing third parties, or anything that degrades a service you do not own.
• Scraping or bulk extraction that violates the target's own terms or robots directives.
• Bypassing paywalls, DRM, authentication or any access control.
• Probing, scanning or reaching private, internal or reserved network addresses.
• Cryptomining, large-scale file mirroring, or using the proxy as storage or a CDN.
• Sending credentials or personal data: the public key refuses to forward Cookie and Authorization headers, and working around that is a breach of these terms.

Quotas and enforcement

The public key is limited per calling site, per target host and for the instance as a whole, per UTC day, plus a per-minute limit per IP. Limits return 429 with a Retry-After header, and cached responses count too — the quota is about requests, not upstream load. When limits are hit or abuse is detected we may throttle, rotate or disable the public key, or block hosts, origins and IPs, immediately and without notice. The public instance has no whitelist and no exception process; self-host if you need one.

Data and privacy

• We log every request: IP, country, method, target URL, status, latency, caller Origin and which key was used. Logs are kept for 30 days and used for abuse handling and capacity planning.
• Successful GET responses are stored in a shared cache and may be served to another user. Never route private, personal or authenticated data through the public instance.
• Do not send secrets, tokens, cookies or personal data. Stripping Cookie and Authorization is a safety net, not permission to send them.
• The public pages set no cookies beyond remembering your language choice.

No warranty, limited liability

The service is provided "as is", without warranty of any kind, express or implied, including merchantability, fitness for a particular purpose, availability, accuracy and non-infringement. To the maximum extent permitted by law, the operator is not liable for any direct, indirect, incidental, special or consequential loss — including lost data, profits or business — arising from the use of, or inability to use, this service.

Changes

These terms, the quotas and the feature set may change at any time; the version on this page is the current one, and continued use after a change means you accept it. corx itself is open source: for guarantees, advanced features and no shared quotas, run your own instance.

Report abuse

Report abuse, illegal content or security issues to abuse@envx.cnInclude the full request URL when you can.