# Acceptable use policy

This policy forms part of the terms of use. It exists because a forwarding
service that does not police itself becomes a spam relay within weeks, and
because the people this service is built for are harmed most when it stops being
deliverable.

## What you may not do

**Unsolicited bulk email.** Sending marketing or any other bulk message to people
who did not ask for it, whatever the content.

**Harassment and threats.** Using an alias to intimidate, threaten, stalk or
persistently contact someone who has asked you to stop.

**Fraud and impersonation.** Phishing, pretending to be another person or
organisation in order to deceive, or any attempt to obtain credentials, money or
data by deception.

**Unlawful material.** Distributing material that is unlawful to distribute,
including child sexual abuse material, which we report to the competent
authorities without exception and without waiting to be asked.

**Malware.** Sending or linking to software intended to damage or gain
unauthorised access to a system. The same applies to files attached to a support
ticket: every attachment is scanned before it is stored, and one that fails is
refused rather than quietly kept.

**Attacks on the service.** Circumventing limits, automating account creation,
probing for vulnerabilities outside the terms of the disclosure policy, or
interfering with other users.

**Evading enforcement.** Creating a new account to get around a suspension.

## What we do about it

We act on **addresses, not people**. When an alias is used for abuse we revoke
its ability to send and stop its delivery. This needs no decryption and tells us
nothing about who held it.

Repeated abuse leads to suspension of the account. That decision uses counters
and signals attached to the account, not the content of anyone's mail.

We answer a report by saying what happened to the address. We never tell a
reporter who held it.

## Reporting abuse

Write to abuse@skudo.org with the alias address, the full message headers and what the
message did. We acknowledge within **2 working days** and tell you the outcome.

Reports from recipients are welcome. You do not need an account to make one.

This is a small project run by one person, so an acknowledgement may arrive
before a resolution. Urgent matters involving a risk to someone's safety should
say so in the subject line.

## Appeals

If we suspend something of yours we tell you what and why, by category of breach,
unless the law prevents us. You have **30 days** to appeal to abuse@skudo.org and we
answer within **10 working days**. Nothing is permanently deleted until the
appeal window has closed or an appeal has failed.

## Law enforcement

Requests from authorities are handled under the law enforcement guidelines and
are not a route around this policy. An authority asking us to act on an address
gets the same answer as anyone else about what we can and cannot produce.

## Why this policy is short

Longer acceptable use policies mostly enumerate specific technologies and go
stale. The rules above are about conduct, so they age better, and every one of
them is something we can actually enforce with what the system knows.