Acceptable Use Policy

Effective: September 24, 2026 Entity: Chrysaor, Ltd.

This is the list of things you can’t do with the Service, and why. It’s part of the Terms of Service — same agreement, just the section that deals with conduct rather than contracts. Anything defined in the Terms means the same thing here.

The point of Chrysaor is to give people real control over their data, privacy, and identity. Everything below exists to protect that — for you, for everyone else using the Service, and for the infrastructure underneath it.

1. You Own This

You’re responsible for how you use the Service, and for anyone you let use your account. That means you comply with the law, the Terms, this Policy, any product-specific terms, and any reasonable security instructions we give you. You can’t hand your account to someone else so they can do something you couldn’t do yourself.

Everything below is illustrative, not exhaustive. If something’s clearly the same kind of harm even if it’s not listed word-for-word, it’s still not allowed.

2. Don’t Break the Law

Don’t use Chrysaor to violate any law — federal, state, local, or foreign. That covers facilitating crime, evading sanctions, fraud, identity theft, trafficking, exploitation, distributing unlawful material, obstructing a lawful investigation, or helping someone else do any of it. Figuring out whether your specific use is legal where you are is your job, not ours.

3. Don’t Hurt People

No threats of violence. No stalking, intimidation, or sustained harassment. No facilitating exploitation or abuse. No encouraging someone else toward violence or unlawful harm. No using Chrysaor as the tool that causes serious harm to a real person.

To be clear — none of this touches lawful speech: criticism, journalism, research, advocacy, or just disagreeing with someone loudly. That’s not what this section is about.

4. Children

We have zero tolerance here. You cannot use the Service to create, store, send, distribute, seek out, or knowingly access child sexual abuse material, or anything that sexually exploits a child. You cannot use it to groom, traffic, or abuse a child. If we reasonably believe an account is being used this way, we act immediately, and we make whatever disclosures the law requires or allows.

5. Non-Consensual Intimate Content

Don’t create or distribute sexually explicit or intimate material of a real person without their consent — including images taken or obtained without authorization, and including convincingly faked or manipulated intimate content depicting a real person who never agreed to it.

6. Fraud

Phishing, credential theft, impersonation, fraudulent schemes, fake financial solicitations, forged documents, account takeovers, social engineering to get access you’re not entitled to — none of it. Using a pseudonym for legitimate privacy reasons is fine; that’s not what this section is targeting.

7. Don’t Pretend to Be Someone Else

Don’t impersonate a real person, a company, a government agency, a bank, us, Peleus, or one of our employees — in a way meant to deceive, defraud, get unauthorized access, or trick someone into believing you’re someone you’re not. Don’t fake technical or sender information to pull that off.

8. Spam

No unsolicited bulk email, mass spam campaigns, phishing blasts, or automated messaging abuse. No trying to dodge spam filters or reputation systems. Ordinary personal messages and newsletters people actually signed up for are fine — that’s not spam, and this section isn’t aimed at it. Comply with whatever anti-spam and communications law applies to you.

9. Malware

Don’t upload, spread, deploy, or knowingly host malicious code for malicious purposes — viruses, worms, ransomware, spyware, credential stealers, malicious remote-access tools, botnet components, destructive scripts, any of it.

Legitimate security research, malware analysis, and authorized testing are fine, as long as they don’t cross another line in this Policy.

10. Unauthorized Access

Don’t try to get into someone else’s account, device, or data. Don’t try to get into our systems, Peleus’s systems, or anyone else’s network or database without permission. That includes trying to defeat passwords, authentication, encryption, access controls, or rate limits.

11. Attacks on Systems

No denial-of-service attacks, credential attacks, password cracking, unauthorized scanning or exploitation, traffic flooding, resource exhaustion, or botnet activity — against us or anyone else. If you own the system or have real authorization to test it, that’s different — go ahead.

12. Security Research — We Actually Want This

Good-faith security research is welcome, as long as it’s against systems you own, systems you’re authorized to test, or through an actual bug-bounty or disclosure program. What’s not okay is testing someone else’s systems without their permission, using us as the launchpad.

Found a real vulnerability in Chrysaor? Tell us — check our Security page for the reporting channel, or email legal@chrysaor.net. Give us a reasonable window to fix it before you go public, unless the law or a disclosure agreement says otherwise.

13. Other People’s Privacy

Don’t use Chrysaor to expose, collect, sell, or misuse someone else’s personal information without authorization — publishing their private data, harvesting credentials, leaking private communications, running unauthorized surveillance, tricking people out of sensitive information, or enabling identity theft. Lawful journalism, research, and public-interest work aren’t what this is aimed at. You’re still responsible for complying with privacy law when you handle someone else’s data through us.

14. Intellectual Property

Don’t knowingly store, send, or distribute material that infringes someone’s copyright, trademark, patent, or trade secret. Make sure you actually have the rights to what you’re putting through the Service. We’ll respond to valid infringement notices as the law requires.

15. Don’t Abuse the Service Itself

Don’t bypass technical restrictions, defeat security controls, dodge account restrictions, spin up accounts to get around enforcement, manipulate rate limits, scrape in a way that materially burdens our infrastructure, or otherwise mess with how the Service works for everyone else. If we’ve published an API or documented interface for automation, using it as intended is fine.

16. Don’t Hog Resources

Don’t put an unreasonable load on our infrastructure or degrade the Service for other people — excessive automated requests, deliberate resource exhaustion, storage or bandwidth abuse, or working around published usage limits. We can set reasonable technical limits to keep things running for everyone.

17. Scraping

Automated scraping, crawling, or mirroring of the Service is off-limits where it breaks published restrictions, dodges access controls or rate limits, hits data you’re not authorized to see, or burdens our infrastructure. Reasonable use of an API we’ve actually published for this purpose is fine.

18. Don’t Break Encryption That Isn’t Yours

Don’t try to defeat, bypass, or compromise another user’s encryption or privacy protections without authorization. Lawful research, authorized testing, and defensive analysis are exceptions — and to be clear, we’re not against people using encryption or privacy tools for legitimate reasons. That’s the whole point of this company.

19. Export Controls and Sanctions

Don’t use the Service in a way that violates export-control, sanctions, or trade law. Figuring out whether your location, activity, or the people you’re dealing with fall under a restriction is on you. We’ll restrict access ourselves where the law requires it.

20. Don’t Bet Lives on This

Unless we’ve agreed to it in writing, don’t make Chrysaor your sole system for anything where a failure could reasonably kill someone, seriously injure them, or cause catastrophic harm — critical infrastructure, emergency response, life support, nuclear facilities, weapons systems, aviation control, safety-critical industrial systems. We haven’t built this to be that, and we’re not going to pretend otherwise.

21. Regulated Data — Read the Fine Print Yourself

You can use Chrysaor to store or send sensitive information, within whatever a given product actually supports. But using Chrysaor doesn’t automatically make you compliant with HIPAA, GLBA, FERPA, PCI DSS, or any other regulatory regime. Unless we’ve said so in writing for a specific product, don’t assume it’s been built to satisfy your particular compliance obligation. That’s your call to make, with your own legal advice.

22. Politics and Civic Activity

Lawful political speech, journalism, advocacy, campaigning, and civic organizing are all fine here. What’s not fine: fraud, impersonation, harassment, voter intimidation, or election interference dressed up as political activity. The line isn’t the topic — it’s the conduct.

23. Your Content Is Still Yours

This Policy doesn’t change who owns your content — you do. You’re still responsible for it and for complying with the law when you use it here.

Where a product’s encryption means we genuinely can’t read your workspace content, our enforcement has to work with what we actually have access to. We’re not claiming a right to read your private, encrypted content just because this Policy exists.

24. Reporting a Problem

See something that looks like a violation? Email legal@chrysaor.net. Security issue or suspected system compromise? Use the channel on our Security page. Give us enough to actually investigate, and please don’t include more personal or confidential information in your report than we need.

25. What We Might Do About It

Depending on what happened, we might warn you, restrict a feature, limit your account technically, suspend it, terminate it, block specific activity, preserve relevant records, cooperate with a lawful investigation, or take whatever else is reasonably necessary to protect people and the Service.

For an active threat — a live attack, ongoing abuse, a real risk to someone’s safety, a compromised account — we act first and sort out the details after.

26. Enforcement Without Reading Your Private Content

Because some of our products are built so we genuinely don’t have access to your readable workspace content, enforcement in those cases relies on what we do have — account data, authentication events, device signals, abuse reports, metadata, information you’ve given us voluntarily, or whatever comes through lawful legal process.

That’s the tradeoff of building real privacy: it means we can’t catch everything. We’re telling you that honestly instead of pretending our enforcement is more complete than it is.

27. If You Think We Got It Wrong

Email legal@chrysaor.net with the account or email tied to it, what action you’re appealing, roughly when it happened, and why you think it was wrong. We may ask follow-up questions before we decide. We’ll review it based on the actual facts and the law.

28. We Can’t Catch Everything

We’re not promising to detect or act on every violation. And not acting on something once doesn’t mean we’ve given up the right to act on it, or something like it, later.

29. Changes to This Policy

We’ll update this as the Service, the law, or our own practices change, and we’ll bump the date when we do. If a change is material, we’ll try to tell you through the Service or another reasonable channel, where the law requires it. Keep using the Service after an update, and you’ve accepted it, to the extent the law allows.

30. How This Fits With the Terms

This Policy is part of the Terms of Service. If the two ever conflict on an acceptable-use question specifically, this Policy controls — unless the Terms say otherwise. Anything not defined here means what it means in the Terms.

31. Contact

Chrysaor, Ltd.
A wholly owned subsidiary of Peleus, Inc.
1001 S. Main St. #13163, Kalispell, MT 59901, United States

Legal and AUP matters: legal@chrysaor.net
Privacy matters: privacy@chrysaor.net
Phone: (406) 476-9775