Acceptable Use Policy

Draft · Awaiting legal review

DRAFT — needs legal review. This text is a working draft and is not yet in force.

This Acceptable Use Policy ("AUP") is part of the Terms of Service of Quvos, operated by [Company legal name]. It applies to everyone who uses quvos.dev, quvos.io and quvos.app, and to everything built, run or published with the Service, including Agents, Skills, MCP connections, chat channels, apps and previews. Workspace owners and admins are responsible for making sure their members and the Agents they configure follow it.

Quvos is a shared platform. These rules exist to keep it safe, fair and available for every customer.

1. Prohibited content

You may not use the Service to create, store, host, publish or distribute:

• child sexual abuse material (CSAM) or any content that sexualises minors. We report such material to the competent authorities and preserve evidence as the law requires;
• content that is illegal where it is published or where you are, including content that incites violence or terrorism, or that sells illegal goods or services;
• content that infringes copyright, trademarks, trade secrets or other rights of others, including pirated software and leaked credentials or data;
• personal data of others processed without a lawful basis, including doxxing.

2. Prohibited activities

You may not use the Service, directly or through Agents, apps or automations, to:

1. Mine cryptocurrency or run other compute-heavy workloads unrelated to software development, such as proof-of-work, password cracking or bulk proxying.
2. Phish or harvest credentials, including pages on quvos.app that imitate another organisation's sign-in, payment or brand.
3. Distribute malware, ransomware, spyware, botnet components or exploit kits, or host command-and-control infrastructure.
4. Send spam or unsolicited bulk messages, by e-mail, SMS, messaging apps, chat channels or Agents, or run Agents that post or message people at scale without their consent.
5. Attack or scan third parties: denial-of-service, port or vulnerability scanning, brute-forcing, or exploitation of systems you do not own or are not authorised in writing to test.
6. Circumvent limits or isolation: bypass quotas, rate limits, billing, sandboxing, network restrictions or the isolation between workspaces, or access another customer's data.
7. Create multiple free accounts or workspaces to obtain more free usage, or evade a suspension by opening a new account.
8. Resell or sublicense the Service, or provide it to third parties as a hosting or AI-access service, without our written permission.
9. Build surveillance or deceptive impersonation tools: covert tracking of individuals, stalkerware, mass profiling, or Agents and apps that pretend to be a real person or organisation in order to deceive.
10. Interfere with the Service: probe or test our systems for vulnerabilities outside our responsible disclosure process [link TBD], overload shared resources, or tamper with other users' sessions.
11. Misuse AI features to generate content prohibited by this AUP or by the usage policies of the model providers your workspace uses.

3. Your responsibility for Agents and apps

Agents and apps act with the permissions you give them. You are responsible for their behaviour as if it were your own, including actions through MCP servers, connected services and chat channels. Configure sensible limits, review generated code before deploying it, and do not give Agents credentials or permissions they do not need.

Apps and previews served on quvos.app must clearly identify their operator where the law requires it and must not collect credentials or payment details under false pretences.

4. How we detect abuse

To protect the platform we monitor signals such as:

• sustained CPU or GPU usage patterns typical of crypto-mining;
• spikes of blocked outbound connections;
• many sign-ups from the same address or device (assessed with hashed IP and device data);
• disposable e-mail addresses;
• Agents sending messages at spam-like volumes;
• reports and automated checks of phishing pages on quvos.app.

We do not read private workspace content to look for abuse, except where a specific report or signal requires it, and then only as described in the Privacy Policy.

5. Enforcement

Depending on the severity and our confidence, we may:

• throttle resources or outbound traffic;
• require card verification before further use;
• disable a specific Agent, app or preview, or take down reported content on quvos.app;
• suspend the workspace or account pending review;
• terminate the account for serious or repeated violations, and report illegal activity to the authorities.

Where possible and lawful we will notify the workspace owner, say what was found and what was done, and give a chance to fix the issue. We may act first and notify after when there is immediate risk to people, third parties or the platform. Suspensions are reviewed by a person.

6. Appeals

If you believe an action was a mistake, you can appeal via [support contact] within [30] days, explaining the context. We aim to answer within [5] business days. Paid plan fees for a period of suspension that turns out to be unjustified will be credited. [confirm]

7. Reporting abuse

Anyone can report abuse, including phishing, malware or infringing content hosted on quvos.app:

• the abuse form at https://quvos.dev/abuse;
• e-mail to [email protected].

Please include the URL, a description and, where relevant, evidence. Copyright notices should identify the work and the infringing material and include your contact details. We acknowledge reports and act on them as quickly as possible. Security vulnerabilities in Quvos itself should be reported through [security contact].

8. Changes

We may update this AUP as new forms of abuse appear. Material changes are announced in advance, except where an immediate change is needed to address a security threat.