Acceptable use

Who it binds

This policy binds every account, inbox, key and agent that sends or receives mail through the service. Whoever holds a key answers for everything sent with it, including messages an automated agent composed and sent on its own. Where this page says "you" it means the account and every agent acting under its keys.

The four sending classes

Every inbox sends under exactly one class, chosen when the inbox is created. The class sets the limits that apply, the proof of consent we ask for, and how strictly the thresholds below are read. An account may hold different classes on different inboxes; no inbox may send outside its own.

• transactional
  No marketing of any kind. Verification codes, password resets, receipts, notifications, contact-form relay, replies in a conversation that already exists, and an agent's correspondence with people who wrote first. The default.Consent: the recipient started the exchange or holds an account with you.
• limited_marketing
  Occasional announcements to a list you upload, capped at one message per recipient per seven days.Consent: the list itself, with the relationship stated for every address on it.
• opt_in_only
  Newsletters and updates to people who asked for them.Consent: double opt-in evidence recorded per recipient before the first send: when they confirmed, from where, and the token they confirmed with.
• own_customers
  Account, billing and service notices to the customers you already have. No prospecting.Consent: proof of the customer relationship.

There is no cold-mail class, no bulk class and no purchased-list class. We do not offer one at any price, and we make no exception for volume, for personalization, or for an introduction described as warm.

What is not allowed

The service may not be used to send or relay any of the following:

• Unsolicited mail of any kind: cold outreach, follow-up sequences to people who never answered, and introductions to anyone who has not asked to hear from you.
• Mail to lists that were bought, rented, scraped, harvested or borrowed, or to addresses guessed from a name and a domain.
• Phishing, spoofing, or impersonation of a person or an organization, including a sender name or reply address you are not entitled to use. The sending address is always the inbox's own; an attempt to override it is refused.
• Malware, credential harvesting, links to either, or content that hides where it leads behind shorteners and redirect chains.
• Content that is illegal where you or the recipient are, including fraud, harassment, threats, and material that exploits minors.
• The categories that draw complaints no matter how consent was obtained: adult content, pharmaceuticals, gambling, multi-level marketing, payday lending, cryptocurrency promotion, list brokering and lead generation.
• Anything that gets around a limit, a hold, a suppression list or a sending class, including spreading the same traffic across several accounts.

Agents are held to every rule above. That an agent decided to do it is not a defense.

Limits

Limits are there so that one sender's mistake never costs every other sender their delivery. They are enforced as mail is submitted, and a send over a limit is answered with a wait, never dropped on the floor.

• Per inbox and per domain. Each inbox has a daily limit and a short-window limit; each domain has a daily limit of its own. The defaults for a new account are modest, in the low thousands a day per domain, and are meant for working systems rather than campaigns.
• Bursts. An inbox may send only so many messages in one minute. A loop is slowed on its first few rounds.
• New recipients. Addresses an account has never written to, heard from or recorded consent for are counted separately, per inbox per hour and per account per day, and the allowance depends on the sending class. A message to several strangers counts each of them and is admitted or refused whole.
• Bounce-rate hold. If one in ten of an account's messages over the last hour comes back as undeliverable, with enough sends to mean something, the account is held on the spot and the message that crossed the line is parked with it.
• Content scoring. Every outgoing message is scored for spam content before it leaves. A high score parks the message for a person to look at; a very high score refuses it. Parked mail is released or refused within three days, and an outage of the scorer never delays anyone's mail.
• Raised only on request. Limits rise when a sender asks and has shown it behaves. Nothing in the API lets a key raise its own.

Enforcement

Complaint rates, bounce rates, blocklist listings traced to an account, refused content and the shape of recent sending are each scored, and the score decides what happens. We are stricter than the large providers ask us to be, so that the shared reputation of every sender here stays clean.

• Warned once. The account is told what we saw, with the evidence, and its limits are halved while the cause is fixed.
• Held. If the cause is not fixed, or the same thing happens again within thirty days, new sends are accepted and held for three days so that a problem that is being fixed loses nothing. Reading, receiving, keys and domain settings keep working while held. Once the rates are back under the line, the held mail goes out and full limits return.
• Closed. A week without remedy, or a third strike, closes the account. Sending and receiving stop; the evidence and a full export of the account's mail stay available to it for thirty days.

We say why at every step. A hold or a closure can be appealed through the contact page, and the appeal is read against the same evidence the decision was made on.