Acceptable Use Policy

This policy is part of the Terms of Service and applies to everything you do through the API.

Everything on this list is here for one of three reasons: it is unlawful, it causes harm, or it puts the service at risk for everyone else.

What is not on this list matters too. We do not restrict what you build, who you sell it to, or what you do with the output. Section 6 says so explicitly. This policy is about conduct and content, not commerce.

1. Illegal and harmful use

You must not use the service to:

• Break the law, or help someone else break it.
• Generate, solicit, or attempt to obtain child sexual abuse material, or any sexual content involving minors, whether real or synthetic.
• Produce sexual imagery of a real person without their consent, or intimate imagery of anyone who has not consented to it.
• Produce malware, ransomware, exploits, or tooling whose purpose is unauthorised access to systems or data.
• Harass, threaten, stalk, defame, or incite violence against anyone.
• Impersonate a real person or organisation — including us — in a way designed to deceive.
• Commit fraud, run phishing or other scams, send unlawful spam, or engage in deceptive commercial practice.
• Fund an account with the proceeds of crime or with a card you are not authorised to use, or use the service to launder money, evade sanctions, or finance terrorism.
• Generate targeted disinformation, or content designed to interfere with an election or a democratic process.
• Obtain instructions for chemical, biological, radiological, nuclear, or high-yield explosive weapons, or for any weapon intended to cause mass casualties.
• Encourage or assist self-harm, suicide, or disordered eating, or exploit anyone’s vulnerability to them.
• Infringe intellectual property rights or misappropriate trade secrets.

2. Decisions about people, and things that must not fail

Model output is a statistical prediction. Two kinds of use ask more of it than it can carry: decisions that land on a person, and jobs that must not fail.

• Do not make automated decisions about a person’s employment, credit, housing, insurance, education, immigration status, or legal rights without meaningful human review.
• Do not present model output as advice from a qualified medical, legal, or financial professional.
• Do not use the service for biometric identification, for inferring emotion in an employment or education setting, or for predictive policing.
• Do not use the service for time-critical or mission-critical functions, or anywhere failure could cause injury, or serious physical or environmental harm. There is no uptime commitment, capacity depends on upstream providers, and any request can fail at any time — see Section 11 of the Terms.

3. No personal data

Do not submit personal data through the API. Not names or contact details, government identifiers, financial account numbers, health information, biometric data, precise location, or anything at all about a child.

This is an outright prohibition rather than a duty to have a lawful basis, and the reason is structural: we retain nothing of a request, so if you send personal data we cannot find it, produce it, or delete it, and we cannot tell you what an upstream provider did with it. Section 8 of the Terms and Section 3 of the Privacy Policy say the same thing from their own angles.

4. Model integrity

• Do not circumvent, disable, or engineer around a model’s safety measures.
• Do not attempt to extract system prompts, model weights, or training data.
• Do not present model output as human-authored where doing so deceives someone to their detriment.

5. Technical abuse

• Do not degrade the service for other customers — by flooding it, by deliberately exhausting shared resources, or otherwise.
• Do not access accounts, keys, or data that are not yours, or interfere with the operation of the service.
• Do not scrape or bulk-copy our site, dashboard, models page, or documentation, or harvest data from the service by automated means beyond ordinary use of the API.
• Do not probe, scan, or test our security without written permission. If you find something anyway, report it privately to security@caft.dev and give us a chance to fix it — we will not pursue anyone who does.

6. What this policy does not restrict

We sell capacity. What you build on it is your business, and we would rather say so than leave you to infer it:

• You may resell or redistribute access. Put us behind your own product, serve your own customers, run an agency. No separate agreement with us is needed.
• You may use the output for anything these rules permit, including training or evaluating your own models, and including building something that competes directly with us.
• We set no limit on accounts or team size. Rate and concurrency limits are per account and are the only limits that apply.

One thing comes back the other way. If you resell or otherwise give others access through your account, their use is your use. This policy travels with the access: you are responsible for what your customers do as if you had done it yourself, and it is on you to bind them to terms at least as strict as these.

7. Enforcement

Where a breach is serious or unlawful we may suspend or terminate without notice, and may report it to law enforcement and to the upstream provider involved. Otherwise we will tell you what the problem is and give you a chance to fix it, where the circumstances allow.

Where throttling or a rate limit would solve the problem, we would rather do that than close an account.

Termination for breach forfeits any remaining credit balance — Section 6 of the Terms. That is the consequence of a breach, so it does not apply to a suspension we later determine was mistaken: if we get it wrong, we restore the account and the balance. If you think we have, write to support@caft.dev and we will look again.

8. Reporting misuse

Report misuse of the API, or content generated through it, to abuse@caft.dev. Report security vulnerabilities to security@caft.dev. Both are monitored.

Tell us what you saw and when, and how you came across it. We cannot search request content — we do not keep any — so what you can show us is usually all there is to go on.

9. Changes to this policy

We may update this policy. The date it was last updated appears at the top of this page, and a change is notified by publishing it here and nowhere else, on the same terms as Section 16 of the Terms.