Acceptable Use Policy

• Version: 0.1 (draft)
• Date: 2026-10-14
• Applies from: [[PLACEHOLDER: effective date]]

This policy is part of the Terms of Service. It applies to every app on hyad, whether it is served at <name>.hyad.app or on a custom domain, and to everyone who uses the hyad portal, API or MCP server, including AI assistants acting for you.

1. Not allowed

Deception and fraud

• Phishing: pages that collect passwords, payment details, one-time codes or other credentials by pretending to be someone else.
• Imitating hyad, its sign-in or passkey prompts, or another brand, person or organisation in a way that can mislead.
• Scams, fake shops, fake invoices or reviews, and other fraud.

Harmful software and attacks

• Malware, viruses, ransomware, or links that deliver them; drive-by downloads.
• Cryptocurrency mining, or using an app to attack, scan or flood other systems.
• Open proxies, or using an app's server code to hide where traffic comes from.
• Probing or attacking hyad, other apps or their users. Security research is welcome only through the contact in section 4, and without accessing other people's data.

Spam

• Sending unsolicited bulk messages (email, chat, comments, notifications) from or for an app, or hosting pages promoted that way.
• Abusing hyad's own mails, for example by signing up other people's addresses.

Illegal and harmful content

• Content that is illegal in [[PLACEHOLDER: hyad's country, likely the Netherlands]] or the EU, including child sexual abuse material (reported to the authorities at once), terrorist content, illegal hate speech, and content that infringes copyright, trademarks or other rights.
• Selling or promoting illegal goods or services.
• Publishing other people's personal data without a lawful basis (doxxing), harassment or threats.
• Adult (sexual) content, gambling and weapons, also where they are legal.

Misuse of the platform

• Getting around plan limits or holds, for example with several Free accounts for one purpose, or claiming app names only to hold or sell them.
• Using hyad as general file storage, a file-sharing service or a content delivery network for content served elsewhere.
• Running an app that breaks the law on data protection, consumer protection or e-commerce towards its own visitors.

2. Custom domains

A custom domain is another address for an app hosted on hyad. It must:

• serve only content of that hyad app (it cannot point hyad at content hosted elsewhere);
• be a domain you control or have the owner's permission to use (hyad checks a DNS proof when you add it);
• follow this policy exactly as the <name>.hyad.app address does.

Holds apply to every address of an app at once. We may also disconnect a custom domain that is used for abuse, that looks confusingly like another brand (for example a look-alike domain), or whose DNS no longer points at hyad (after 7 days without the DNS record, a domain is disconnected automatically).

3. How we moderate, and what an admin hold means

How we find problems. Through reports (section 4), our own review, and these automated tools:

• the sign-up guard, which refuses sign-ups from disposable email domains and above daily sign-up limits per network and per email domain;
• Cloudflare Turnstile, a bot check on the sign-up and password reset pages;
• rate and resource limits, which slow down requests or pause an app when it reaches a plan limit (Terms, section 7).

These tools do not decide about content. A person decides on every admin hold.

If we believe an app or account breaks this policy, we may put it on admin hold:

• App hold: the app stops serving at every address (its own and custom domains). Visitors see that it is unavailable. The hold stays with the app's name: while it lasts, no one can claim that name, also after the app is deleted. When we release the name, it starts clean: no hold carries over to the next owner.

• Account hold: every app of the account stops serving, and the account cannot deploy, create, start, stop or delete apps.

• Nothing is deleted during a hold. Content is kept so that it can be reviewed, restored, or handed to the authorities where the law requires.

• We send the owner a statement of reasons, unless the law forbids it or it would defeat the purpose. It says:

  • what we restricted (app or account) and the category of the problem (phishing, malware, spam, illegal content, child sexual abuse material, intellectual property or trademark, a breach of these terms, or other);
  • an explanation of the facts and the rule in these terms or the law it is based on;
  • whether we acted on a report or on our own or automated detection;
  • how to contest the decision with us, and that the owner can also go to court or, where available, to a certified out-of-court dispute settlement body (DSA Art. 21).

  We send it by email and show it in the owner's hyad account wherever the hold is shown. When we disconnect a custom domain for abuse (section 2), the owner gets a statement of reasons in the same way, shown with the domain on the app's page. Domains disconnected automatically (no DNS record for 7 days, or no longer covered by the plan) get the usual notice instead.

• How to contest a decision. The owner can appeal it in the portal: signed in, with Appeal this decision next to the statement of reasons (on the app's page for an app or a custom domain, on the dashboard for an account), saying why. Someone who sent a report can appeal our decision on it the same way, signed in with the email address they reported with, on the Appeals page with the report's reference. Or by email: reply to our email or write to support@hyad.app. A person reviews every appeal, and we tell you the outcome and our reasons by email; the Appeals page in your account shows where it stands. One appeal per decision can be open at a time; the portal takes appeals for six months after the decision. If we reverse a hold, we lift it at once. If we reverse the disconnection of a custom domain, we do not reconnect it ourselves: you add it again from the app's page (with a new DNS proof).

For serious cases (for example phishing, malware, child sexual abuse material) we act first and tell the owner after. Repeated or serious breaches can end the account (Terms, section 9).

App names that infringe others' rights (for example a trademark) may be blocked, renamed or reassigned without a hold on the account (Terms, section 4.6).

4. Reporting abuse

Anyone can report an app or content on hyad, without an account:

• Web form: https://hyad.app/report-abuse
• Email, if the form does not work for you: support@hyad.app

Please include:

1. the full address (URL) of the content;
2. why you think it is illegal or breaks this policy (for illegal content, a sufficiently substantiated explanation);
3. your name and email address (not needed for reports of child sexual abuse material);
4. a statement that you believe in good faith that the report is accurate and complete.

We do not share your name or email address with the app's owner: the owner only learns that a hold was based on a report. We confirm receipt (if you gave an email address), review reports within 5 working days (serious cases, such as child sexual abuse material or phishing, faster), and tell you what we decided and how you can contest it. We may report criminal content to the authorities.

Security vulnerabilities in hyad itself: support@hyad.app.

Authorities (DSA Art. 11) reach hyad at support@hyad.app, in English or Dutch.