Acceptable use policy

This is the document we point at when we restrict an account, which is the only honest reason to have one. It forms part of the terms of service, and “you” here means whoever the terms say it means.

Free email attracts people who want to send a great deal of it. Almost everything below exists so that everybody else’s mail keeps arriving.

1. The rule underneath all of it

Send mail a reasonable person would call legitimate, to people who are willing to receive it. If a clause below does not cover something you are about to do, that sentence does.

2. Content you may not send or store

You may not use Pidgeon to send, store, publish or link to:

• Anything that is illegal where you are, where we are, or where the recipient is.
• Child sexual abuse material. There is no context in which this is tolerated, no notice period, and no appeal: an account is terminated immediately and the matter is reported to the competent authorities.
• Content that harasses, threatens, stalks or defames a person, or that incites violence against anyone.
• Malware, ransomware, exploit kits, or attachments whose purpose is to compromise the recipient.
• Phishing of any kind — mail that impersonates a person, a company, a bank or a public authority in order to obtain credentials, payment or data.
• Material you have no right to distribute.

3. Sending behaviour

You may not:

• Send unsolicited bulk email. Recipients must have given you their address for the purpose you are writing to them about, and you must be able to show when and how if we ask.
• Send commercial mail without a working, honest way to stop receiving it, or continue sending to someone who has used it.
• Forge headers, falsify the envelope sender, or send from a domain you do not control. Domain verification exists precisely so that this is difficult here.
• Harvest addresses, buy lists, or mail addresses obtained by scraping.
• Keep sending to addresses that bounce hard, or ignore complaint feedback. Repeated delivery to dead addresses damages the reputation every account on this service shares.
• Operate a mail service for a third party out of your account in a way that hides who is actually sending — a customer of yours sending under your account is fine, a laundering arrangement is not.

4. Technical behaviour

You may not:

• Work around the sending limits, the rate limits or the trust tiers — by creating extra accounts, by splitting a send across domains, or by any other route. The limits are a shared resource, not a paywall.
• Probe, scan or attempt to interfere with the service or with other accounts. Genuine security research is welcome and goes to security@pidgeon.ai — tell us before you test, not after.
• Use the API or webhooks in a way that is designed to degrade the service for others.
• Resell raw capacity — addresses or send volume — as a product of its own. Building a product on Pidgeon is the point; reselling Pidgeon as Pidgeon is not.

5. Addresses your software owns

An application, workflow or agent address has no inbox: mail arriving there becomes an event and your endpoint is called. That makes automated sending easy, and this clause is the other half of it.

You are responsible for what your code sends, exactly as if you had typed it. An automated reply loop, a runaway retry, or a model that decides to mail a list are all your account’s sending, and they count against your limits and your trust the same way. Put a stop condition in anything that replies automatically; a pair of auto-responders can generate thousands of messages before a human notices.

Where software sends on behalf of a person, say so in the mail. Nothing here prohibits automated mail — it is most of what this product is for — but mail that conceals that it came from software, in a context where a recipient would assume otherwise, is covered by the impersonation clause in §2.

6. How we find out

Three ways, and none of them is a person reading your mail:

• A spam classifier runs over inbound mail, and its verdicts are recorded.
• Trust scoring and per-account limits. A new account starts well below its plan’s daily allowance and earns its way up as its mail is accepted and not complained about.
• Reports — from recipients, from other providers, from our mail provider’s complaint feedback, and from anyone writing to abuse@pidgeon.ai.

A report should say which address, roughly when, and what the problem is. Headers help more than a screenshot.

7. What we do about it

Proportionate, and in this order where the situation allows it:

1. We tell you, at your account address, what we have seen.
2. We restrict sending from an address or an account — a lower limit, a pause, or a block on creating new addresses.
3. We suspend the account, which stops sending and creating entirely.
4. We terminate it, for serious or repeated breaches, with the notice and the export window described in the terms.

Restriction and suspension never stop mail arriving, and never delete a message. Your correspondence is not leverage — not over an abuse investigation and not over an unpaid invoice.

We skip straight to termination for the things in §2 that have no innocent version, and for anything we are legally required to act on immediately.

8. Telling us we got it wrong

Reply to the notice, or write to abuse@pidgeon.ai. Say what you think happened. A person reads it, and a restriction that turns out to have been wrong is lifted and said to have been wrong.

If you are in the EU and we have restricted or removed something of yours, the Digital Services Act gives you the right to a statement of reasons, to an internal complaint, and to an out-of-court dispute settlement body. The notice we send is that statement of reasons; this section is that internal complaint; and the legal notice names the authority that supervises us.