Acceptable Use Policy

Voidhash s.r.o. · Version 1.0 · Effective from 14 October 2026

1. Introduction

1.1. This Acceptable Use Policy ("Policy") sets out what you may not do with the Voidhash hosted cloud service ("Service") operated by Voidhash s.r.o., ID No. 23738944, with its registered office at Chudenická 1059/30, Hostivař, 102 00 Prague 10, Czech Republic ("Voidhash" or "we"). It also explains how anyone can report illegal content and how we handle such reports under Regulation (EU) 2022/2065 on a Single Market for Digital Services ("Digital Services Act" or "DSA").

1.2. This Policy forms part of the Terms of Service ("Terms"). Capitalised terms not defined here have the meaning given in the Terms. The Policy applies to the Customer, all of its users of the dashboard and API, and anyone acting on the Customer's behalf. The Customer is responsible for their compliance.

1.3. This Policy applies to the hosted Service only. Your use of the open-source Voidhash code (including the SDKs and the self-hosted Community edition) is governed by the respective open-source licence; sections 11 to 15 nevertheless apply to anyone who sends us a notice about content hosted in the Service.

1.4. The examples in this Policy are not exhaustive. Where something is not listed but is clearly comparable to a prohibited use, it is also prohibited.

2. Illegal and harmful content

You must not use the Service to create, store, deliver or distribute content (including paywalls, flows, components, images, texts, push notifications and webhook payloads) that:

1. is illegal under the law of the European Union, the Czech Republic, or the country where it is made available to End Users;
2. infringes intellectual property rights, trade secrets, privacy or personality rights of others (for example, unlicensed images, fonts, trademarks or copied paywall designs of other apps);
3. contains or links to malware, phishing pages or other code designed to harm devices or obtain data without authorisation;
4. sexually exploits or endangers minors, incites violence or hatred, or harasses, threatens or defames any person;
5. impersonates another person, brand or app, or misrepresents your identity or affiliation; or
6. promotes goods or services that may not be lawfully offered to the End Users concerned.

The same applies to content you generate with the AI features of the Service. You must review AI output before publishing it.

3. Paywalls and purchase flows

Paywalls and flows built or delivered through the Service must allow End Users to make an informed purchase decision. In particular, you must not:

1. hide or obscure the price, billing period, total amount payable, trial length or the fact that a subscription renews automatically, or display them less prominently than the purchase button;
2. state misleading prices, "discounts" calculated from a price that was never charged, or comparisons that are not true;
3. use fake urgency or scarcity, such as countdown timers that restart, "limited" offers that are not limited, or invented numbers of other buyers;
4. obstruct cancellation or restoration of purchases, for example by hiding the close button, misdirecting End Users to a different purchase, or making false statements about how to cancel;
5. pre-select paid options or bundle unrelated consents with the purchase; or
6. collect payment card numbers or other payment credentials in paywall forms.

4. App store rules and purchase integrity

4.1. You must comply with the rules of the stores through which your apps are distributed, including the Apple App Store Review Guidelines (in particular the rules on in-app purchase and auto-renewable subscriptions), the Apple Developer Program License Agreement, the Google Play Developer Program Policies and Payments policy, and the terms of your payment provider (for example Stripe). We do not review your paywalls for store compliance.

4.2. You must not, and must not help others to:

1. submit forged, replayed or manipulated receipts, signed transactions, purchase tokens or store notifications to the Service;
2. grant entitlements based on purchases that did not occur, or manipulate entitlements to obtain access to content you or others are not entitled to;
3. use the Service to circumvent the billing systems of Apple or Google where their rules require the use of those systems; or
4. use the Service to process purchases of goods or services that the relevant store or payment provider prohibits.

5. Security and protection of the Service

5.1. You must not:

1. access or attempt to access accounts, projects, data or systems you are not authorised to access, including data of other customers;
2. probe, scan or test the vulnerability of the Service, carry out penetration tests or load tests, or attempt to bypass rate limits, authentication or tenant separation, unless we have given you prior written consent under section 5.2;
3. disrupt or overload the Service (including denial-of-service attacks), or send traffic designed to inflate or distort events, tracked revenue or metrics;
4. scrape the dashboard or access the Service other than through the published interfaces (the dashboard, the API, the SDKs and the server libraries);
5. reverse engineer, decompile or attempt to extract the source code of those parts of the hosted Service that are not published under an open-source licence (this does not restrict your rights under open-source licences); or
6. share login credentials or secret API keys outside your organisation, embed secret keys in client applications, or allow third parties to use your account other than as your authorised users.

5.2. We welcome security research. If you wish to test the security of the Service, contact legal@voidhash.com (subject line "Security testing") in advance and describe the scope, timing and methods. You may test only after we confirm in writing, only within the agreed scope, and only against your own projects. Please report vulnerabilities to the same address and give us reasonable time to fix them before any disclosure.

6. Push notifications and messaging

You must not use the push notification features to send:

1. unsolicited commercial communications to End Users who have not agreed to receive them or have opted out, contrary to applicable law (in the Czech Republic in particular Act No. 480/2004 Coll.);
2. messages that are deceptive about their sender or content, or that impersonate the operating system, the store or another app; or
3. messages in a volume or frequency that is abusive or that violates Apple or Google push notification rules.

7. Restricted data

7.1. Unless we have agreed otherwise in writing, you must not send to the Service, in events, person traits, paywall form inputs or any other field:

1. special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR), such as health, biometric or sexual orientation data;
2. payment card numbers, bank account credentials, passwords or authentication codes; or
3. government identification numbers (such as birth numbers, passport or social security numbers).

7.2. If your app is directed at children, or you knowingly process children's data, you must comply with the applicable rules (including Article 8 GDPR, the Czech age of digital consent of 15 years, COPPA and the store rules for apps for children) and configure the SDKs accordingly.

7.3. You must not use the Service in breach of EU, UN, US or other applicable sanctions or export control rules, or for the benefit of sanctioned persons.

8. Accounts, usage and billing

You must not:

1. create multiple accounts or organisations, or split one app across projects, to stay within the limits of the Free plan or otherwise avoid fees;
2. manipulate the measurement of tracked revenue, events or other usage on which fees are based;
3. provide false information at sign-up, including the business declaration; or
4. resell or provide the Service to third parties as a standalone service without our written consent.

9. Published components

9.1. When you publish a component (whether to your organisation only or, where the Service allows it, to other customers), you are its publisher and you confirm that:

1. you own or have the right to license all code, images, fonts and other materials in it, and to grant the installers the rights described in the Terms;
2. the component does what its description and declared capabilities say, and contains no malicious, hidden or obfuscated functionality;
3. the component does not collect, transmit or exfiltrate data of End Users or customers (including purchase data or form inputs) except as necessary for its documented function and through the capabilities it declares;
4. the component does not circumvent the sandbox, capability checks or other protections of the Service or the SDKs; and
5. the component, its name, icon and documentation do not infringe third-party rights or mislead installers.

9.2. We may refuse, withdraw (yank) or block any component version that breaches this Policy, and we may notify the customers who installed it. Automated checks performed when a component is published verify technical conformance only; they do not confirm that the component is lawful or safe, and passing them does not relieve the publisher of responsibility.

10. Enforcement

10.1. If we learn of a possible breach of this Policy, we may investigate it and request information from you. Our response will be proportionate to the seriousness, impact and repetition of the breach. Depending on the circumstances, we may:

1. send you a warning and ask you to remedy the breach within a reasonable period;
2. remove or disable access to specific content (for example a paywall, a component version or an image) or restrict a specific feature (for example sending push notifications);
3. temporarily suspend a project or the account; or
4. terminate the Terms in accordance with their provisions.

10.2. We will normally give you notice and an opportunity to remedy the breach before taking the measures under points 2 to 4. We may act without prior notice where this is necessary to prevent harm to End Users, other customers or the Service, where we are required to do so by law or by an authority, or where the breach is manifest and serious.

10.3. We will inform you of each restriction together with a statement of reasons under section 12. We may report illegal activity to the competent authorities and cooperate with them.

11. Reporting illegal content (notice and action)

11.1. Anyone, including End Users of apps that use Voidhash, can notify us of content in the Service that they consider to be illegal. Send the notice to legal@voidhash.com (subject line "Illegal content").

11.2. To allow us to assess the notice, please include:

1. a sufficiently substantiated explanation of why you consider the content to be illegal;
2. a clear indication of the exact location of the content, such as the URL, or, where the content appears inside an app and has no URL, the name of the app, the platform, a link to its store listing, the screen where the content appears and a screenshot;
3. your name and email address, except where the notice concerns content that may constitute child sexual abuse or exploitation, which you may report anonymously; and
4. a statement confirming your good-faith belief that the information and allegations in the notice are accurate and complete.

11.3. If you give us an email address, we will confirm receipt of the notice without undue delay.

11.4. We will process notices in a timely, diligent, non-arbitrary and objective manner. Where the content is part of a customer's app, we may forward the notice (without your identity, unless it is needed to deal with the notice and you agree, or the law requires it) to the customer concerned and ask for its response. We will notify you of our decision without undue delay and inform you of the available means of redress.

11.5. A notice that meets section 11.2 may give us actual knowledge of the content concerned. Please do not submit notices that are manifestly unfounded. We may process notices from persons who frequently submit manifestly unfounded notices with lower priority or stop processing them, after a prior warning.

11.6. Notices of intellectual property infringement can be sent through the same channel. The notice should also identify the protected work or right and the right holder.

12. Statement of reasons and redress

12.1. If we remove or disable content, restrict its visibility, suspend or terminate the Service or the account, or otherwise restrict your use of the Service because your content is illegal or breaches this Policy or the Terms, we will provide you with a clear and specific statement of reasons, at the latest when the restriction takes effect (unless we do not have your contact details or the law prohibits it). It will state:

1. what measure we have taken, its territorial scope and its duration;
2. the facts and circumstances on which the decision is based, including whether it was taken on the basis of a notice;
3. whether automated means were used in taking or detecting the decision;
4. where the content is considered illegal, the legal ground and why the content is considered illegal on that ground;
5. where the content is considered to breach the Terms or this Policy, the contractual provision relied on and why the content is considered to breach it; and
6. the means of redress available to you under sections 12.2 to 12.4.

12.2. Internal complaint. Within six months after we inform you of a decision, you can submit a complaint against it, free of charge, to legal@voidhash.com (subject line "Complaint about decision"), quoting the decision reference. The person who submitted a notice under section 11 can also complain about our decision on that notice. We will handle complaints in a timely, non-discriminatory, diligent and non-arbitrary manner, under the supervision of a person who was not involved in the original decision, and without relying solely on automated means. If the complaint shows that the decision was wrong, we will reverse it without undue delay. We will inform you of the outcome and the further means of redress.

12.3. Out-of-court dispute settlement. You may refer a dispute about our decision to an out-of-court dispute settlement body certified under the DSA. The list of certified bodies is published by the European Commission.

12.4. Courts and authorities. You may at any time bring the matter before the competent court. You may also lodge a complaint with the Digital Services Coordinator of the Member State in which you are located or established.

13. Points of contact

13.1. Authorities (Article 11 DSA). Member State authorities, the European Commission and the European Board for Digital Services can contact us at legal@voidhash.com. We accept communications in Czech and English.

13.2. Users of the Service (Article 12 DSA). Customers, End Users and other recipients of the Service can contact us directly and rapidly at legal@voidhash.com. Messages are handled by people; we do not rely solely on automated tools to respond. We accept communications in Czech and English.

13.3. Notices of illegal content (section 11) and reports of security vulnerabilities (section 5.2) are sent to the same address; please state the subject in the subject line.

14. Threats to life or safety

If we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person or persons has taken place, is taking place or is likely to take place, we will promptly inform the law enforcement or judicial authorities of the Member State or Member States concerned and provide all relevant information available. Where the Member State concerned cannot be identified with reasonable certainty, we will inform the Police of the Czech Republic or Europol. If you are aware of an immediate threat, contact the emergency services (112) first.

15. Content moderation methods

15.1. Content in the Service is reviewed by people when we receive a notice, a request from an authority, or other information indicating a possible breach. We do not use automated tools to detect, identify or decide on illegal content or content incompatible with this Policy.

15.2. We use automated technical controls that are not content moderation decisions but may prevent content or traffic from being processed, in particular rate limiting and abuse protection at the network edge, validation of data sent to the API, and automated conformance checks of component versions when they are published. If such a control restricts your content in a way that affects you, you may contact us under section 13.2 and use the complaint procedure under section 12.2.

15.3. If we start using automated content moderation tools, we will update this section and describe their purpose and the human review involved.

16. Changes

We may update this Policy for the reasons and in the manner set out in the Terms. Material changes that restrict the permitted use of the Service will be notified at least 30 days in advance by email and in the dashboard, unless a shorter period is required by law or to address a security threat. Previous versions are available on request at legal@voidhash.com.