Skip to content
NoptchaNoptcha Docs
Draft — not yet in effect. This document has not been reviewed by counsel and does not govern your use of Noptcha.

Acceptable Use Policy

Last updated: [TBD: date] · Effective: [TBD: effective date]

This Acceptable Use Policy (“AUP”) is part of the Terms of Service. It applies to everyone who uses Noptcha, including every member of an organization and everyone who uses its API keys. The organization is responsible for all use made with its keys.

Captcha solving has legitimate uses: testing and monitoring your own websites, accessibility, research, quality assurance and automating access to services you are authorized to use. It can also be misused. You may use Noptcha only for lawful purposes and only to access websites, accounts and systems that you are authorized to access.

Prohibited uses

Section titled “Prohibited uses”

You may not use Noptcha, directly or through someone else, to:

  1. Gain unauthorized access. Access accounts, systems or data without authorization; bypass access controls or security measures of systems you are not authorized to access.
  2. Take over accounts. Credential stuffing, password spraying, brute-forcing logins or one-time codes, or any other attempt to take over accounts that are not yours.
  3. Commit fraud. Payment fraud, card testing (“carding”), using stolen identities or payment details, creating accounts with false identities for fraud, phishing, or obtaining money, goods or services by deception.
  4. Manipulate counts and outcomes. Fake votes, fake reviews, fake sign-ups or fake engagement; inflating views, clicks, followers or other metrics; ad fraud; automated purchase of limited inventory (such as tickets) in breach of law; or manipulating polls, contests, giveaways or elections.
  5. Send spam. Send unsolicited bulk messages, post spam comments or forum content, or create accounts in bulk to send spam.
  6. Distribute illegal or harmful content. Child sexual abuse material, content that infringes intellectual property, malware, or any other content that is illegal where it is published or received.
  7. Harm people. Harass, stalk, threaten or intimidate anyone; collect personal data unlawfully; or dox people.
  8. Evade sanctions or export controls. Use the Service from, for, or on behalf of sanctioned countries, regions or persons, or to help anyone evade sanctions or export controls.
  9. Abuse target websites. Send traffic that overloads or disrupts a website or service (including denial of service), or collect data in violation of applicable law.
  10. Break the law. Do anything else that violates applicable law or regulation, or that helps someone else do it.

Abuse of Noptcha itself

Section titled “Abuse of Noptcha itself”

You may not:

  • attack, probe or overload the Service, try to get around rate limits, concurrency limits or key restrictions, or try to access other customers’ data or tasks;
  • use proxies, accounts or credentials you are not authorized to use in task parameters;
  • deliberately submit false reports about answers, or report answers in bulk without checking them;
  • create multiple accounts or organizations to abuse sign-up offers or promo codes, or to get around a suspension;
  • top up with payment methods you are not authorized to use, or file chargebacks for payments you made;
  • resell or offer the Service to others [TBD: whether reselling, white-labeling or integrating Noptcha into a product sold to others is allowed, and on what conditions];
  • use test keys or the sandbox for load testing beyond its published limits.

How we enforce this policy

Section titled “How we enforce this policy”

Enforcement is largely automated: rules detect patterns of abuse and act on them, and you can appeal. Depending on the case we may, without prior notice:

  • reject or rate-limit requests, or block an IP address or network;
  • disable or revoke an API key;
  • freeze an organization, so that it cannot create tasks, top up or redeem promo codes;
  • withdraw promotional credit obtained in breach of this policy;
  • close the account, as described in the Terms of Service;
  • report the activity to the payment processor or to the authorities where required or appropriate.

When we freeze an organization or close an account, the console shows that it is frozen. [TBD: whether and how we notify the owners by email, and the exceptions (legal prohibition, ongoing investigation)]

Appeals. If you think we got it wrong, write to [TBD: appeals contact] from an email address of an owner of the organization, with the organization ID and an explanation of your use case. We may ask for more information. [TBD: target response time for appeals]

Reporting abuse

Section titled “Reporting abuse”

If you believe Noptcha is being used against your website or service in breach of this policy, contact [TBD: abuse contact] with as much detail as you can (times, the requests or traffic you saw, and what happened). We do not publish who our customers are; we review reports and act under this policy.

Section titled “Law enforcement and legal requests”

We cooperate with law enforcement and other authorities when we receive valid legal process (such as a subpoena, court order or warrant) that applies to us. We review each request, and we may refuse or narrow requests that are invalid or too broad. We may preserve data relevant to a request. [TBD: whether and when we notify the affected customer about a request, and whether we publish a transparency report] Requests should be sent to [TBD: legal process contact]. What data we hold, and for how long, is described in the Privacy Policy.

We may also disclose information without legal process when we believe in good faith that it is necessary to prevent imminent harm to a person, or to protect the Service, our customers or others from fraud or abuse.

Changes

Section titled “Changes”

We may update this policy. Material changes are announced as described in the Terms of Service.