Acceptable Use Policy

1. Illegal content and activity

Do not use Koru hosting for anything that is illegal in Sweden, in the EU, or where your app is offered. In particular, do not publish, store or send:

• child sexual abuse material, or anything that sexualises children. We remove it, end the account and report it to the police;
• terrorist content, or content that recruits people to commit crimes;
• threats, or incitement to violence or to hatred against groups of people;
• content that infringes copyright, trademarks or other rights;
• other people’s private information, such as addresses, ID numbers or intimate images, published without their consent;
• content or services that sell or help sell illegal goods or services, such as drugs or weapons;
• fraud, such as fake shops, investment scams, or sites that pretend to be another business.

Do not process personal data unlawfully.

2. Content we do not allow

Even where it would be legal, do not use Koru hosting for:

• harassment or bullying;
• content that glorifies violence, or encourages self-harm or suicide;
• sexually explicit content (pornography).

3. Security and network abuse

Do not use Koru hosting to:

• spread malware, or run phishing pages or command-and-control servers;
• attack others, for example with denial-of-service floods or botnets;
• scan, probe or test the security of systems that are not yours, including other customers’ apps and the platform itself;
• get into accounts, systems or data without permission;
• get around Koru hosting’s isolation: escape the sandbox your app runs in, or reach other customers, the platform’s control systems or the servers’ own addresses;
• run open proxies or open mail relays that others can misuse.

You may test the security of your own apps, as long as the tests do not affect the platform or other customers. Testing the platform itself needs our written permission. Report security problems you find to support@flybywire.se.

4. Email and messages

Do not send spam: unsolicited bulk or commercial messages, by email or any other channel. Do not forge senders or headers, and do not collect addresses without consent. Send email through an email provider, with its login: our servers do not let apps send email on port 25.

5. The platform’s resources

• Do not mine cryptocurrency, by proof of work, proof of space or any other method.
• On servers you share with other customers, do not use the platform in a way that is meant to degrade it for others, or that does.

6. Your own users

If your app lets others publish content or run code, make them follow rules at least as strict as these, act on notices about their content, and remove what breaks the law. You are responsible for your app, including what your users do with it.

7. How we enforce this policy

What we can see

Koru hosting is built so that we do not see inside your apps: we do not see your data, your logs or what your apps send to their visitors (Hosting Terms, section 3). We learn about problems from:

• notices from anyone, through Report illegal content;
• reports to our abuse contact;
• our providers, and authorities;
• what anyone can see on the public internet, such as your app’s public pages;
• measurements of the platform, such as processor and memory use, traffic volumes and request counts, which can show mining, floods or scanning.

What we do

We look at each case and choose what fits it: how serious it is, whether it continues, and whether it is deliberate. We cannot change content inside your app, so we usually ask you to remove it first, and disable the app if it is not removed in time. In serious or urgent cases, such as child sexual abuse material, terrorist content, attacks in progress, malware, phishing or an order from an authority, we disable the app or suspend the account at once. We end the accounts of repeat infringers. We report suspected crimes that threaten someone’s life or safety to the police.

Automated tools

If a tool stops an app on its own, for example during an attack in progress, we say so in the statement of reasons, and a person reviews the decision.

Statement of reasons

When we restrict an app or an account, we email you a statement of reasons, at the latest when the restriction starts. It says:

• what we did, for example disabling an app or suspending the account, where it applies and for how long;
• the facts we relied on, and whether we acted on a notice or on our own findings;
• whether automated means were used;
• the law we relied on and why the content is illegal under it, or the rule of this policy we relied on and why the content breaks it;
• how you can ask us to look at it again, and your other ways to challenge the decision.

We do not send one where the law forbids it, for example when an authority has asked us not to tell you yet.

Asking us to look again

Reply to the statement of reasons within six months. A person looks at the decision again and tells you the outcome. You can also take the matter to a Swedish court, or complain to the Digital Services Coordinator of the country where you are located or established. In Sweden that is the Swedish Post and Telecom Authority (Post- och telestyrelsen, PTS).

8. Terrorist content

Terrorist content is not allowed on Koru hosting. When an authority in the EU orders us to remove terrorist content under Regulation (EU) 2021/784, we remove it or disable access to it within one hour of receiving the order. We keep the content and its related data for six months, and we tell the customer, unless the authority decides that the customer must not be told yet. We do not use automated tools to find terrorist content.

9. Changes

We update this policy when the law, our providers’ rules or new kinds of abuse require it. We tell you about changes by email and in Koru before they take effect, as the Hosting Terms describe.