Acceptable Use Policy

Draft: this policy is not final yet and is shown for transparency. Questions? hello@trycanary.net

DRAFT. Not legal advice. This document must be reviewed by a qualified lawyer (including under the Israeli Computers Law, 5755-1995 and the laws of the main countries where you have users) before publication. Placeholders in {{DOUBLE_BRACES}} must be completed.

Last updated: {{EFFECTIVE_DATE}}

This Acceptable Use Policy ("AUP") is part of the Canary [Terms of Service](terms-of-service.md). It applies to everyone who uses Canary's free check, security scan, dashboard, monitoring and alerts (the "Service"), operated by {{COMPANY_NAME}}.

1. Authorized targets only

You may check, monitor or scan only apps, websites and URLs that you own, or that you have explicit permission from the owner to test.

• "Permission" means authorization from someone with authority over the app (for example the owner, or your employer or client for an app you build or maintain for them), covering this kind of automated testing.
• If your permission ends (for example, a client engagement ends), you must stop monitoring that app and remove it from your dashboard.
• We may ask you to show that you are authorized to test a URL, and we may stop checks of any URL until you do.

Even though Canary's checks are passive and read-only, running them against a site without permission may violate that site's terms or the law. You are responsible for the URLs you submit.

2. What Canary does, and does not do

To help you use it responsibly: Canary loads publicly reachable pages in an automated browser, follows links to sign-up, login and checkout pages, reads files and headers the site serves publicly, and (for the Supabase check) asks publicly exposed tables for at most one row using the site's public key. It does not submit forms, create accounts, log in, attempt payments, guess passwords, fuzz inputs or exploit vulnerabilities. Checks identify themselves with the user agents CanaryBot/0.1 and CanarySecurityScan/1.0. Canary refuses private and internal network addresses.

3. Prohibited uses

You must not use the Service, or attempt to use it, to:

1. check, monitor or scan any app or URL you do not own or are not authorized to test;
2. find, map or exploit vulnerabilities in third-party systems, or prepare or support any attack;
3. collect, copy or use secrets, keys, personal data or other information found in someone else's app, including information revealed by a scan;
4. use any exposed key or credential found by a scan, other than to revoke or rotate your own;
5. bypass or try to bypass rate limits, plan limits, or the restriction on private or internal addresses (for example by using DNS tricks or redirects to reach internal networks);
6. overload, disrupt or degrade any website, including by submitting the same target from many accounts or networks;
7. probe, scan or test the security of Canary's own systems, except as described in Section 6;
8. resell, rent or provide the Service to others as a scanning service without our written permission;
9. create multiple accounts or use multiple email addresses to get around Free plan limits;
10. use the Service in violation of any law, including laws on unauthorized computer access (such as the Israeli Computers Law, 5755-1995), data protection or export control;
11. interfere with other users' use of the Service.

4. Enforcement

If we believe you have violated this AUP, we may, without prior notice, block URLs, stop monitoring, suspend or terminate your access, and cooperate with site owners and law enforcement. Refunds are not normally given for accounts terminated for violations (see our [Refund Policy](refund-policy.md)).

5. Reporting misuse

If you believe Canary is checking your site without your permission, email {{ABUSE_EMAIL}} with your domain and the approximate time. We will investigate and stop unauthorized checks of your site. You can also block our user agents listed in Section 2.

6. Reporting security issues in Canary

If you find a security vulnerability in Canary, please report it privately to {{SECURITY_EMAIL}}. Do not access other users' data, disrupt the Service or publicly disclose the issue before we have had a reasonable time to fix it. {{SAFE_HARBOR_STATEMENT}}

7. Changes

We may update this AUP. The "Last updated" date shows the latest version.

Contact: {{COMPANY_NAME}}, {{ADDRESS}}, {{CONTACT_EMAIL}}.