Acceptable use policy

This policy says what the ironkeel pilot service may and may not be used for, what the service does not promise, and what ironkeel labs Pty Ltd ("we", "us"), which runs it, can and cannot do when it is told of misuse. It forms part of the pilot terms.

1. Who this policy applies to

1.1 This policy applies to every person who uses the ironkeel pilot service: the holder of an account number and anyone who uses a device registered to that account. The account holder is responsible for use through their devices.

1.2 This policy forms part of the pilot terms at /terms. If this policy and the terms conflict, the terms prevail. Words defined in the terms have the same meaning here.

1.3 The service is for adults. You must be 18 or older to hold an account.

1.4 By redeeming a voucher or connecting a device you agree to this policy.

2. Permitted use

2.1 You may use the service for ordinary, lawful internet use through an encrypted tunnel to one of our exit servers outside Australia: browsing, email, messaging, streaming, downloading, working, and anything else that is lawful and does not breach section 3.

2.2 You may register up to five devices per account and use them at the same time.

2.3 You may use the service on networks you are entitled to use, including public Wi-Fi.

3. Prohibited use

You must not use the service, or allow it to be used:

3.1 for anything unlawful under the law of the place where you are or the law of the country where the exit server is;

3.2 to send unsolicited bulk email or messages. Outbound TCP port 25 is blocked on every exit server as a design decision, so direct mail submission does not work anyway;

3.3 to attack, scan, probe, flood or attempt to gain access to any system, network or account without the permission of its owner;

3.4 to distribute malware, or to run command-and-control, phishing or credential-harvesting infrastructure;

3.5 to access, store, share or distribute child sexual abuse material. We cannot see what passes through the tunnel, but where such material comes to our attention, for example because it is sent to support or reported with evidence, we refer it to the Australian Federal Police as the Criminal Code requires of an internet service provider (ss474.25 and 474.33);

3.6 to access, share or distribute abhorrent violent material;

3.7 to harass, stalk, threaten or intimidate any person, or to publish private information about a person without consent (doxxing);

3.8 to commit fraud, including payment fraud, identity fraud or deceptive impersonation;

3.9 to infringe copyright, trade marks or any other intellectual property right;

3.10 to run services that need inbound connections from the internet (web servers, game servers, seeding that relies on reachability, and the like). The service has no port forwarding, by design, so this does not work and asking support to enable it will not change that;

3.11 to resell, sublicense or share access to the service for payment or as part of another product without our written agreement;

3.12 to interfere with other users of the service, with our servers, or with the service's rate limits and protections.

4. What the service does not promise

4.1 Access to any particular website, app or service. Some services block or limit traffic from VPN exit addresses, and some Australian services do not work from an exit outside Australia. We do not undertake to make any service work.

4.2 That any platform will not detect or block VPN use. Platforms may detect VPN use and may act on it.

4.3 Anything about age assurance or the under-16 social media minimum age. The service must not be used to get around age assurance or the minimum-age rules of any platform, and we do not offer, market or support it for that purpose.

4.4 Anonymity against every adversary, or protection that no law could reach. What Australian law can compel is summarised in the privacy statement. The service is configured not to log and has not yet been audited.

5. Shared exit addresses

5.1 Every user of an exit server shares that server's public IP addresses. The consequences of one user's conduct fall on everyone using that address: CAPTCHAs, rate limits, blocks by websites, mail providers or games, and refusals by services that reject VPN addresses.

5.2 We cannot tell which user was responsible for traffic from a shared address, and cannot exempt one user from a block applied to all.

5.3 If a shared address is blocked somewhere, switching exit server is the only remedy available to you, and a change of address is the only remedy available to us.

6. Enforcement

6.1 ironkeel is configured not to log connections or activity and has not been audited. It holds no record of which account did what through an exit server, and so it cannot identify a user from an abuse report, however detailed the report is.

6.2 Where an account is identified as the source of a breach of this policy, for example because the person identifies themselves in a support ticket, in a formal complaint, or through the voucher purchase channel inside the 14-day dispute window, we may warn, suspend or terminate that account.

6.3 Where an account is terminated for breach of this policy, remaining paid time is not refunded.

6.4 We block specific destinations on our own resolvers only when required by law, for example by a Copyright Act s115A order, a Telecommunications Act s313 request or an eSafety notice. Every such block is published at the blocklist page on this website. We do not block destinations for commercial or editorial reasons.

6.5 We may apply protections that affect all users equally, such as the outbound port 25 block, client-to-client isolation and connection rate limits, to keep our servers and hosting in service. During the pilot these are the port 25 block, the SMB and NetBIOS blocks, client isolation and a limit on how fast each device can open new connections; connections over the limit are dropped.

6.6 We count abuse and copyright complaints and publish the counts in our transparency report. We do not publish anything about any individual complaint or account.

7. Reporting abuse

7.1 Reports of misuse go to abuse@ironkeel.app, which is also published on the terms page, or through the support ticket form.

7.2 Include: the exit IP address involved; the date and time with time zone; the destination or target; what happened, with any log excerpt or evidence; and how to reach you for a reply. Reports without a timestamp or address cannot be matched to anything, and even complete reports cannot be matched to a user (6.1).

7.3 We acknowledge reports within one business day and say plainly what we can and cannot do. Reports are deleted with the ticket 30 days after it closes, unless they enter the formal complaints register.

7.4 Reports of child sexual abuse material or abhorrent violent material are handled under clause 3.5 and 3.6 and the AFP referral procedure, not through the ordinary abuse queue.

8. Changes to this policy

8.1 We may change this policy. Changes are published on the website with the date of change and a summary, and are announced through the notices endpoint, the status page and the account page (and on RSS and Mastodon once they exist) at least 14 days before they take effect, except where a change is required by law sooner.

8.2 Continued use after the effective date is acceptance of the change. If you do not accept a change you may delete your account; the refund position is set out in the pilot terms.

8.3 The current version and its date are shown at the top of the published policy. The change history is kept at the end of this document.