Acceptable use

The short list of things you must not do with a mineral, and what enforcement honestly means when the machine is yours.

Version 0.4, effective 2026-09-09. Samuel Davis trading as Crads AI.

A mineral is a machine on the internet with your credentials on it and an assistant that can act. This page is the short list of what you must not point it at. Part of the terms.

Version 0.3, effective 1 September 2026. (Changed in 0.3: the self-host redesign. The resale line now defers to the coming open-source licence, the platform-attack line now names what actually exists to attack, and the enforcement section says plainly what we can and cannot do about a machine we cannot reach. The conduct list itself is unchanged.)

Do not#

  • Break the law with it. Any law that applies to you.
  • Use it against other people. No harassment, no stalking, no building profiles of people who have not agreed to it, no scraping someone's data in a way they have not agreed to, no attacking anyone's systems.
  • Put other people's confidential material on it unless you are entitled to hold that material. Your own client list, yes. A list you took from a former employer, no.
  • Send bulk unsolicited mail from it. Your assistant can reach your inbox. That is not a mailing tool and using it as one will get your own email domain burned before anyone else notices.
  • Use it to generate material that sexualises children, incites violence, or is designed to deceive someone into losing money. This is a short list and it is not negotiable.
  • Pass your assistant off as another person. It drafting and sending as you is the product; the interview even learns your voice for it. Using it to write as somebody else, or to make automated output look like a specific real person wrote it, is not.
  • Misrepresent the software. Do not resell it as your own product or charge people for the software itself; charge for your services, plainly labelled as yours. The coming open-source licence will state the binding version of this.

Some judgement, honestly#

Your assistant works from your notes and can act on your accounts. Two things follow that are your call and not ours to police:

  • What you put in your brain is up to you, and nobody else can look. If you keep material there that would be damaging in the wrong hands, put credentials in the sealed tier and read the privacy policy on what a support session can see.
  • Automating a decision is still your decision. If you schedule your assistant to send things on your behalf, what it sends is from you. Read the cadence you install.

One more boundary that is not ours: your assistant runs on your own Claude account, so Anthropic's usage policies bind that use too, under your agreement with them, as the terms set out.

Security research#

If you find a vulnerability, we want to hear it, and you will not be in trouble for having looked. Email cradsdavis@gmail.com with what you found and how.

What we ask: do not use other people's minerals as your test target, do not exfiltrate anyone's data to prove a point, and give us a chance to fix it before you publish. What you get: a real answer from the person who wrote the code, and credit if you want it.

If you break this#

Honesty about enforcement, because the old kind is gone: your mineral is your machine, and we cannot reach it, suspend it or delete it. What we can do is stop dealing with you: end paid services and decline support. Unlawful use is between you and the law, and where the law obliges us to act on something we operate, we will.