Acceptable Use Policy

1. Purpose and Scope

1.1 What this policy covers. This policy sets the rules for using the Createrun services, including the Software, the Cloud Services, the Development Services, the Createrun Agent, the MCP interface and the Createrun Store (together, the "Services"). It covers what you host, build, run, distribute or transmit through the Services, and how you behave toward Createrun, its staff, other customers and the end users of applications built with the Services.

1.2 Who it binds. This policy binds every Account and Organization, and everyone acting under them, including employees, contractors, agents, automated processes, and AI clients connected through the MCP interface. You are responsible for anything done through your Account or Organization.

1.3 Relationship to your agreements. This policy is incorporated into the Createrun Terms of Service and, for publishers, into the Createrun Publisher Agreement. A breach of this policy is a breach of those agreements, and the remedies in them, including suspension and termination, apply.

1.4 Examples, not a complete list. The rules below describe categories of conduct, with examples. Conduct that is not listed may still breach this policy if it is unlawful, deceptive or harmful to people, to the Services or to other customers. If you are unsure whether something is allowed, ask at support@createrun.com before you do it.

1.5 Self-hosted use. Createrun does not monitor Self-Hosted Installations. This policy still applies to them, and in particular to your use of Createrun's hosted licensing, update, Store and Development Services from them.

2. Prohibited Uses

2.1 Illegal and harmful activity

You may not use the Services for any unlawful purpose, or to promote, facilitate or carry out unlawful activity. You may not publish content or functionality that facilitates serious harm to people, including instructions for weapons or attacks intended to cause mass casualties. Content that sexualizes, exploits or endangers minors is absolutely prohibited and will be reported where the law requires. Content that incites, glorifies or coordinates violence, or promotes violent extremism, is prohibited.

2.2 Malicious code

You may not create, store, build, run or distribute malware, ransomware, spyware, keyloggers, droppers or any code designed to damage, disable or take unauthorized control of a system or data. You may not ship code that downloads and runs a payload that you have not disclosed. You may not modify or interfere with other applications, the Services or a host environment without authorization from the party that controls it. Security research tools are allowed only where their purpose is stated plainly and they cannot be triggered without the operator's knowledge.

2.3 Fraud, phishing and deception

You may not use the Services to harvest credentials, to imitate the sign-in page of another service, to collect payment details under false pretenses, or to deceive people about who you are or what an application does. Claims about capability, pricing, certification or affiliation must be true.

2.4 Infringement

You may not use, store or distribute content that you have no right to use, including code, libraries, media, fonts, data sets and documentation, or use another party's trademarks in a way that implies endorsement, sponsorship or affiliation. Accurate statements that your application integrates with a named service are allowed.

2.5 Privacy and covert data collection

You may not collect or process personal data without a lawful basis, without the notices and consents that applicable law requires, or beyond what your stated purpose needs. You may not send end user data to destinations you have not disclosed, and you may not use fingerprinting or similar techniques to track people in a way that evades their choices. You may not use the Services to stalk, surveil or profile people unlawfully.

2.6 Resource abuse

You may not use the Services, including build and compile environments, Cloud Environments and free plans, for cryptocurrency mining, password cracking, distributed computing, artificial traffic or ad-click generation, file sharing or content delivery unrelated to your applications, or any workload that places a disproportionate burden on shared infrastructure. You may not create multiple Accounts or Organizations to obtain free usage, trials or promotions repeatedly, or to evade plan limits.

2.7 Spam and unsolicited messages

You may not send bulk unsolicited messages through the Services or use the Services to send them elsewhere. You may not harvest, buy or scrape contact details for messaging. Every commercial message must identify the sender, explain why the recipient is receiving it, and offer a working way to opt out, and opt-out requests must be honored promptly.

2.8 Circumventing controls

You may not bypass, disable or tamper with licensing, activation, registration, metering, quota, rate-limiting, review, signing, authentication or security controls, or help anyone else do so. You may not use undocumented or internal interfaces to obtain functionality that is otherwise restricted or priced. You may not access or attempt to access data or environments that do not belong to you, interfere with other customers' workloads, or degrade the availability of the Services.

2.9 Security testing

You may not scan, probe, penetration-test or load-test the Services without Createrun's prior written permission. Report suspected vulnerabilities to security@createrun.com. Createrun will not pursue good-faith researchers who report vulnerabilities to that address, do not access or change data that is not theirs beyond what is needed to show the issue, do not disrupt the Services, and give Createrun a reasonable time to fix the issue before disclosing it. Security testing of your own Self-Hosted Installation is your decision.

2.10 Misuse of AI features

You may not use the Createrun Agent, the MCP interface or other AI features to:

generate malicious code, exploits against systems you are not authorized to test, or content this policy otherwise prohibits;
attempt to extract the underlying models, their instructions or other customers' data, or to bypass the safety and usage controls of the AI features;
make fully automated decisions that have legal or similarly significant effects on people without the human review and safeguards that applicable law requires; or
impersonate a real person, or present AI-generated content as human-generated where that would deceive people in a harmful way.

AI clients you connect through the MCP interface must be configured so that they follow this policy. Their actions are treated as yours.

2.11 Manipulating platform signals

You may not post, buy, solicit or incentivize reviews or ratings, artificially inflate installation, usage or ranking figures, or invite only users likely to be positive to leave public reviews.

2.12 Impersonation

You may not present an Organization, application, listing or communication as coming from a person or entity it does not come from, falsely claim affiliation, certification or endorsement by Createrun or any third party, or misrepresent your identity, your control of a domain or your authority to act for an organization. You may not submit altered documents or records.

2.13 Abuse of Createrun staff and processes

You may not harass, threaten or abuse Createrun staff, reviewers or moderators, flood support, review, dispute or appeal processes with repeated or frivolous submissions, knowingly give false information in any of those processes, or try to influence a decision by offering anything of value.

2.14 Sanctions and export

You may not use the Services in breach of export control or sanctions laws, or give access to them to persons or places those laws prohibit.

3. Publishing to the Createrun Store

If you publish items to the Createrun Store, the Createrun Publisher Agreement and the program requirements published with it also apply, including requirements that listings describe what an item actually does, disclose its data handling, provide a monitored support contact, and receive security updates. An item must not behave differently during review than after release.

4. Reporting a Violation

4.1 Anyone may report a suspected violation of this policy to legal@createrun.com. Suspected vulnerabilities, active attacks and malicious code should be reported to security@createrun.com. Copyright complaints follow Section 21 of the Terms of Service.

4.2 A useful report identifies the Account, Organization, application or listing concerned, describes what was observed and when, and includes any evidence, such as screenshots, logs or reproduction steps.

4.3 Createrun does not disclose a reporter's identity to the reported party unless the law or a binding order requires it.

5. Enforcement

5.1 Proportionate measures. Where Createrun determines that this policy has been breached, it generally applies the least severe measure that addresses the problem, such as:

a warning, with a period to fix the issue;
removal or disabling of the affected content, application, workload or listing;
suspension of the affected Services, publishing rights, AI features or API access; or
termination of the Account or Organization under the Terms of Service.

5.2 Immediate action. Createrun may take any of these measures immediately, without prior warning, where there is malicious code, a security risk, abuse of resources, fraud or impersonation, content that endangers minors, illegal use, non-payment, or where the law or a binding order requires it.

5.3 Repeat and evasive conduct. Repeated violations, and attempts to evade an enforcement measure, for example through new Accounts or Organizations, may lead directly to termination.

5.4 Notice. Where practicable, Createrun will tell you which rule it relied on, the facts it relied on, and, where a fix is possible, what would resolve the issue.

5.5 No obligation to monitor. Createrun is not obliged to monitor use of the Services, but may investigate suspected violations and may cooperate with law enforcement and affected parties.

5.6 Fees. Enforcement measures do not relieve you of your obligation to pay Fees.

6. Appeals

You may appeal an enforcement decision by writing to legal@createrun.com within thirty (30) days of the notice. Identify the decision, explain which findings you dispute and why, and attach any new evidence. Createrun will review the appeal and reply in writing. An appeal does not suspend the measure. If the appeal succeeds, Createrun will lift the measure promptly. Createrun may close further appeals against the same decision that do not present materially new evidence.

7. Changes to This Policy

Createrun may update this policy as the Services, security threats and the law change. Material changes are notified to affected users and take effect no earlier than thirty (30) days after notice, except changes required by law or needed to address a security risk, which may take effect immediately. The current version and its date are published on the Createrun legal pages.