Acceptable Use Policy

This policy is part of the Terms of Service. It applies to everyone who uses crunu.com, the service at app.crunu.com, or the Crunu software with that service.

How we enforce it

The values you store are encrypted on your devices, so we can't read them and we don't scan them. We enforce this policy using what the service can see: account details, names, request patterns, logs, and reports from other people. The Privacy Policy lists that information.

What you may not do

Break the law or harm others

• Store or share credentials, keys or personal data you aren't authorized to hold, including credentials taken from systems without the owner's permission.
• Use Crunu to commit fraud, to control malware or botnets, or to get into systems you aren't allowed to use.
• Use share links to distribute malware, phishing pages, or material that is illegal to share.
• Use the service in breach of sanctions or export control laws that apply to you or to us.

Abuse the service

• Create accounts in bulk or by automation.
• Use sign-up, invitation or alert emails to send messages to people who didn't ask for them.
• Try to get around limits, rate limits, network policies or other controls.
• Put load on the service that degrades it for others, such as load testing or flooding, without our written permission.
• Use the service as general file storage or as a way to distribute files that have nothing to do with configuration and credentials.
• Resell the hosted service or offer it to others as your own product without an agreement with us.

Interfere with other people

• Access, or try to access, accounts, organizations or data you weren't given access to.
• Impersonate a person or a company, including by naming an organization so that it passes for someone else's.
• Use invitations, share links or alerts to harass anyone.

Security research

We welcome reports from people who find problems in Crunu. If you test the service, follow these rules:

• Test only against accounts and organizations you created yourself, or ones whose owners have given you permission.
• Don't access, change or delete other people's data. If you reach it by accident, stop, don't keep a copy, and tell us.
• Don't run denial-of-service tests, send spam, use social engineering on our staff or users, or attempt physical access.
• Keep automated scanning light enough that it doesn't affect other users.
• Send your report to security@crunu.com with the steps to reproduce it. Leave real secrets out of the report.
• Give us a reasonable time to fix the issue before you publish details, normally up to 90 days from your report. We'll agree on a date with you.

We'll confirm that we've received your report and keep you informed while we work on it. If you follow these rules in good faith, we won't take or support legal action against you for that research. The same contact details appear in the site's security.txt file.

What happens if this policy is broken

Depending on how serious the problem is, we may:

• warn you;
• turn off specific features, such as creating share links;
• suspend or close accounts or organizations;
• report the matter to the authorities when the law requires it.

Where we can, we tell you what we did and why. To challenge a decision, reply to our message or write to support@crunu.com.

Reporting abuse

If you think someone is misusing Crunu, write to support@crunu.com. Include the organization name, the share link or the email you received, and what happened. The part of a share link after # lets anyone who has it open the shared files, so leave it in only if you want us to look at them. Don't send us secret values. We don't need them, and we'd rather not hold them.