Acceptable Use Policy

Do not use this service to harm other people, and do not use it in a way that makes other customers carry the consequences.

This applies to everything you run: your app, your app's users, the content they upload, and the traffic that leaves your service. You are not off the hook because it was your user who pressed the button.

Child sexual exploitation material. No exception, no prior warning, no grace period. The service is shut down immediately and the incident is reported to the authorities.

Material that incites or threatens violence against a person or a group, including death threats, doxing, and calls to attack.

Fraud: pages impersonating a bank, digital wallet, marketplace, government body or other service in order to take people's credentials, money or personal data.

Malware and attack tooling: distribution, command-and-control, stolen-data drops, and tools whose main purpose is to attack other systems.

Material that infringes someone else's intellectual property — including pirated works and stolen licence keys.

Unlicensed gambling, ponzi schemes, and deceptive financial offers.

Stolen personal data — breach dumps, databases being traded, or identity sets collected with no lawful basis.

Anything else unlawful under Indonesian law is prohibited here too, whether or not it is listed above.

Do not scan, attack, flood or break into anyone's systems from your service — including penetration testing of third parties without the written permission of the system's owner.

Do not run the service as an open proxy, open relay, public anonymising VPN exit, or any other route for traffic you cannot account for.

Load-testing your own service is fine, but tell us first at [email protected] so we do not handle it as an attack.

Do not send bulk email people did not ask for. Send only to people who actually signed up, provide an unsubscribe that works, and stop sending to addresses that bounce.

Do not forge senders, headers or domain identity.

Outbound SMTP ports are closed by default. To send mail from your app, use a third-party email provider through their API or submission port — which is also what makes your mail actually arrive.

Cryptocurrency mining is prohibited, including mining run through your site's visitors. It burns shared CPU for a return far smaller than its cost.

The CPU and memory you bought are genuinely reserved for you; using them fully, all the time, is not a breach. What matters is a pattern that harms neighbours on the same machine — flooding shared disk with unending writes, for instance, or holding outbound network saturated indefinitely.

If your usage genuinely needs more, the answer is a larger plan, not a way around the limit. We contact you before doing anything when the pattern is not itself dangerous.

Do not try to leave the boundary of your own service: reaching another customer's namespace, volumes or traffic, attempting to break the isolation layer, or probing our infrastructure without permission.

Finding a security flaw in our platform is not a breach — reporting it is welcome. Write to [email protected] with `SECURITY` in the subject. Do not dig further than it takes to demonstrate it, do not touch other customers' data, and give us time to fix it before you publish.

If something running on PodsFlow is harming you, write to [email protected]. That inbox is read separately from sales and support questions, so a report does not queue behind either.

Include the address (URL or domain name) at fault, what happened, and when — with the time zone. Without an address we can open, a report cannot be acted on.

We reply to every actionable report within 1 working day, and tell you the outcome as far as we are allowed to. We do not pass a reporter's identity on to the customer reported.

For a copyright complaint, name the work infringed, the address where it appears here, and state that you own it or are authorised to act for the owner.

Our response matches the problem, and we take the smallest one that resolves it.

We contact you about things that can be fixed — a leaking configuration, mail sending that needs cleaning up, a usage pattern that disturbs others. You get a reasonable deadline.

We suspend when the problem is ongoing and harming someone else, or when the deadline passes. Your data is not touched.

We shut down immediately, without prior notice, for child exploitation material, active attacks on others, and anything else where every further minute adds a victim.

A suspension for abuse is not lifted by paying an invoice — it is lifted once the matter is resolved. That differs from a suspension for non-payment, which comes back on its own once paid.

We state the reason if you ask, unless stating it would break the law or compromise an ongoing investigation.

Reply to the suspension email, or write to [email protected] with `APPEAL` in the subject. Say what actually happened and what you have already fixed.

While an appeal is being reviewed your data stays within the retention period set in the Terms of Service — we do not delete anything merely because you are disputing it.