Acceptable Use Policy

Spam is the single biggest threat to an email service. Don’t send it, don’t help anyone else send it, and don’t disguise mail to get it past filters.

Unsolicited and bulk email

• No unsolicited bulk email. Don’t send identical or similar messages to many recipients who haven’t asked to hear from you, whatever the content: commercial, political, religious, charitable or anything else.
• No unsolicited commercial email. Don’t send advertising or promotional messages to people who haven’t agreed to receive them, wherever the law requires consent. In the European Union, that is almost always the case.

Consent and the rules for commercial messages

If you send commercial email of any kind, you must comply with the laws that apply to you and to your recipients, such as the EU ePrivacy Directive (2002/58/EC) and its national implementations, the GDPR, the US CAN-SPAM Act and Canada’s Anti-Spam Legislation (CASL). At a minimum, every commercial message must:

• Go only to people who opted in. Recipients must have given clear, prior and provable consent, or fall within a narrow legal exception (such as the existing-customer exception for similar products, where the law allows it). Pre-ticked boxes and consent hidden in other terms don’t count.
• Identify you. Say clearly who is sending the message and, where the law requires it, include a valid postal address.
• Offer a working unsubscribe. Give recipients an easy, free way to opt out in every message, and keep it working for at least 30 days after you send.
• Honor opt-outs. Stop writing to anyone who opts out as soon as possible, and in any case within the period the law sets (for example, 10 business days under CAN-SPAM). Never sell or share an address that has opted out.

Address lists

• No bought or borrowed lists. Don’t use purchased, rented, shared, traded or “opt-in” lists from third parties.
• No harvested or guessed addresses. Don’t use addresses scraped from websites or social networks, collected by software, guessed by combining names and domains (dictionary attacks), or appended to your own list from outside sources.
• Keep your lists clean. Remove addresses that bounce or that you no longer have a reason to write to.

ExitoMail is not an email-marketing platform

The Service is built for personal and business correspondence between people. It doesn’t have the list management, unsubscribe handling and bounce processing that bulk mail needs, and bulk mail would put our shared sending reputation at risk (see Sending limits).

• On personal plans (Free, Plus, Pro and Max). Don’t send newsletters, mailing-list posts, marketing campaigns or other bulk mailings, even to people who opted in.
• On Business. Normal business correspondence is fine, including service messages to your own customers at modest volume. Marketing campaigns and newsletters belong with a dedicated provider.
• Use the right tool. For newsletters and campaigns, use a dedicated email service provider (ESP). For high-volume notifications from your own app or website, use a transactional email provider. You can authorize such a provider to send for your custom domain alongside ExitoMail by adding its SPF and DKIM records to your DNS.
• Group mail between people who know each other. Writing to your team, club, family or a small group that expects your messages is fine, within your sending limit.

Honest headers and content

• Don’t forge or alter message headers, sender addresses or routing information to hide where mail comes from.
• Don’t send from addresses or domains you aren’t entitled to use.
• Don’t use subject lines that misrepresent what the message is about.
• Don’t try to get mail past spam filters with tricks such as hidden text, image-only messages, random characters, or link shorteners and redirects that disguise where a link goes.

Don’t work around the limits

Don’t use aliases, forwarding rules, auto-replies, Bcc stuffing, mailing-list software, extra accounts or other Business members to send more than your limits allow or to avoid our filters. Don’t connect software that sends mail on behalf of many unrelated people through your account, and don’t automatically forward spam you receive to other addresses.

Bounce and complaint levels

Bounces and spam complaints are the clearest sign that recipients didn’t want a message. As a guide, keep your spam-complaint rate below 0.1% of the messages you send and your hard-bounce rate below 2%. A sudden rise in bounces, complaints or messages rejected by other providers can trigger automatic throttling or a pause on sending, even if your averages look fine.

Every account has a daily limit on outgoing mail. The limits are generous for people and small businesses, and too low to be useful to a spammer.

New accounts start lower

New accounts, and newly connected custom domains, start with a lower limit than the table shows. Free custom domains start at the lowest level of sending trust. Limits then grow automatically with account age and a good sending record, up to your plan’s limit. Upgrading raises the ceiling but doesn’t skip that trust period. If you have a legitimate need for more, write to support@exitomail.com.

Why we are strict about this

What happens when you reach a limit or break the rules

• Reaching your limit. Further messages are refused until the 24-hour window allows more. The app tells you when this happens. It is not a penalty and nothing else changes.
• Throttling and queueing. If signals suggest abuse (a spike in volume, bounces or complaints), we may slow down or hold your outgoing mail while we look into it.
• Temporary sending block. We may pause outgoing mail, automatically or manually. In most cases this affects sending only: you can still receive mail and use your files.
• Verification. Before sending resumes, we may ask you to confirm information about yourself or your domain, or to secure your account (a new password, two-factor authentication).
• Suspension and termination. Serious violations can lead to suspension of the account. Repeated or severe violations lead to termination. See How we enforce this Policy.

Don’t use the Service to deceive people or to take what isn’t yours. In particular:

• Phishing. Messages, files, share links, file-request pages or fake sign-in pages designed to trick people into revealing passwords, one-time codes, payment details or other sensitive information. This includes storing phishing kits or fake login pages in Exito Vault or Exito Transfer.
• Fraud and scams. Advance-fee, investment and cryptocurrency scams, fake invoices, prize and lottery scams, romance scams, fake job offers, pyramid schemes, and selling goods or services you don’t intend to deliver.
• Business email compromise. Impersonating executives, colleagues, suppliers or customers to redirect payments, change bank details, or obtain gift cards, data or credentials.
• Spoofing. Sending as addresses or domains you aren’t authorized to use, or setting display names, Reply-To addresses or headers so that mail appears to come from someone else.
• Impersonating brands and people. Pretending to be a company, public authority, bank, charity or person (including ExitoMail and our staff) in order to mislead. Parody and commentary that are clearly identified as such are not impersonation.
• Social engineering. Trying to trick our support team, or another provider, into giving you access to an account that isn’t yours.

Don’t use any part of the Service to create, store, send or distribute software or files designed to damage, disrupt or gain unauthorized access to devices, networks or data. This includes:

• viruses, worms, trojans, spyware and stalkerware;
• ransomware, and messages that deliver or negotiate ransoms;
• exploit kits, and documents weaponized with malicious macros or exploits;
• botnet command-and-control traffic, droppers, loaders and credential stealers;
• hosting malicious files in Exito Vault or Exito Transfer, or using share links, transfers or file requests as download points for malware, including inside password-protected or encrypted archives meant to avoid scanning.

Automatic scanning

Mail is filtered automatically for spam on our own infrastructure, and mail and files uploaded to Exito Transfer may be scanned for malware in the background. Files flagged as malicious may be quarantined, and the transfer or link that carries them blocked. No scanner is perfect, so treat unexpected attachments and downloads with care.

Don’t use the Service to store, send or share content, or to carry out activity, that is illegal under the laws that apply to you, to your recipients or to us. Examples include:

• selling, buying or promoting illegal goods and services, such as drugs, weapons, explosives, forged documents, and stolen data, accounts or payment cards;
• money laundering, terrorist financing and the evasion of sanctions;
• human trafficking and the exploitation of people;
• illegal gambling and unlicensed regulated activities;
• content that is illegal in itself, such as illegal hate speech or unlawful defamation.

The sections below deal with specific kinds of illegal content in more detail. To report illegal content, use our Notice & Action form. It is the notice-and-action mechanism required by Article 16 of the EU Digital Services Act (“DSA”), and anyone can use it, with or without an account.

It is strictly prohibited to use the Service to create, store, send, share, request or link to:

• child sexual abuse material in any form, including drawn, animated, computer-generated and AI-generated depictions;
• content that sexualizes minors;
• grooming: contacting, befriending or manipulating a minor for sexual purposes, or arranging to meet one for such purposes;
• sextortion, and the trafficking or sexual exploitation of minors.

What we do

• Remove access immediately. As soon as we receive a report or other signal of such material, our systems disable access to it, to any link that carries it and to the account. A person then handles the case; it is never left to automation alone.
• Report. As a US provider, we report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) through its CyberTipline, as 18 U.S.C. § 2258A requires. NCMEC makes reports available to law enforcement in the US and other countries. Where someone's life or safety is at risk, we also inform the competent authorities directly.
• Preserve evidence. We preserve the reported material and related records under a legal hold for one year after our report, as US law requires, or longer if an authority asks us to. Preserved material is stored securely, and only the people who must handle the case can access it.
• Terminate. We terminate the account and any accounts linked to it, and the person may not open new ones.
• No reinstatement. You can appeal if you believe we made a mistake about your account, but no appeal will ever lead us to restore child sexual abuse material.

How to report it safely

Report it through our Notice & Action form or to abuse@exitomail.com. You can also report directly to the police, to the hotline for your country in the INHOPE network (opens in a new tab), or to NCMEC’s CyberTipline (opens in a new tab). If a child is in immediate danger, call your local emergency number first.

• Terrorist content. Material that incites, solicits or threatens terrorist offenses, glorifies them, or gives instructions for making or using explosives, firearms or other weapons for terrorist purposes, as defined in Article 2(7) of Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online, and similar laws. This includes recruitment, propaganda and fundraising for terrorist organizations.
• Violent extremism. Promoting or supporting violent extremist groups, glorifying mass-casualty attacks, and sharing material produced by attackers to celebrate or spread their acts.
• Credible threats. Threats of violence against people, groups, places or events, including threats against schools, public officials and journalists.

Material shared for genuine educational, journalistic, artistic or research purposes, or to prevent or counter terrorism, is not prohibited by this section when that purpose is clear and the material doesn’t promote violence.

Our policy for addressing terrorist content

This is our policy under Article 7(1) of Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online:

• Notices and our own detection. When we learn of possible terrorist content through a report or our own systems, we assess it and, if it is terrorist content or breaks this Policy, remove it or disable access to it expeditiously. Automated tools may hide a reported transfer while we assess it; a person decides.
• Removal orders. When a competent authority of an EU Member State sends us a removal order under the Regulation, we remove the content or disable access to it in all Member States as soon as possible and in any event within one hour of receiving the order. The one-hour deadline applies to removal orders from competent authorities, not to reports from other people. Authorities can send orders to legal@exitomail.com.
• Preservation. We preserve removed terrorist content and related data for six months, or longer if a competent authority or court asks us to, as Article 6 of the Regulation requires.
• Informing the person who provided it. We tell them about the removal and, on request, the reasons and how to challenge it, unless the issuing authority decides that we must not disclose this for reasons of public security (Article 11).
• Threats to life. Where terrorist content involves an imminent threat to life, we promptly inform the competent authorities.
• Transparency. For any calendar year in which we take action against terrorist content, we publish a transparency report before 1 March of the following year (Article 7(2)).

Respect other people’s rights in what they create. Don’t use the Service to:

• Infringe copyright. Share copies of films, series, music, software, games, books, courses or other works without the rights holder’s permission, including through transfers and share links.
• Infringe trademarks. Use someone else’s trademark in a way that is likely to confuse people about who is behind a product, message or page.
• Sell or promote counterfeit goods. Including fake branded products and pirated copies.
• Circumvent protection. Distribute software cracks, key generators, stolen license keys, or tools for circumventing technical protection measures where the law prohibits it.
• Misuse confidential information. Share trade secrets or confidential business information that was obtained or disclosed unlawfully.

Copyright owners can report infringement under our Copyright Policy or to dmca@exitomail.com. Other intellectual-property complaints go through Notice & Action or to legal@exitomail.com.

Don’t use the Service to hurt, frighten or degrade other people. This includes:

• Harassment and bullying. Repeated unwanted contact, especially after someone has asked you to stop, and using new addresses or aliases to reach someone who has blocked you.
• Stalking and intimidation. Monitoring, following or intimidating a person, or encouraging others to do so.
• Threats. Threatening violence or other serious harm against a person or their family.
• Hate speech. Content that incites violence or hatred against people because of their race, ethnic or national origin, religion, disability, sex, gender identity, sexual orientation or another characteristic protected by law.
• Doxxing. Publishing or sharing someone’s private information, such as a home address, identity documents, financial details or private photos, without their consent in order to harass, expose or endanger them.
• Non-consensual intimate imagery. Sharing, or threatening to share, intimate images or videos of someone without their consent, including sexually explicit deepfakes, and using such material to extort anyone.
• Impersonating people. Pretending to be a real person to harm their reputation, deceive others or harass them.
• Encouraging self-harm. Encouraging or instructing anyone to harm themselves or to take their own life.

If someone is targeting you through ExitoMail, report it to abuse@exitomail.com. If you are in danger, contact your local emergency services first.

• Collecting data without a lawful basis. Don’t harvest, scrape or buy personal data, and don’t use messages, forms or file requests to collect identity documents, financial records, health data or other personal data without a lawful basis and a clear explanation to the people concerned.
• Accessing accounts that aren’t yours. Don’t access someone else’s account, mailbox or files without their permission, including those of a partner, family member, colleague or former employee.
• Covert tracking. Don’t use the Service to secretly track people or devices, or to distribute stalkerware or hidden trackers, where the law doesn’t allow it.
• Business admin powers. Admins of a Business organization can manage members’ accounts. Use those powers only for legitimate purposes and in line with employment and data-protection law, including telling members how their accounts are managed.

When you use the Service to process other people’s personal data (a customer list, or documents received through a file request), you decide why and how that data is used and are responsible for complying with data-protection law. For Business customers, our Data Processing Agreement sets out our role as your processor. How we handle personal data ourselves is described in our Privacy Policy.

Don’t attack, overload or misuse the Service, other users, or anyone else’s systems. In particular:

• Probing and scanning. Scanning, probing or testing the vulnerability of our systems or networks, or using the Service to do so against anyone else, except as authorized research under our disclosure policy (see below).
• Attacks. Attempts to gain unauthorized access, exploiting vulnerabilities, denial-of-service attacks, mail bombing and flooding.
• Credential stuffing and brute force. Automated sign-in attempts with leaked or guessed credentials, whether against our web app, IMAP, SMTP and JMAP endpoints, or against anyone else using the Service.
• Open relays and proxies. Running or configuring an open relay, open proxy or any setup that lets other people or systems send mail through your account, and using the Service as a proxy, tunnel or VPN exit node for unrelated traffic.
• Automated bulk access. Using IMAP, SMTP, JMAP or the web app for automated bulk sending, or for automated access far beyond what normal mail clients and syncing need, including excessive polling and scraping of our website or app.
• Cryptocurrency mining and unrelated workloads. Using our resources to mine cryptocurrency or to fill storage for “proof of space” schemes, or using Exito Vault as a storage backend or content delivery network for another app, website or service.
• Reverse engineering to bypass limits. Decompiling, reverse engineering or tampering with the Service to get around limits, scanning, security controls or billing, except where the law expressly allows it.
• Interfering with others. Disrupting other users’ use of the Service, degrading its performance, or sending malformed data designed to crash clients or servers.

Security research is welcome

We appreciate good-faith security research. If you follow the rules in our responsible disclosure policy, we won’t treat your research as a breach of this Policy. In short: test only against accounts you own, don’t access, change or delete other people’s data, don’t degrade the Service, don’t send spam or phishing to real people, and report what you find to security@exitomail.com.

The free plan is free forever for real people. Keeping it that way means nobody may game it. Don’t engage in:

• Multiple free accounts. Creating or using several free accounts to multiply free storage, sending or transfer allowances, or to get around a limit.
• Account farming. Creating accounts in bulk or by script, creating accounts for other people to use or sell, or using disposable or fake recovery addresses. We limit signups per network address and may require a verified recovery email.
• Referral fraud. Referral rewards (currently 1 GB of extra storage for both people, up to 10 GB per account) are for inviting real people who want to use the Service. Referring yourself, using fake or farmed accounts, or paying for signups is prohibited, and we may remove rewards obtained that way.
• Selling or renting accounts and addresses. Selling, renting, leasing, trading or giving away accounts, addresses or aliases, or offering them as a service to others. Business admins may assign addresses to their own members, and approved partners may resell Business seats under their partner agreement.
• Circumventing enforcement. Using new or other accounts, domains or organization members to get around a suspension, sending block or termination.

Storage is for your own mail and files, and Exito Transfer is for sending files to people. The limits of each plan are shown on our pricing page.

Connect a domain only if you own it or its owner has authorized you to manage its email. We verify control of every domain with a DNS TXT record before any mail flows.

• Domains you don’t control. Don’t connect, or try to connect, a domain you don’t own or aren’t authorized to use. If a domain expires or changes hands, disconnect it. We may disconnect any domain that no longer verifies.
• Lookalike and typosquat domains. Don’t use domains that imitate another brand or organization (misspellings, swapped or look-alike characters, misleading subdomains or extensions) to deceive people. We may refuse or disconnect them.
• Domains with a bad reputation. We may refuse to connect, or limit sending from, a domain that is listed on major blocklists, was recently used for spam, phishing or malware, or was registered after expiring with a history of abuse. You may need to clean up its reputation first.
• Email authentication. Keep the SPF, DKIM and DMARC records we provide in place while your domain sends through us. Don’t publish records that misrepresent who is allowed to send for the domain.
• DNS credentials. If you connect a domain with your DNS provider’s API credentials, provide only credentials you are authorized to use.
• Mail for people outside your account. Don’t use a custom domain to send or receive mail on behalf of people or organizations that aren’t part of your account or Business organization, beyond what your plan allows.

Exito Transfer is for sending files to specific people. It is not a public file host or a content delivery network.

Not allowed

• Public distribution. Posting transfer links on websites, forums, social networks, public chat groups or link-sharing sites for anyone to download, or otherwise using Exito Transfer as a file-hosting service.
• Piracy and warez. Sharing films, music, software, games, books or courses without the rights holder’s permission, or cracks and key generators.
• Hotlinking and embedding. Linking to or embedding transferred files directly in websites, apps or media players, or automating downloads.
• Mass distribution. Sending the same files to very large numbers of recipients, or repeatedly re-creating transfers to keep content available beyond its expiry.
• Malware and illegal content. Distributing malware or any content prohibited by this Policy, including in password-protected or encrypted archives.
• Unlawful file requests. Using file-request links to collect personal data, identity documents, financial records or credentials under false pretenses or without a lawful basis, or to receive illegal content. File-request pages must not impersonate anyone.
• Misleading branding. Logos and wallpapers on your download pages must be yours or used with permission, must not imitate another organization, and must not contain illegal or sexually explicit content.

Download caps and rate limits

To keep Exito Transfer fast and fair, we may limit the number of downloads, the download speed or the number of different people downloading a transfer, particularly when a link is downloaded far more often than a person-to-person transfer would be.

We may disable a link at any time

We may disable any transfer or file-request link at any time if we believe it breaks this Policy, is being used for public distribution, or puts other people or the Service at risk. When we do, we tell the sender (see How we enforce this Policy). Links also stop working when they expire, and their files are then deleted.

Recipients can report a transfer in one click

Every download page has a one-click report option. Reports go to our automated enforcement system and to our abuse team. A transfer reported as child sexual abuse material or malware, or reported several times, is hidden automatically while the report is assessed. We don’t tell the sender who made the report.

Share links let you give specific people access to files in your Exito Vault, with an optional password and expiry date. The principles that apply to Exito Transfer apply here too:

• no public distribution, file hosting or use as a content delivery network;
• no hotlinking or embedding shared files as assets in websites or apps;
• nothing illegal, infringing or malicious, and no phishing pages or fake sign-in documents;
• no re-sharing to get around an expiry date or a link we disabled;
• respect the privacy of the people whose information is in the files you share.

We may disable a share link, or restrict sharing for an account, if it breaks this Policy. Disabling a share link doesn’t delete the file from your Exito Vault, but we may also restrict or remove a file that is itself illegal or malicious. To report a share link, write to abuse@exitomail.com or use our Notice & Action form.

How we find out

We don’t read your mail to look for violations, and nobody at ExitoMail browses mailboxes or files. We learn about possible violations from:

• Automated signals. Spam complaints and bounces, sending volume and patterns, listings of our servers or your domains on DNS blocklists, the results of spam filtering and of malware scans of mail and transfers, and sign-up and sign-in patterns that suggest account takeover. These rely on metadata and automated filtering, not on people reading content.
• Reports. From recipients, users and other mail providers, through the report option on download pages, and reports of child sexual abuse material.
• Notices and orders. Notices of illegal content under the DSA, copyright notices, and orders from competent authorities.

When a report concerns specific content, we review that content: the files behind a reported link, or the copy of a message that the reporter sends us, together with our delivery logs. We look only at what we need to reach a decision.

Automated enforcement

Most measures below are applied by our automated enforcement system when signals cross thresholds that indicate abuse or a compromised account. Automatic measures are designed to be temporary and reversible. Complex or unclear cases are escalated to our staff, a person decides every appeal, and cases involving child sexual abuse material are always handled by a person. Terminating an account is always a decision made by a person.

What we may do

Proportionality

We choose the least severe measure that will effectively stop the harm. We consider how serious the violation is, whether it was deliberate, the account’s history, the risk to other people and to our shared sending reputation, and whether the account appears to have been compromised. Where the harm is serious or ongoing (child sexual abuse material, terrorist content, phishing, malware or large-scale spam), we may act immediately and without a prior warning.

If your account appears to have been compromised, we may pause sending and ask you to secure it with a new password and two-factor authentication before sending resumes.

Business organizations

We may act on an individual member’s account or, for organization-wide or repeated problems, on the whole organization. We normally inform the organization’s owner or admins and may ask them to resolve the issue.

We tell you what we did and why

When we restrict your content or account, whether automatically or not, we send a statement of reasons to the email address of the account, as Article 17 DSA requires. It explains:

• what we did, and its scope and duration;
• the facts and circumstances we relied on, including whether we acted on a notice;
• whether automated means were used to detect the issue or to make the decision;
• the legal ground, if the content is illegal, or the rule of this Policy or the Terms that was broken;
• how to appeal, and the other ways to seek redress.

The exceptions are narrow: we have no electronic contact details for you; the content is deceptive high-volume commercial content, such as a spam campaign; or a competent authority requires confidentiality, in which case we tell you as soon as and to the extent that we may. In cases involving child sexual abuse material, the statement is limited to what we can say without compromising a criminal investigation. Plan limits that apply to everyone, such as reaching your daily sending limit, are not enforcement decisions: the app shows you when you reach one.

Authorities and preservation

If we become aware of information that gives rise to a suspicion that a criminal offense involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we promptly inform the competent law-enforcement or judicial authorities, as Article 18 DSA requires. We report child sexual abuse material to NCMEC as described above. Otherwise, we disclose user data to authorities only when the law requires it, as described in our Privacy Policy.

We may preserve content and records related to a violation, including content we have blocked or quarantined, for as long as we need them to handle appeals, to establish, exercise or defend legal claims, or to comply with a legal obligation or a preservation request from an authority (a legal hold). We keep records of reports, notices, decisions and appeals for 12 months after the case is closed, or longer while needed for a legal claim or a legal hold.

If you disagree with a decision we made about your content or account, including one our automated systems made, or with how we handled a report you sent us, you can appeal free of charge. This is our internal complaint-handling system. It is modelled on Article 20 DSA, which we apply voluntarily.

1. 1
   Appeal within six months
   Use the appeal page at exitomail.com/appeal, reply to the notice we sent you, or write to abuse@exitomail.com, within six months of the decision. Include the reference from our notice (if there is one), your account address, and why you think the decision was wrong.
2. 2
   A person reviews it
   Appeals are never decided by automated means alone. A qualified member of our team reviews each one, where possible someone who wasn’t involved in the original decision.
3. 3
   We decide without undue delay
   We tell you our decision and the reasons for it. If we got it wrong, we reverse the measure and restore your content or access where that is still possible. (Expired transfers can’t be restored, because their files are deleted on schedule.)

A measure may stay in place while we review your appeal. You can always go to court. Notice & Action explains the other options, including out-of-court dispute settlement.

Thank you for helping keep ExitoMail clean. Here is where each kind of report goes:

Include full headers

For spam and phishing, the full message headers show us which account and server sent the message. In most mail apps you’ll find them under “Show original”, “View source” or “View message headers”. Forwarding the message as an attachment (an .eml file) keeps them intact. Reports in the Abuse Reporting Format (ARF) are welcome too.

We assess every report. For privacy reasons we may not be able to tell you what we did about a particular account, but if you send a notice of illegal content under the DSA, we confirm receipt and tell you our decision.

We may update this Policy as the Service, the law or patterns of abuse change. We show the date of the current version at the top of this page and, for material changes, we notify account holders in advance as described in the Terms. Questions about this Policy: write to abuse@exitomail.com.