Acceptable Use Policy

01The principle#

HummingRelay serves abliterated models: models whose reflexive refusal behaviour has been reduced. We do this because mainstream models decline large amounts of legitimate work — security research, red-teaming, frank analysis, fiction with dark themes, medical and legal questions asked by adults who want straight answers.

Fewer refusals from the model does not mean fewer rules for the person using it. It moves the judgement from the model to you. This policy sets the limits that stay in place whatever a model is willing to write. It is part of the Terms of Service and applies to everyone who uses your account or your keys.

The test we apply is about what you do, not which words appear in a prompt. Discussing, studying, simulating or writing about a difficult subject is different from using the service to carry out harm against real people.

02What the service is for#

Uses we built this for, and expect to see:

• Security work you are authorised to do — penetration tests and red-team engagements with a scope and permission, CTFs, vulnerability research, exploit development for systems you own or are engaged to test, malware analysis, detection engineering, incident response.
• AI safety and evaluation — red-teaming other models, building classifiers and guardrails, generating adversarial test data.
• Agents and automation — coding agents, tool-using pipelines and data processing that mainstream models interrupt with unnecessary refusals.
• Research and analysis — direct answers on medicine, law, chemistry, history, extremism, crime and other subjects, for people who study or work with them.
• Creative writing — fiction, role-play and games with mature or dark themes, involving adult characters.
• Content moderation and trust & safety — classifying, summarising and reasoning about harmful material in order to deal with it.

03What is never allowed#

These apply regardless of who you are, what you are authorised to do elsewhere, or how the request is framed.

Sexual content involving minors

No sexual or sexualised content involving anyone under 18, or anyone presented as under 18 — real or fictional, in any form, including role-play. No content that grooms, solicits or facilitates the sexual exploitation of children. We report what the law requires us to report.

Mass-casualty weapons

No use of the service to develop, produce, acquire or deploy biological, chemical, radiological or nuclear weapons, or other means of causing mass casualties — including synthesis routes, enhancement techniques or acquisition strategies meant to give real capability.

Violence against real people

No planning, inciting or facilitating of violence, terrorism, trafficking in persons, or attacks on critical infrastructure. No threats aimed at real people.

04Other prohibited use#

Attacks without authorisation

• Gaining or attempting access to systems, accounts, networks or data you do not own and have no permission to test.
• Building or operating malware, ransomware, stealers, botnets or denial-of-service tooling for use against targets that have not consented.
• Supply-chain compromise, and mass, indiscriminate scanning-and-exploitation campaigns.
• Tooling whose purpose is to hide an ongoing unauthorised intrusion from its victims.

Authorisation is the line. If you could not show a scope, a contract, ownership or a programme's rules to back an activity, do not use the service for it.

Fraud and deception

• Phishing, scams, pretexting and social-engineering content aimed at real targets outside an authorised test.
• Impersonating a real person or organisation in order to deceive.
• Forged documents, fake reviews, counterfeit credentials and other fabricated records presented as genuine.
• Coordinated inauthentic behaviour: fake-account networks, astroturfing, and disinformation campaigns, including attempts to interfere with elections.
• Spam and unsolicited bulk messaging.

Harm to individuals

• Harassment, stalking, intimidation or doxxing of real people.
• Sexual content depicting real, identifiable people without their consent.
• Building profiles of private individuals, or tracking them, without a lawful basis.
• Content that encourages or coaches a specific person toward suicide or self-harm.
• Making decisions with legal or similarly serious effects on people — credit, employment, housing, insurance, criminal justice — solely from model output, without human review.

Illegal activity

• Anything unlawful where you are or where the people affected are.
• Trading in illegal goods or services, money laundering, and sanctions evasion.
• Infringing others' intellectual property or privacy rights.

Abuse of the service itself

• Getting around metering, rate limits, spend limits or account suspension.
• Creating multiple accounts to claim one-off packs or bonuses more than once.
• Reselling raw API access without a written agreement with us.
• Probing or attacking the service, other customers, or the infrastructure behind it.
• Using stolen payment methods, or keys that are not yours to use.

05If you build on the API#

If you put the models in front of other people — a product, a bot, an internal tool — this policy applies to what they do through you, and you are responsible for it.

• Tell your users what they are talking to. Do not present model output as written by a human where that would mislead.
• Add the safeguards your use case needs. A model that rarely refuses is the wrong thing to expose to the general public, or to minors, without your own controls.
• Do not offer the service to anyone under 18.
• Give your users a way to report abuse, and act on reports.
• Use per-key spend limits and expiry dates so a leaked or misused key is contained.

06How we enforce this#

We do not keep the text of your requests or the models' answers, so we do not routinely read what you send. We act on what we can see and what we are told: usage patterns and metadata, reports from third parties, notices from the inference providers that process requests, and legal requests.

Those inference providers apply their own usage rules and may have their own safeguards. A request can be refused or flagged by them independently of us.

When we believe this policy has been broken, we may, depending on how serious it is:

• ask you what happened and to stop;
• revoke a key, or limit or suspend the account, immediately where the risk calls for it;
• close the account — the Terms say what happens to credit;
• cooperate with law enforcement where the law requires it.

We would rather talk than ban. If your work sits near one of these lines — a red-team engagement, sensitive research — tell us about it up front and we will tell you where we stand.

07Reporting misuse and vulnerabilities#

If you see HummingRelay being used to harm someone, or you receive abusive content that appears to come from it, write to access@hmbrd.dev with whatever detail you have. We read every report.

If you find a security vulnerability in the service, report it to the same address before disclosing it publicly, and do not access other customers' data or degrade the service while investigating. We will not take action against good-faith research that follows those two rules.

• Email: access@hmbrd.dev
• Telegram: toxuv.t.me

08Changes#

We will update this policy as we learn how the service is used. The current version is always on this page with its effective date; material changes are announced in the dashboard where we reasonably can.