Policy &
Terms

• Natural persons of age to enter contracts in their jurisdiction (18 in most countries; 16 with guardian consent in some).
• Legal entities and sole proprietors acting through an authorized representative.
• Persons not on the sanctions lists of the country hosting our nodes (England), nor EU/UN/OFAC.

• One account, one owner. Sharing access without notifying support is forbidden.
• You must use a strong password and notify us immediately on suspected compromise. Passwords are stored only as bcrypt hashes (cost=12); we cannot recover them, only reset.
• We reserve the right to request proof of domain or email ownership when investigating violations.

• Free tier is available without payment within the limits shown at /#pricing.
• Paid plans (Solo / Pack / Heavy / Lifetime) run for the term purchased. Lifetime does not expire until the Service itself shuts down.
• Refunds are possible within 14 days of payment if the Service has not been used for live traffic. Disputes - support@anycast.ac.

We may change these Terms. Material changes are announced at least 14 days in advance via the registered email and on this page. Continued use after changes take effect means acceptance of the new version.

You can delete your account anytime from settings or by emailing support@anycast.ac. We may suspend or terminate service in the cases described in §3 (Penalties).

• CSAM. Any material exploiting minors. Account is locked immediately on detection, data is reported to NCMEC / national law enforcement.
• Terrorist propaganda. Content inciting or glorifying terrorism under EU / Swiss / Swedish law.
• Content infringing adult-consent laws without explicit, verifiable consent (revenge porn, deepfake-nude, hidden recording).
• Botnet C&C and malware distribution. Sites controlling compromised hosts or spreading malicious code.
• Mass phishing. Sites impersonating banks, crypto exchanges, government portals, or other trusted resources.
• Attack retransmission. Using the Service as a proxy layer fronting stresser / booter / DDoS-as-a-service.

• Attacking third-party systems. Exploiting vulnerabilities of sites without owner permission, bruteforcing third-party logins through our proxy.
• Mass spam. Email, SMS, social spam; mass-mailing systems bypassing anti-abuse.
• Copyright infringement. Hosting content subject to a valid DMCA or equivalent claim without response in the stated window (§7).
• Deceiving end users. Scam landings, fake shops, fake giveaways, sites promising money for a crypto wallet.
• Unauthorized scraping. Using the Service to proxy scrapers violating the target's robots.txt and Terms of Service.
• Anonymization for wrongdoing. Intentionally using our edges to hide the source when committing criminal offenses.
• Protection resale. Reselling or sublicensing your account and/or proxied traffic to third parties without separate written permission.

• Using edges as a CDN for massive files. The Service is an L7 proxy shield, not a file host. Use S3/R2/BunnyCDN for static assets.
• Infinite WebSocket sessions without real useful payload (keep-alive floods, 'parked' sockets to fake concurrent users).
• Circumventing plan limits (many small accounts under one owner, automatic Host swapping, counter manipulation).

• Forums, blogs, biolinks, portfolios, community sites.
• Commercial sites: shops, SaaS, APIs, media, gaming lobbies, Discord panels - anything legal in the owner's jurisdiction.
• NSFW content between adults with explicit consent and within local law.
• Hobby projects, experimental APIs, Telegram bots behind a proxy.

1. Signal received. Automated detector, third-party complaint, or law-enforcement request.
2. Initial check. Within 24 hours we verify the facts: logs, traffic samples (no payload), CNAME, domain.
3. Contact with the account owner. Email to the registered address. Response deadline: 24 to 72 hours depending on severity.
4. Measures applied. From warning to full permanent ban, depending on severity and repetition.

If the block is the user's fault (breach of §2) - the unused subscription portion is not refunded. If it was our mistake - we restore access and compensate downtime with proportional subscription extension.

Any decision can be appealed by writing to support@anycast.ac within 30 days of the sanction. We commit to review within 14 business days and give a written answer.

• Email - for login, password reset, service notifications.
• Handle (nickname) - publicly visible in the panel and audit log.
• bcrypt password hash. The plaintext password is not stored. Cost factor is 12.
• Last-login IP and browser user-agent - for session theft detection.
• Session cookies (name fg_session) - HttpOnly, Secure, SameSite=Lax, domain .anycast.ac. TTL 30 days, extended on activity.

• Client IP - for rate-limit, bans, analytics.
• Host and path of the first request line - for routing and the 'top URL under attack' report.
• User-Agent - for bot and empty-UA detection.
• Method, status code, response size, duration - aggregated counters.
• Cause-of-block - reason the request was dropped (rate, protocol violation, UAM-challenge fail etc.), if applicable.

• Request/response body. We don't log or read POST payloads, JSON bodies, uploaded files, form contents.
• Passwords from protected sites. Your users' login forms are your business; we don't peek.
• Third-party TLS keys. In ACME mode, keys are generated on our edges and stay there; we do not export private keys to your subscribers.
• Third-party personal data from user databases - we are not the processor of your customers' data, we just pass the traffic.

The marketing site (anycast.ac, /network) has no third-party trackers - no Google Analytics, no Meta Pixel, no Yandex.Metrika. dash.anycast.ac uses only one cookie, fg_session, for authorization.

• Panel + Postgres - hosted in England.
• Edges - London, England.
• DB backups - encrypted (AES-256-GCM), replicated inside England.

We do not sell or share data with advertisers or data brokers. Third-party data transfer happens only in the following cases:

• Court order or lawful law-enforcement request from the jurisdiction hosting our servers (England). Requests from other jurisdictions are ignored unless an MLAT is produced.
• Payment providers - transaction data only (amount, currency, email), no traffic metadata.
• Infrastructure providers (OVH, Hetzner, …) - they see only what any hosting provider sees (network in/out, hardware), no application-layer data.

Email support@anycast.ac from the account address. Within 30 days you'll get a JSON export: profile, sites list, active sessions, billing history, last 30 days of block logs.

Email and handle are editable via account settings. Other fields - request at support@anycast.ac.

Self-service deletion is in the panel. Removed: account, all sites, all sessions, all sample rows. Only anonymized aggregates (per-day request counts with no IP/handle link) and billing records (we are required to keep those 7 years under tax law) remain.

You can opt out of marketing email with one click in any email. Objection to processing required for attack protection (request logs) is only possible by ceasing to use the Service - without metadata, we cannot protect your site.

• URL or domain where the infringing content is hosted.
• Description of the violation (copyright, phishing, CSAM, etc.).
• Evidence (link to the original, rights-holder paperwork, screenshots).
• Claimant's contact data and a declaration that the provided information is accurate.

Send to abuse@anycast.ac. Response: within 48 hours for regular claims, immediate for CSAM / national-security.

If your content was removed by mistake, you can file a counter-notice at support@anycast.ac. We'll notify the claimant and, if no court action arrives within 10 business days, restore access.