Acceptable Use Policy

1. Purpose and scope

UptimeOwl helps you watch over your services and keep the right people informed. This Acceptable Use Policy explains how to use that capability responsibly. It forms part of the Terms of service between you and Blastup Single Member P.C. (“Blastup”, “we”, “us”). Terms defined in the Terms of service have the same meaning here.

This policy applies to your workspace, users and anyone using the service under your authority, including use through an application, agent, API or integration. It covers monitoring, incident management, notifications, widgets, status pages, reports and automation. References to regional or private probes, mobile applications, additional monitor types, on-call features, SMS, advanced integrations or AI assistance apply when those capabilities are available and enabled under your plan or agreement; they do not promise availability.

2. Monitor only with authority

You must own the systems you monitor or have the necessary permission from their owner or operator. Keep that permission current and ensure that it covers the endpoints, credentials, methods, frequency, regions and actions you configure. A publicly reachable address does not by itself authorise intrusive testing or access to restricted information.

Do not use UptimeOwl to discover or exploit vulnerabilities without authorisation, guess credentials, enumerate private resources, bypass access controls, or retrieve another person's data. Do not use redirects, DNS changes, request configuration or agents to reach cloud metadata, internal administration services or other restricted destinations through our infrastructure. Approved private-network monitoring must use the intended private-monitoring facilities and remain within your authorised scope.

Availability checks are not permission to conduct denial-of-service attacks, stress testing, bulk crawling or security exploitation. Do not configure excessive requests, oversized payloads, expensive operations or browser journeys that disrupt a target or third-party service. Respect applicable limits and reasonable requests from a target operator to stop or adjust monitoring.

Regional probes and different monitoring addresses must not be used to evade blocks, rate limits, geographic restrictions or security controls. When monitoring requires allowlisting or access credentials, arrange legitimate access with the operator.

3. Protect credentials and automated actions

Use dedicated credentials with only the permissions needed for a monitor or integration. Enter secrets only in the settings intended for them. Do not place passwords, tokens, private keys or sensitive query parameters in monitor names, public URLs, incident notes, screenshots, logos, status updates or other fields that may appear in public content, reports or alerts.

Configure checks to avoid unintended purchases, messages, data changes or other real-world actions. Use test accounts and non-destructive operations where possible. If a supported browser journey, diagnostic or remediation action intentionally changes a system, obtain authority for that action and assess its consequences, safeguards and recovery procedure before enabling it.

Protect your sign-in email, sessions, devices, API credentials and private agents. Do not share another user's access or bypass workspace roles, support-access restrictions or revocation. Remove unused integrations and notify us promptly if you suspect compromised access to UptimeOwl.

4. Keep content lawful and respectful

Do not use UptimeOwl to publish, transmit, facilitate or promote unlawful activity. This includes public widgets, status pages, custom domains, uploaded branding, incident updates, notifications, reports and content submitted through integrations.

Prohibited content and conduct include child sexual abuse or exploitation; threats, targeted harassment, unlawful discrimination or defamation; incitement to violence or hatred; promotion or encouragement of suicide or self-harm; and recruitment, fundraising or operational support for terrorist activity. Do not distribute malware, phishing content, fraudulent messages or material intended to deceive people into disclosing information or making payments.

You must have the rights necessary to use the names, domains, logos, text and other materials you provide. Do not impersonate another organisation, misrepresent ownership of a monitored service, infringe intellectual-property rights or falsely imply endorsement by Blastup or a third party. These restrictions concern harmful conduct and unlawful content; they do not prohibit legitimate reporting, security research within an authorised scope, or lawful criticism.

5. Respect privacy and confidentiality

Collect and submit only the information reasonably needed for your monitoring and incident-management purposes. You are responsible for the applicable lawful basis, notices and permissions for personal data you supply or instruct us to process, including data about workspace users, alert recipients, subscribers and people whose information appears in monitored responses.

Do not use the service for unlawful surveillance, stalking, doxxing or unauthorised profiling. Do not publish confidential information or personal data without a lawful basis and appropriate authority. Take particular care with response bodies, request headers, screenshots, exports and incident attachments that may contain information beyond a simple availability result.

Do not configure the service to collect full payment-card data, authentication secrets outside designated credential settings, or sensitive health and other specially protected information unless a specific written agreement permits that processing and the required safeguards are in place. Ordinary monitoring access does not establish suitability for regulated health-data processing.

Review what a widget, status page, subscriber notification or shared report will reveal before making it public. Limit public information to what recipients need. The Privacy Policy and, where applicable, the Data Processing Addendum govern personal-data handling; this policy does not replace those obligations or provide blanket consent to processing.

6. Send alerts responsibly

Send email, SMS, push notifications and messages through Slack, Teams or other channels only to recipients you are authorised to contact for that purpose. Maintain accurate recipient details, observe applicable consent and electronic-communications requirements, and respect unsubscribe, opt-out and permission changes where applicable. Do not use monitoring alerts as a disguised marketing list or send unsolicited bulk messages.

Do not forge sender identities, misrepresent an incident, harass recipients through repeated alerts, or route notifications to numbers, devices or channels you do not control or have permission to use. Purchased, scraped or fabricated contact lists must not be used to bypass these requirements.

Configure thresholds, repeats, escalation schedules and routing responsibly. Do not deliberately generate alert storms, artificial failures, SMS pumping or other traffic designed to consume credits, increase carrier charges or exploit a messaging provider. Channel availability in a plan does not authorise unlimited or abusive delivery. Applicable limits and any SMS-credit charges are governed by the plan, Terms of service and disclosed channel conditions.

7. Respect service boundaries and fair access

Do not interfere with UptimeOwl, its providers or other customers. This includes attacks on availability, unauthorised access across workspaces, deliberate exploitation of a defect, tampering with audit records, or attempts to disable security, billing or usage controls.

Use supported interfaces and observe documented rate limits, quotas and reasonable technical safeguards. Do not split traffic, rotate identities or repeatedly create accounts to evade plan allowances, payment requirements, suspensions or restrictions. Each tenant account belongs to one workspace; a legitimate additional workspace requires a separate account, not an attempt to bypass these rules.

Do not sell, sublicense or expose access to our infrastructure except through functionality and arrangements expressly permitted by your agreement. Supported customer-facing embeds, authorised delegated administration and any agreed white-label use remain subject to their normal access and plan conditions.

If you discover a possible security issue, report it privately to [email protected]. Provide enough information for us to investigate without accessing other customers' information, disrupting services or disclosing credentials. A report is not permission to continue intrusive testing.

8. Use integrations and AI within their intended scope

Connect only accounts, channels, domains and third-party systems you are authorised to administer. Observe their applicable terms and permissions. Do not use webhooks, provisioning, infrastructure-as-code, ticket integrations or agents to bypass another service's safeguards or perform unauthorised actions.

Where AI assistance is offered, submit only information you may lawfully provide for that feature and follow its stated data-handling conditions. Do not use it to create harmful or deceptive content or enable prohibited activity. Review suggestions before acting on them, especially where they affect production systems, people or public incident communications. Enabling an optional feature does not remove your responsibility for the actions you approve or make its output a guaranteed diagnosis.

9. Investigations and protective action

We may investigate credible reports and relevant service activity to assess compliance, subject to the Privacy Policy, Data Processing Addendum and applicable law. We may ask you to explain a configuration, confirm permission or correct a problem. This does not mean that every target, message or item of content is reviewed or approved by us.

Where reasonably necessary to address a violation or a credible risk, we may limit traffic, pause a monitor or integration, restrict notification delivery, remove access to offending public content, or suspend or terminate access in accordance with the Terms of service and applicable law. We will consider the nature, severity, recurrence and impact of the issue and use a proportionate response. Where practicable, we will explain the issue and allow an opportunity to correct it.

Immediate action without advance notice may be necessary to protect people, data or infrastructure, respond to serious abuse, or comply with a legal obligation. We may limit what we disclose where disclosure would undermine security, an investigation or a legal restriction. You may contact [email protected] to explain the circumstances or request a review of an enforcement decision.

An access restriction does not itself authorise indiscriminate deletion of your workspace data. Retention, lawful preservation, return and deletion remain governed by the Terms of service, Privacy Policy, Data Processing Addendum and applicable law. Payment-related suspension follows the billing terms; this policy does not introduce additional billing penalties or replace the agreed payment-grace process for ordinary non-payment.

10. Reporting concerns and policy changes

Report suspected misuse to [email protected]. Include the relevant public URL or workspace reference, the date and time, a description of the concern and any evidence you can lawfully share. Do not send passwords, secret keys or unnecessary personal data. If someone is in immediate danger, contact the appropriate emergency services; UptimeOwl is not an emergency-response service.

We may update this policy through the change process set out in the Terms of service. The current policy is available at /acceptable-use-policy. This policy supplements the Terms of service; it does not override mandatory rights or the Data Processing Addendum's safeguards for customer personal data.