Acceptable Use Policy

Use Mushy responsibly, follow network rules and keep people in control of publishing.

Current version 1.0 · Effective October 26, 2026

Under legal review

Prohibited

This policy is part of the Terms for using Mushy, provided by EcoEarth Enterprises, Inc. You are responsible for how you and your workspace use Mushy.

Do not use Mushy for:

• Spam, including unwanted bulk posts, messages or replies.
• Impersonation, including pretending to be another person or business without permission.
• Harassment, threats or targeted abuse.
• Misleading automation, including disguising automated activity to deceive people.
• Breaking network rules, including the terms and policies of each social network you connect.

Do not use fake accounts, duplicate Free workspaces, stolen credentials or payment attempts to get around safeguards.

Automation

Agents act for the member who connected them and on the workspace’s behalf. You are responsible for what your agents do and for content a person approves. Nothing goes public without a person’s approval: agents cannot publish on their own. Follow the same rules whether you use the app, an agent or an API key.

Sign-up checks

We check sign-ups and requests for sign-in emails to limit abuse. Your browser solves a proof-of-work challenge that our sign-in server issues and checks, without a third party. You must verify your email address before creating a workspace. We refuse disposable email domains and limit accounts created from the same IP address. An account counts when its email is verified or its Google or Apple sign-in completes. Verification emails count toward sign-in email limits.

Free plan

A social network account can belong to only one Free workspace at a time. Moves between Free workspaces are limited. Reconnecting it to the same workspace is not a move. Upgrading releases the workspace’s claims, so the network account can join another Free workspace immediately; later moves are limited again. If a downgrade would break this rule, we pause the affected channel and explain why.

Sign-up and billing signals can flag likely duplicate Free accounts for review; a match does not block a new workspace outright. Sign-up signals use keyed hashes of the IP network and the sign-in device cookie, rather than the raw values, and are kept for a limited period. Matching another Free Owner opens a review case.

Payments

Payments go through Stripe Checkout, with 3-D Secure when your bank asks for it. Stripe Radar blocks high-risk payments and card-testing patterns. We limit checkout attempts by workspace and IP address. A payment dispute or chargeback pauses publishing for the workspace and opens a review case.

Content limits

New workspaces have an initial publishing limit; extra posts wait until that initial period ends. All plans have the same daily per-channel guard. Unusually heavy publishing, including a sudden increase over a workspace’s recent busiest hour, can pause publishing for review.

We check outbound links against Google Web Risk and our own blocklist when a post is scheduled and again when it publishes. If the link check is unavailable, posts still publish on time. A post scheduled during an outage is checked again at publishing.

Near-identical posts across other workspaces on the same network can open a flag case. We compare fingerprints and counts, without sharing content between workspaces. The case opens for the workspace whose post triggers the flag, with a limit on repeat cases. This flag alone does not hold publishing or email the customer. X replies must also follow the network’s rules and Mushy’s limits for X replies.

Account security

Keep your sign-in and agent credentials secure. We email you when you sign in from a new device, recognised by an essential cookie on the sign-in host.

Your Profile lists active browser sessions. Use “Sign out everywhere” to end those sessions. Agents keep their own credentials; manage those separately in My agents. Repeated wrong codes temporarily lock code sign-in for that email address. Sign-in emails then carry only a link, and passkeys still work.

Super Administrators must use passkeys for the console and to approve Super MCP connections. Staff support access requires a session signed in with a passkey. Their ordinary app sign-in follows the normal rules.

Rate limits

We limit sign-in requests, publishing, API calls and other activity to protect the service. Agents and API keys that repeatedly hit rate limits are slowed further, with longer holds for repeated breaches. Do not bypass these limits. API keys belong to one workspace and cannot act across workspaces. Limits and their time windows are settings, so we do not list their thresholds here.

Enforcement

Every automatic pause or flag opens a review case and alerts our support team. Staff can also open a case from an abuse report. Case evidence records triggers and counts, never content.

We may clear a case, warn you, keep publishing paused or suspend the workspace for a serious breach of this policy or the Terms. Clearing a case or issuing a warning releases that case’s publishing hold; a warning also comes by email. Keeping a pause closes the review but leaves the hold until staff release it.

We give notice explaining what was paused, why and how to appeal, except in active abuse cases. To appeal, reply to the notice email. Cases and appeals are reviewed within 4 business hours for paid workspaces and 2 business days for Free. Business hours are 9:00 to 17:00 America/Chicago, Monday to Friday.

While suspended, members can sign in and read, and the Owner can export and delete data. Billing continues. Publishing, agents and every other change stop. A breach can also lead to deletion under the Terms, after the required notice to the Owner and Admins; notice may be withheld during an open abuse case or where the law requires.

Reporting

Anyone can report abuse, whether or not they use Mushy. Email [email protected]. Reports are reviewed on the same schedule: within 4 business hours for paid workspaces and 2 business days for Free, during the business hours above.

Monitoring

We review weekly counts of abuse cases, pauses, disputes and refused sign-ups in our platform analytics. Refused sign-ups and checkout attempts are counted daily by reason, without an email address, IP address or workspace in those counts. Payments blocked inside Stripe Checkout by Radar remain visible in Stripe and are not included in these platform counts.