Acceptable use policy

Captchas exist to protect websites and their users. bypass.so is built for legitimate automation, testing and accessibility work, and this policy sets out where the line is. It applies to every use of the Service, including use by anyone you allow to use your API key.

Capitalised terms have the meanings given in the Terms of service.

You may use the Service only on websites, applications and services that:

1. you own or operate, or
2. you are authorized by the owner or operator to test, monitor or automate, within the scope of that authorization.

Examples of permitted use include automated end-to-end and regression testing of your own sign-up or checkout flows, uptime and journey monitoring of your own services, authorized security testing within an agreed scope, and assistive tools for people who cannot complete a captcha themselves, where the site permits it.

You must not use the Service, directly or indirectly, to:

• Commit or facilitate fraud, including payment fraud, ad or click fraud, promotion and referral abuse, or impersonation.
• Send spam or unsolicited messages, comments, reviews, posts or form submissions.
• Carry out credential stuffing, password spraying, brute-force sign-ins or any other attempt at account takeover.
• Create fake, bulk or automated accounts in violation of a site's terms.
• Get around purchase limits, waiting rooms or quotas that a site uses to allocate scarce goods, tickets or appointments fairly.
• Collect personal data without a lawful basis, or scrape a site in breach of the law or of rights you have agreed to respect.
• Overload, disrupt or attack any website or service, including denial-of-service activity.
• Distribute malware, phishing or other harmful content, or support harassment or any other illegal activity.
• Violate sanctions or export control laws, or provide the Service to anyone subject to them.

You must not:

• Share, sell or publish your API key, or let anyone outside your organisation use it.
• Resell the Service or offer it as part of another product without our written agreement.
• Probe, scan or test the security of the Service, or try to access other customers' data or accounts.
• Interfere with the Service, poll faster than our documentation recommends or try to get around technical limits.
• Submit wrong-answer reports that are not genuine, or otherwise abuse billing or refund features.

1. You are responsible for making sure each use of the Service is lawful and permitted by the terms of the website concerned.
2. Keep a record of the authorization you rely on, and provide it to us within a reasonable time if we ask.
3. Make sure your team, contractors and integrations follow this policy.

We review task records and technical logs to detect misuse. If we believe this policy has been breached, we may, depending on severity:

• Ask you for information or proof of authorization.
• Rate-limit, suspend or rotate API keys.
• Close your Account. Remaining Balance may be forfeited as described in the Terms of service.
• Report activity to affected parties or to law enforcement where appropriate.

Where possible we will tell you what we found and give you a chance to respond, unless doing so would create a security risk or break the law.

If you believe the Service is being used against your website or in breach of this policy, use the abuse reports option on our contact page. Helpful details include:

• The affected website or application.
• Approximate dates and times of the activity, with time zone.
• Any task ids, request details or examples you have.
• How we can contact you for follow-up.

We review every report. We may not be able to share details of any action we take with the reporter.

We may update this policy as the Service and the law change. The "Last updated" date at the top shows when it last changed. Material changes are announced as described in the Terms of service.