1code Studio Acceptable Use Policy

Last updated: 30 October 2026 · Version 1

This policy says what you may not do with 1code and what we do when someone breaks the rules. It applies to every 1code app, to everyone in your company or workspace, and to every AI agent and app you connect. In short: do not break the law or harm people, do not deceive people or pretend to be us or anyone else, do not spread malware, do not send bulk or marketing email, do not misuse free sites, do not scrape, resell or wrap 1code, do not get around our limits, and do not attack the service. If something breaks these rules, we may remove it, limit a feature or pause an account. We tell you what we did and why, and you can ask us to look again. The first part applies to everyone. The country sections after it add only what is different or extra where you live.

Who this policy covers

This policy is part of our Terms of Service. It covers all of 1code: Docs, Sheets, Slides, Pdf, Drive, Mail, Channels, Rooms, Calendar, Project, Store, Books, 1code ID, the 1code phone app, free sites at <name>.1code.host, the 1code connector (MCP) and the developer API.

It applies to you, to everyone you invite into your company or workspace, and to every AI agent and app you connect. You are responsible for what happens under your account. If you run a company or workspace, make sure the people in it know these rules.

"We", "us" and "1code" mean 1CODE X LTD, which runs 1code, and for customers in South Africa also 1code X (Pty) Ltd, which contracts with and bills them. Either company may act under this policy.

What you may not do

Illegal content and harm to people

Do not use 1code to create, store, share, publish, send or sell anything that is illegal where you are, where the people you reach are, or where we are based (the United Kingdom and South Africa). In particular, do not:

share child sexual abuse material or anything that sexualises children, or contact a child for sexual purposes. We remove it, close the account and report it to the authorities;
promote, support or recruit for terrorism or violent extremism;
threaten anyone, stalk them, or stir up violence against them;
harass, bully or abuse people, including by writing again and again to someone who has asked you to stop;
attack people for their race, ethnicity, nationality, religion, sex, gender, sexual orientation, disability or age;
share intimate images or video of someone without their consent, including fake ones made with AI;
pass off AI-made images, audio or video of a real person as real, or use them to deceive, shame or defraud anyone;
encourage or help anyone to end their life or seriously harm themselves;
publish someone's private details, such as their home address, ID number, bank details or health information, to expose or target them;
record a meeting or call without telling the people in it, where the law requires their consent;
run scams, frauds or pyramid schemes, or launder money;
infringe copyright, trademarks or other people's rights, for example by sharing films, music, books or software you have no right to share.

Do not publish pornography or sexually explicit content on any public part of 1code: public sites, stores, public Rooms or public links.

News, education, research, art, commentary and satire are fine, even on hard subjects. Context matters, and we look at it before we act.

Phishing, scams and impersonation

Do not:

make pages, forms, emails or messages that trick people into giving passwords, codes, card numbers, ID documents or money;
pretend to be 1code or our staff, or copy the look of our sign-in, approval or payment screens;
pretend to be another company, brand, public body or person, or suggest you work with them when you do not;
use a company name, email address, site name or store name that belongs to a brand you do not own or represent.

Talking about a brand, reviewing it or clearly labelled parody is fine. Pretending to be it is not. We may refuse, or take back, a company name, address or site name that impersonates someone.

We will never ask you to approve a sign-in you did not start, and we never ask for the sign-in details of your AI account. If someone does, it is not us. Report it.

Malware and attacks on others

Do not use 1code to store, send, host or link to malware: viruses, ransomware, spyware, trojans, exploit kits, or crypto miners that run without the owner's consent.

Do not use 1code to attack anyone else's systems. That includes denial-of-service attacks, password guessing, taking over accounts, scanning for weak spots, and getting into systems you have no permission to test.

Email: no spam and no bulk sending

1code Mail is for conversations between people. It is not for bulk or marketing email.

No marketing. No newsletters, promotions, cold outreach or mailing lists, even to people who agreed to receive them. Use a service built for that.
10 recipients per email sent outside 1code from your own domain, counting To, Cc and Bcc together.
100 outside emails per person per day from your own domain. An outside email goes to an address that is not on 1code Mail. Each recipient counts separately, so one email to 5 outside people counts as 5. A day is a calendar day in your account's time zone. The limit covers every address you send from.
1code.email addresses (including company addresses such as name@company.1code.email) may write to anyone on 1code. They never send outside 1code, not even replies. To write to people outside 1code, connect your own domain.
Your own domain may write outside 1code only to your Contacts, or reply to an email someone sent you, within these limits. Contacts are people who write in, whom 1code adds automatically, and people you add by hand. Keep the sender records we ask you to add (SPF, DKIM and DMARC) in place.
Do not split messages, rotate addresses or open extra accounts to get around these limits.
Do not buy, rent or harvest email addresses, fake who an email is from, or hide where it came from.
Stop writing to anyone who asks you to stop.

Emails that 1code sends for you as part of a service, such as a confirmation or reminder for a Room someone signed up for, or an order confirmation from your store, do not count as your email.

We watch bounces and spam complaints. If they rise, we may lower the limits or pause outside sending, for an address, a company or the whole service, until the problem is fixed.

Free sites

Free sites at <name>.1code.host are for your own real website or store. Do not use them:

as a file store or download host, or to serve files, images or video to sites hosted somewhere else;
to hide where a link goes, for chains of redirects or as a link shortener;
to run proxies, VPNs, crypto mining or other heavy computing;
for search spam, such as doorway pages, keyword-stuffed pages or copies of other sites;
to hold names you will not use, or to sell names on;
to get around the limits of a free site.

We scan published free sites for malware, phishing, impersonation and other breaches of this policy, when they are published and from time to time after that. A site that fails a check may be taken offline while we look at it.

Selling

Selling through 1code, in Store or in a paid Room, needs a completed identity check (KYC) and a payout account in your own name or your business's name. When you sell:

sell only what is legal where you and your buyers are, and anything that needs a licence only if you hold that licence;
do not sell counterfeit or stolen goods, firearms, ammunition, illegal drugs, or anything Paystack or Stripe does not allow;
describe what you sell honestly, deliver it, and follow the consumer law of your buyers' country, including on refunds and returns;
do not let anyone else sell with your identity check or payout account, and do not take payments for another business;
issue only genuine invoices and receipts in Books.

Paystack and Stripe have their own rules and may hold or refuse payments under them.

Scraping and bulk copying

Do not scrape, crawl or bulk-download 1code, or other people's content on 1code, such as their sites, stores, Rooms or shared files. This applies whether you do it by hand, with a tool or with an AI agent. Do not collect email addresses or other personal information from 1code. Do not copy content from 1code in bulk to train or tune AI models.

Downloading and exporting your own content is always fine. So is letting search engines index your own public site.

Reselling, white-labelling and wrapping

1code is for you and your organisation to use. Do not resell it, rent it out, white-label it, or wrap it inside your own product so that other people use 1code through you without their own account. This includes selling access to your account, to 1code addresses, or to the connector or API.

What is fine: running your own business on 1code, inviting your staff, sharing with your clients, selling your own products in Store, and building apps that people connect to their own 1code account under our developer terms.

Getting around limits and protections

Do not:

get around a limit, a pause or a ban, for example by opening more accounts, using someone else's account, or starting again under a new name;
create accounts in bulk or with automated tools;
buy, sell or hand over accounts, addresses or site names;
share your 1code ID, or approve sign-ins or actions for someone else;
copy, extract or misuse anyone's keys, certificates or approvals;
get around a protection on someone else's content, or share a private link to defeat its purpose;
get around our identity checks, or give false information in them.

AI agents and apps you connect

You may connect your own AI, such as Claude, ChatGPT or Gemini, through the 1code connector (MCP) or the developer API, with your own subscription or keys.

What your agent does, you do. This whole policy applies to your agent as if you had acted yourself.
An agent may not do what you could not do yourself. It may not send email you could not send, go past your limits, reach data you cannot see, or act as someone else.
Sensitive actions need your approval on your phone, by default: sending outside 1code, paying, publishing publicly, and deleting for good. Sending inside 1code and moving something to Trash do not ask by default. You can change each of these settings. Read what you approve. Do not build or use tools that approve for you.
No misuse through agents. Do not use an agent to scrape, send in bulk, create accounts, harass people, or produce spam or deceptive content.
Stay within the rate limits of the connector and the API.
Your AI account stays yours. We never ask for, store or pass on the sign-in details of your AI account. If anyone asks for them in our name, it is phishing.
The activity log. You can read a log of what your agents did. We keep it for one year. It is also the record we check if we look into a report about your account.

Any AI features 1code itself provides run on our own API keys, never on your personal AI subscription.

Developers who build apps on the connector or the API must also follow our developer terms. If an app harms people or breaks this policy, we may pause it. When we do, we tell the people who use it.

Attacking or overloading the service

Do not probe, scan, load-test or attack 1code. Do not overload it or interfere with how it works for other people. Do not get into accounts, data or systems that are not yours, or get around sign-in, approvals or other security. Do not take 1code apart to do any of these things.

If you come across a security problem, tell us at privacy@1code.email and give us time to fix it before you tell anyone else. Do not look at or change other people's data while you do. We will thank you.

What we do

How we find problems

Reports from anyone, with or without a 1code account.
Scanning published free sites for malware, phishing, impersonation and other harm.
Mail checks. Automated systems check mail for spam, fake senders and malware. We watch sending volumes, bounces and spam complaints.
Automated tools, including AI, help us sort reports and spot patterns of abuse.

People at 1code do not read your private files, mail or messages to look for breaches. We look only to check a specific report or a security problem, when you ask us to, or when the law requires it.

How to report

Use the report link where we show one, or write to privacy@1code.email.

Tell us:

where it is, such as a link or an address;
what is wrong, and why you think it is illegal or breaks this policy;
your name and email, so we can reply;
that you believe your report is accurate and complete.

You may report child sexual abuse material without giving your name. Send only the link. Never send us a copy.

We confirm that we got your report, look at it carefully and fairly, and tell you what we decided. Sending a report you know is false breaks this policy. If someone keeps sending reports that are clearly unfounded, we may stop dealing with their reports for a time.

What we may do

What we do depends on how serious the problem is, whether it was deliberate, whether it has happened before, and how many people it puts at risk. We also weigh people's freedom to speak, report and create. We may:

warn you and ask you to fix it;
remove or hide content, or make it private;
limit a feature, such as outside sending, publishing or selling;
pause a site, store, app, account or workspace;
close an account for serious or repeated breaches, including repeated copyright infringement;
refuse or take back a name;
keep evidence, and report to the police or other authorities where the law requires it or where someone's life or safety is at risk.

Usually we tell you first and give you a chance to fix the problem. We act first and tell you afterwards when waiting would harm people or the law requires it. Examples are child sexual abuse material, a real threat to someone, live phishing or malware, and an attack on the service.

Automated checks may block known malware, known phishing pages and known child sexual abuse material at once. A person reviews every pause or removal. If we pause something at once to stop harm in progress, a person reviews it straight after. Nothing with serious effects is decided by a computer alone, and a person decides every appeal.

Telling you

When we act on your content or account, we tell you:

what we did, to what, and for how long;
why: the rule in this policy or the law we relied on, and the facts;
whether it came from a report or from our own checks, and whether automated tools were involved;
how to appeal.

We do not tell you when the law forbids it, when telling you would put someone at risk or harm an investigation, or when we have no way to reach you.

If we close your account, we give you a chance to download your lawful content first, unless the law or someone's safety stops us.

Telling people affected

When we pause something other people rely on, such as an app, a shared workspace, a site or a store, we tell the people who use it that it is paused and what that means for them and their data. Visitors to a paused site see a notice that it is paused. We do not publish the reasons.

If you reported it, we tell you what we decided.

Disputes: review, appeal and complaints

If you disagree with a decision, about your own content or account or about a report you made, you can ask us to look again. Reply to our notice, or write to privacy@1code.email, within 6 months of the decision. Say what you think we got wrong.

Where we can, someone who was not involved in the first decision reviews it. We aim to reply within 14 days, and sooner when an account, store or business is paused.

If we got it wrong, we undo it as far as we can and restore your content.

You can also complain to us about how we handle reports in general, at the same address.

Our answer does not stop you going to a court or a regulator. Your country's section below says where.

Changes to this policy

We may update this policy. For significant changes we tell you by email or in 1code at least 30 days before they apply. A change needed to keep people safe, or to obey the law, may apply at once. Each version shows its date and number. We record which version you accepted, and in which country.

Contact

Privacy, security, reports of abuse or illegal content, appeals and authorities: privacy@1code.email
Help, billing and complaints: support@1code.studio
1CODE X LTD, 2 Centurion Way, Credenhill, Hereford HR4 7FF, United Kingdom. Registered in England and Wales, company number 12828341.
1code X (Pty) Ltd, 2 The Circus St, Three Rivers, Vereeniging 1935, South Africa. Registration number 2025/981275/07.

By country

South Africa

Take-down notices. You may send us a take-down notice under section 77 of the Electronic Communications and Transactions Act, 2002 (ECTA). Send it to privacy@1code.email with:

your full name and address;
your written or electronic signature;
the right you say is being infringed;
the material or activity you complain about, and where it is;
what you want us to do about it;
your phone number and email;
a statement that you are acting in good faith;
a statement that, to your knowledge, the information in your notice is true and correct.

Anyone who sends a notice knowing that it materially misrepresents the facts is liable for the damage a wrongful take-down causes (section 77(2)). We tell the person whose content it is, and they can appeal as described above.

Crimes we report. We report child sexual abuse material, and any reason to suspect it, to the South African Police Service, as section 24B of the Films and Publications Act, 1996 requires. We act on complaints and take-down notices from the Film and Publication Board under section 18E of that Act. Messages that incite violence or damage to property, that threaten people, or that share intimate images without consent are crimes under sections 14 to 16 of the Cybercrimes Act, 2020.

Films and games. If you sell films or games to people in South Africa, for example in a paid Room, you may need to register with the Film and Publication Board and have them classified. That is your responsibility.

Selling to consumers in South Africa. If you sell online to consumers in South Africa:

your store must show the information section 43 of ECTA requires, such as your full name and legal status, physical address, phone number, email, registration number, a full description of what you sell, the full price with delivery and taxes, your delivery times, your returns and refund policy, and your privacy policy;
buyers may cancel within 7 days under section 44 of ECTA, in the cases it covers;
buyers keep their rights under the Consumer Protection Act, 2008, including returning faulty goods within 6 months.

Email. POPIA section 69 and ECTA section 45 limit marketing email. Our ban on marketing email goes further than both.

If you disagree. If you are a consumer and are still unhappy after our appeal, you may go to the Consumer Goods and Services Ombud, the National Consumer Commission or a court. About your personal information, you may complain to the Information Regulator.

United Kingdom your region

Online Safety Act 2023. Parts of 1code let people share content with each other: Channels, Rooms, files shared from Drive, and public sites and stores, including free sites on 1code.host. These parts are user-to-user services under the Online Safety Act 2023, and we have the duties it sets. We assess and record their risks, as the Act requires. Email is not covered by the Act.

Illegal content in the UK includes the offences the Act names, such as terrorism, child sexual exploitation and abuse, threats, harassment and stalking, hate offences, controlling or coercive behaviour, intimate image abuse, cyberflashing, extreme pornography, fraud, selling drugs or weapons, people smuggling and trafficking, sexual exploitation, encouraging or assisting suicide or serious self-harm, foreign interference and animal cruelty.

Automatic tools. To find illegal content, we use automated tools such as matching files against lists of known child sexual abuse material (by digital fingerprint) and checking links against lists of known phishing and malware pages. We use them on files and links shared in Channels, Rooms, Drive and public sites, including free sites on 1code.host. They run when content is uploaded, shared or published. A match with known illegal material may be blocked at once. A person reviews every pause or removal, as "What we may do" says. The Online Safety Act requires us to tell you this.

Reports and complaints. Anyone in the UK can report content they think is illegal, with or without an account, as described in "How to report". We take illegal content down quickly once we know about it. You can complain to us about content you think is illegal, about content we removed or an account we restricted, and about how we meet our duties under the Act. We handle these through "Disputes: review, appeal and complaints" above.

Ofcom. If you think we are not meeting our duties under the Act, you can tell Ofcom, the UK's online safety regulator. Ofcom does not decide individual cases.

Crimes we report. We report child sexual exploitation and abuse content to the National Crime Agency.

Email. The Privacy and Electronic Communications Regulations 2003 (PECR) limit marketing email. Our ban on marketing email goes further.

European Union

Digital Services Act. 1code is a hosting service under the Digital Services Act (Regulation (EU) 2022/2065). Where we make content public at a user's request, such as public sites, stores and public Rooms, we are also an online platform. Because we are a small enterprise, the platform duties in Articles 20 to 28 do not apply to us, apart from Article 24(3).

Points of contact. Our point of contact for you and for EU authorities (Articles 11 and 12) is privacy@1code.email. You can write in English. We will appoint and name our legal representative in the EU (Article 13) before we market to people in the EU.

Notices of illegal content (Article 16). Anyone can tell us about content they consider illegal. For your notice to count under the Act, include:

a clear explanation of why you consider it illegal;
its exact location, such as the URL;
your name and email, unless the content concerns child sexual abuse;
a statement that you believe your notice is accurate and complete.

We confirm receipt, decide in a timely, careful and objective way, and tell you our decision, whether we used automated means, and how you can challenge it.

Statement of reasons (Article 17). When we remove or restrict your content, suspend or end your account, or stop or limit payments to you, we send you a statement of reasons. It has the details in "Telling you" above, the legal or contractual ground, and how you can challenge it: through our appeal, in the courts, or through an out-of-court body where you have access to one. In the EU we send it in every case, except when we have no way to reach you, when the content is deceptive high-volume commercial content (spam), or when an order from an authority covers it.

Threats to life or safety (Article 18). If we learn of something that suggests a crime threatening someone's life or safety, we tell the police or judicial authorities of the EU country concerned, or Europol if it is unclear which.

Orders from authorities (Articles 9 and 10). When an EU authority orders us to act against illegal content, or to give information about you, we comply as the law requires and tell you, unless the order says we may not.

Terrorist content. If an EU authority sends us a removal order under Regulation (EU) 2021/784, we remove the content, or block it in the EU, within one hour. We tell you, and you may challenge the order. Our contact point for these orders is privacy@1code.email, and, once appointed, our EU legal representative also receives them.

Complaints to a regulator (Article 53). If you think we break the Digital Services Act, you may complain to the Digital Services Coordinator in the EU country where you live or are established.

Business users (P2B). Where the EU or UK platform-to-business rules apply to a service (such as a future app marketplace) that you use as a business to reach consumers, we also:

give you reasons when we restrict or suspend what you offer through it, at the latest when it takes effect;
give you at least 30 days' notice before we end our whole service to you, unless the law requires us to act sooner or you have repeatedly broken this policy;
let you clarify the facts through our appeal;
give you at least 15 days' notice of changes to this policy that affect you.

Everywhere else

The policy above applies to you in full. Your local law also applies: do not use 1code for anything that is illegal where you are or where the people you reach are. We act on valid orders from courts and authorities that have power over us, and we tell you unless we may not. We report child sexual abuse material to the authorities who can act on it, such as the National Center for Missing & Exploited Children (NCMEC) in the United States. Send copyright notices to privacy@1code.email. You keep any right your country's law gives you to challenge our decisions in court or before a regulator.