The rules, in practice

Four legal pages exist, and none of them are the sort of thing you were planning to read. This page is the practical version: what you may run, what happens if someone complains about something of yours, and what you can do about it.

Page	Read it when
Terms of Service	You want the actual contract — including the data processing agreement at §10.
Privacy Policy	You want the row-by-row list of what Allocus stores about you.
Abuse and illegal content	You need to report something, or something of yours was reported.
Service notices	You want the public record of incidents, price changes and Terms changes.

What you may not run

Nothing illegal where you are or where the servers are, and specifically:

• Malware, phishing pages, or infrastructure for attacking other systems.
• Bulk unsolicited email.
• Cryptocurrency mining, or anything else whose purpose is to consume as much CPU as it can get. This one is about the business model rather than morality: a fixed price works only if boxes are used like servers rather than as a rented compute farm. A busy app is fine. A deliberate CPU sink is not.
• Reselling your box as shared hosting to third parties.
• Material that sexually exploits children, incites violence, or that you have no right to distribute.

Beyond that list, overloading your own box is explicitly allowed. Run twenty apps, run a benchmark, wedge it entirely — it gets slow, and that's the only consequence. There is nobody else on your box to protect, which is the point of the one-box-per- developer shape.

You keep all rights to your own code and content. Allocus claims no ownership over anything you deploy.

Nobody is looking at your apps

Allocus does not monitor, review, or scan what you deploy. There's no feed, no recommendation system, and nothing is published by Allocus itself — in EU terms it's a hosting service, and the enforcement process is built around acting on reports rather than policing content in advance.

The practical consequence: nothing happens to your app unless somebody reports it, or it breaks something. Enforcement is reactive by design.

If something of yours gets reported

Reports go to the abuse address and a person reads every one. What follows is chosen to be the smallest response that ends the problem:

1. Nothing — if the report is unfounded, out of scope, or better aimed at you directly.
2. A message to you with a deadline to fix it, usually 72 hours. This is the normal route for contested and non-urgent matters: copyright and trademark claims, defamation, a Terms breach that isn't harming anyone right now. Meet the deadline and the case closes.
3. That one app taken offline — your other apps keep running.
4. The account suspended — nothing new can be deployed.
5. The account closed and the box destroyed — the most serious cases, and repeat offenders.

Two design choices in there are worth pointing out, because they're in your favour:

A takedown hits one app, not your box. Taking content down and suspending an account are separate levers, so one bad app doesn't kill unrelated work you have running.

Suspension leaves your box serving. A suspended account can't deploy, tear down, or use the API — but the apps already running keep answering traffic. Teardown is locked specifically because it's destructive: someone under investigation must not be able to erase the evidence their own appeal would be decided on. Cancelling billing stays open.

Acted on immediately, without warning first

A short list skips the notice step and gets removed as soon as it's confirmed. You're told afterwards rather than first:

• child sexual abuse material,
• terrorist content or incitement to violence,
• credible threats to a person's life or safety,
• malware, phishing pages, botnet control servers, or infrastructure attacking others,
• anything causing serious ongoing harm where waiting makes it worse.

Child sexual abuse material and credible threats to life are also reported to the police, as the law requires.

You always get an explanation, and an appeal

Whenever something of yours is restricted, you're given:

• the facts the decision was based on,
• the rule or law relied on,
• confirmation that a person decided it. Nothing here is decided by an algorithm.

That statement of reasons is stored on your account and shown to you on the dashboard, rather than emailed once and forgotten.

To challenge it, reply within 30 days. A human re-examines the case — a second look, not a rubber stamp — and you get an answer within 10 working days. If the original call was wrong, the content and the account are restored and it counts for nothing against you.

Data belonging to a removed app is kept for 90 days, not deleted, precisely so a successful appeal can restore something real. That's the one case where Allocus keeps your data longer than usual, and the reason is that the alternative would make appeals meaningless.

These are the ordinary steps, not a guarantee of process

Where a case is serious, ambiguous, or simply doesn't fit the pattern, the operator may act sooner or differently — including on a strong suspicion before a report is fully investigated. The explanation and the right to challenge always stand, though.

Reporting something yourself

If an app on *.allocus.dev is doing something wrong, the abuse address on the abuse page is the route. Include the full URL (a bare hostname makes it much slower to find), what's wrong with it, and your name and email so it can be followed up.

Two things to know before you send one:

• Your name and address are normally shared with the customer concerned, because they're entitled to know the case against them. Say so if you believe that would put you at risk and it will be weighed. Reports about child sexual abuse material or terrorist content can be made without identifying yourself.
• Often the customer is the faster route. Allocus hosts the app but didn't write it, and the app itself will usually say who runs it.

Targets: acknowledged within 2 working days, decided within 5 working days of that, with manifestly illegal content acted on ahead of both. If someone is in immediate danger, contact the police first — Allocus can take content offline, not respond to an emergency.

Law enforcement and authorities

Orders from a competent authority are complied with as far as the law requires, and you are told unless the order or the law forbids it.

Worth knowing what there is to hand over, which is less than people assume: a GitHub username, one contact email address, and billing references. No card details, and no routine inspection of what runs inside your apps.

Found a security problem in Allocus itself?

Email the support address rather than filing it publicly. It reaches the operator directly and you'll get an answer. The service notices page is where any incident that affects customers gets posted.