Acceptable Use Policy

Nopen turns a sentence into a website with very little human in the loop. That is the whole point, and it is also the risk: an automated builder is an attractive tool for someone who wants a scam page up fast. So every idea is screened before a build starts, and this page tells you exactly what the screen blocks — no vague "anything we deem objectionable".

This policy forms part of the Terms of Service.

These are the categories the screen hard-blocks. A prompt matching one of them is refused outright.

• Fraud, phishing, and scams

  Pages built to impersonate someone and harvest credentials or card details, sites trading stolen card numbers or packaged personal data, and deceptive money-making schemes generally.

• Child sexual abuse material

  Any sexual content involving minors, and anything built to distribute, advertise, or solicit it. There is no grey area here.

• Illegal drugs

  Selling, sourcing, or brokering controlled substances — methamphetamine, cocaine, heroin, fentanyl and the like — whether as a storefront or a directory.

• Illegal weapons

  Weapons you're not allowed to sell or make, and the untraceable end of it especially: ghost guns, unserialised firearms, and 3D-printed firearm files or the sites distributing them.

• Malware and attack tooling

  Ransomware, botnets, keyloggers, other malware, and DDoS-for-hire services such as stressers and booters.

• Counterfeiting

  Forged passports, identity documents, and diplomas, counterfeit money or currency, and counterfeit goods.

• Violence and threats

  Soliciting or arranging violence against people — hiring a hitman is the blunt case — along with threats and incitement.

Those categories are the whole list of what the screen sets out to refuse. Ordinary businesses, marketing and sales copy, adult-but-legal material, information about gambling, and ideas that are merely unusual or edgy are all allowed. The classifier is instructed in those words, so it isn't quietly stricter than this page. We're not in the business of refusing an idea because it's odd.

Two stages. A fixed pattern check runs on every prompt first — it's instant, costs nothing, and catches the blunt cases. When a model backstop is available, a classifier then reads the idea as a second opinion and can block something the pattern check has no word for.

The screen runs before the planner researches an idea you type on the public site, before a build starts, and again before a domain is registered for a site — so an idea can't be reworded past it after the first pass. Your prompt is sent to a model provider for that check; the Privacy Policy lists which ones. It is a screen on what you ask for, not a review of every page a site later grows.

It is automated, and it is not perfect. It will sometimes refuse a legitimate idea, and it will sometimes let something through that it shouldn't have; when it can't reach a verdict at all, it refuses and you can try again. Getting that balance right is our problem to fix, not yours to work around.

Separately from the idea screen, the code an agent writes is scanned before every release of a site, and blocked if it does any of this:

• Crypto-mining — refused in a site's own code, and kept out of the visitor's browser by the content-security policy every generated site ships with.
• Server-side outbound requests from a site's own API code — the pattern that turns a site into an open proxy or an exfiltration route.
• Running code assembled at runtime (eval, dynamic imports, constructed functions).
• Opening WebSockets, spawning background workers, or reading the host environment.
• Weakening or removing that content-security policy.

This is enforced by the platform, on us — it isn't a rule you have to remember. It also means an agent cannot be talked into writing those things on your behalf.

The screen watches the idea. These are on you, and breaking them is grounds for suspension even if nothing was ever flagged:

• Don't impersonate a person, business, or public body, or imply an endorsement you don't have.
• Don't sell what you don't have the rights to — someone else's brand, writing, images, or code.
• Don't use a site's email to message people who never asked. Nopen sends email on your behalf only to a buyer, as the delivery of a digital product purchased from your site; it never messages your leads. Lead-capture forms only record consent — they send nothing to the lead. If sending on your behalf expands beyond this release, email sent on your behalf may go only to addresses that gave recorded consent on that site, must offer a way to unsubscribe, and must not exceed the frequency that consent was given for. Unsubscribes and spam complaints are suppressed permanently and automatically, and we don't offer a way to override that.
• Don't try to defeat the screen — rewording an idea to slip a prohibited build past it is itself a breach.
• Don't probe, overload, or reverse-engineer the platform, or resell access to it.

Depending on what we find, we may refuse a build, block a release, take a live site down, or suspend the account. A build refused before it starts spends no credits. Where a refusal happens partway through work that had already begun, email us and we'll sort the credits out. We report to law enforcement where the law requires it, and child sexual abuse material is always reported.

If a legitimate idea was refused, email hello@hasna.com and a human will look at it. If you've found a Nopen-built site that breaks this policy, email the same address with the address of the site — that's the fastest way to get it taken down.

We'll update this page when the screen changes. It is meant to describe what Nopen actually does, not to give us room we don't use.