X-TKN Acceptable Use Policy

Last Updated: October 14, 2026

This policy governs what may be sent through X-TKN, operated by Fennec LLC. It forms part of the X-TKN Terms of Service and applies to every account, including free Developer accounts and unauthenticated sandbox accounts.

1. Why this policy reads the way it does

X-TKN is designed so that we cannot read what you store. Where a payload is encrypted before it reaches us, we hold no key and can never produce the plaintext, for you or for anyone else. That design decides how this policy is enforced.

We do not screen payload contents, because we cannot. We enforce this policy on the signals we do have: account behaviour, traffic patterns, token metadata, billing history, and reports from third parties. Enforcement is therefore account-level rather than content-level. We suspend accounts; we do not remove individual secrets on the basis of what is inside them, because we cannot see inside them.

That limitation cuts both ways, and you should read it before you rely on the service. We cannot verify that you are complying with this policy, and you should not infer permission from our silence.

2. Prohibited content

You may not use X-TKN to store, transmit, or hand over:

  • Material that is unlawful to possess or distribute in the United States, including child sexual abuse material.

  • Credentials, keys, tokens, or session material obtained without the authorisation of the account holder or system owner.

  • Malware, ransomware payloads, exploit kits, or command-and-control instructions for compromised systems.

  • Material that infringes another party's copyright, trademark, patent, or trade secret.

  • Personal data you have no lawful basis to process, or that you are contractually barred from transferring to a processor.

  • Material subject to export controls or sanctions regimes that prohibit transfer through a United States service provider.

3. Prohibited conduct

You may not:

  • Use the service to conceal the origin, destination, or contents of activity that is itself unlawful.

  • Use retrieval links or tokens as part of phishing, credential harvesting, or any scheme intended to deceive a recipient about who is sending them a secret.

  • Use X-TKN as general-purpose file storage, a content delivery network, a message queue, or a database. The service is sized and priced for one handoff of one secret.

  • Create multiple accounts to obtain additional free quota, additional trials, or to evade a suspension. Team trials are one per customer.

  • Circumvent, probe, or attempt to defeat quota accounting, rate limiting, IP allowlisting, or recipient authentication.

  • Resell, sublicense, or white-label the API to third parties as your own secrets service without a written agreement with us.

  • Automate account creation, including sandbox account creation, beyond what your own integration needs.

  • Access, or attempt to access, tokens or audit records belonging to another account.

4. Security testing

You may test X-TKN against your own account. You may not test it against another customer's account, and you may not run load tests, denial-of-service tests, or automated scanning against our infrastructure without written permission first.

Report vulnerabilities to support@fennec.studio, with "Security" at the start of the subject. We will not pursue legal action over good-faith research that stays inside your own account, avoids degrading the service for others, and gives us a reasonable window to respond before disclosure.

5. Reporting abuse

Report suspected abuse to support@fennec.studio, with "Abuse" at the start of the subject. Include the retrieval URL or token identifier if you have one, and what you believe is happening.

Understand what we can and cannot do with a report. We can suspend an account, and we can delete a token so that it stops resolving. We cannot tell you what a secret contained, confirm what it contained, or recover it after deletion, and we will not attempt to.

6. Enforcement

Depending on severity, we may:

  • Ask you to correct the problem within a stated period.

  • Suspend or rate-limit an API key.

  • Suspend the account, which stops new tokens being minted and stops existing tokens resolving.

  • Terminate the account and delete its data, subject to the retention terms in the Privacy Policy.

  • Report the matter to law enforcement where we are required to, or where we believe there is a risk to someone's safety.

We will generally warn before suspending. We will not warn first where we believe the conduct is criminal, where a warning would let evidence be destroyed, or where delay puts other customers or the service at risk.

Suspension for abuse does not entitle you to a refund of fees already paid.

7. Appeals

If you believe your account was suspended in error, write to support@fennec.studio with "Appeal" at the start of the subject. Say what you use the account for and why you think the decision was wrong. We will review and reply, though we are not obliged to reverse a decision or to explain the specific signal that triggered it, since explaining it in detail teaches the next abuser what to avoid.

8. Changes

We may update this policy. Material changes take effect thirty days after we post them, except where a change is required to respond to an active legal or security problem, in which case it takes effect when posted.

9. Contact

Fennec LLC

Write to support@fennec.studio for abuse reports, security reports and anything else. Starting the subject with "Abuse", "Security" or "Legal" helps us route it.