1. Core principles

You must comply with applicable laws, regulations, third-party rights, and the usage policies of the model provider you select. Do not use Token Box to bypass security controls, access restrictions, billing rules, or provider limits.

You are responsible for activity performed through your account, API keys, or integrations and must take reasonable measures to prevent unauthorized access.

2. Prohibited use

You may not use or help others use Token Box to:

• commit fraud, phishing, extortion, money laundering, identity theft, impersonation, or other unlawful activity;
• create, distribute, or facilitate child sexual abuse material, explicit sexual exploitation, non-consensual intimate content, or targeted malicious harassment;
• create or distribute malware, credential-stealing tools, viruses, exploit code, or conduct unauthorized intrusion, scanning, or attacks;
• threaten, incite, or organize real-world violence or terrorism, or assist with weapons or dangerous materials;
• send bulk spam, manipulate elections or public discourse, impersonate institutions, or conduct deceptive automated activity;
• make unauthorized high-impact decisions or rely on model output as the sole basis for medical, legal, financial, employment, education, or safety decisions;
• infringe copyright, trademark, privacy, trade-secret, or other intellectual-property rights, or process personal data you lack authority to submit;
• disrupt the service, create abnormal load, conduct unauthorized stress testing, resell access, or interfere with other users.

3. Access controls and API keys

API keys are for authorized users and applications only. Do not publish them, share them with unrelated third parties, embed them in client-side code, or use them for unauthorized multi-tenant relaying. If a key is exposed or you detect unusual usage or account compromise, revoke it and contact support promptly.

Do not evade rate limits, credit limits, authentication, risk controls, or other technical measures, and do not create multiple accounts to avoid restrictions or enforcement.

4. Content and user responsibility

You must have the necessary rights, authorization, and legal basis for inputs, files, and personal data you submit, and you are responsible for reviewing model output before using it. Model output may be inaccurate, biased, outdated, or similar to output provided to others.

5. Enforcement

We may investigate suspected violations and take measures appropriate to the risk, including warnings, rate limits, blocking requests, suspending or terminating accounts, revoking API keys, removing related content, or cooperating with law enforcement. In urgent cases, we may act immediately without prior notice to protect users, the public, or the service.

Where permitted by law and circumstances, we consider the nature, severity, recurrence, and remediation of the violation.

6. Reporting, appeals, and updates

If you identify suspected abuse, exposure, unauthorized access, or another violation, contact us promptly with relevant URLs, request IDs, time ranges, and necessary facts. Do not send API keys or complete sensitive content.

You may contact support to provide context or appeal an account restriction. We may update this Policy; material changes will be announced through the website or console in a reasonable manner with a new effective date.