Acceptable use

Why this policy is short and enforced

Requests through the managed pool leave from residential addresses supplied by an upstream provider whose own terms forbid several categories outright, and one account's abuse suspends everyone on it. So the denylist below is enforced at the proxy, not merely written down here.

A target this policy refuses answers immediately with a named refusal and costs you nothing. The one exception is an address your own browser.actions script led the page to: that call already ran in our browser, so it keeps the browser price and its bandwidth.

Targets we refuse

Banking, payment and brokerage sites. Government and tax portals. Webmail and account sign-in pages. Ticketing and event resale. Streaming media. Application stores.

Some of those are gated rather than closed. Where our provider approves a category in writing we open it host by host: Brazil's public procurement portals, PNCP and Compras.gov.br, answer on the managed pool, because tender data is published to be read. No other government domain does.

Private, loopback and link-local addresses, on every redirect hop rather than only the first. That includes cloud metadata endpoints and anything on our own network.

Any site that asks us to stop. A domain whose operator writes to us is refused from then on, whatever category it falls in and whoever is asking for it. See Reporting below.

These apply to the managed pool. A proxy you bring is your own exit under your own provider's terms, so the category list does not apply to it. The private-address refusal applies to every pool, always.

What you must not do with the results

Do not collect personal data you have no lawful basis to hold, and do not build databases of people from public profiles for resale, scoring or contact without their knowledge.

Do not use this API to infringe copyright, to circumvent a paywall you have not paid for, or to gather material that is illegal where you or the target are.

How you must behave toward a site

Read a site's terms and its robots directives and respect them. We do not check them for you, and our fetching a page is not permission to fetch it.

Do not aim volume at a single host that a reasonable operator would call an attack. Concurrency limits exist per plan for this reason; working around them by spreading a flood across accounts is a breach of this policy.

What you must not do to us

Do not resell raw proxy bandwidth, and do not use a browser session as a general-purpose tunnel. A session is a browser we run for you, not an exit node.

Do not probe or attempt to reach anything on our network other than the API, and do not try to escape the browser container. Genuine security research is welcome; tell us at hello@scrapa.app before you start and we will agree a scope.

What we do about it

We enforce in the smallest step that works: a refusal at the proxy, then a rate limit, then a per-account kill switch, then suspension. Where the situation allows it we tell you what happened and what would fix it.

Serious or repeated breaches end the account. A breach that threatens the upstream accounts this service depends on is acted on immediately, because the alternative is everyone losing the service at once.

Reporting

If traffic from us is hitting your site in a way you do not want, write to abuse@scrapa.app with the timestamps and the hostname. We trace it, we stop the account behind it, and if you would rather we were gone entirely we refuse your domain at our proxy. No customer of ours reaches it through us again.

We will not make you fill in a form or prove standing in triplicate. An email from the domain itself, or from its published abuse contact, is enough, and we act the same day. If we get it wrong, the same address undoes it.

If you believe someone is using this service against this policy, the same address reaches a human.