Acceptable use policy

Last updated 2026-09-24

tuzy exposes services running on your own computer. You are responsible for everything served through your tunnels. You must not use tuzy to:

• phish, impersonate a brand, bank, email provider or any other service, or collect credentials or payment details that aren't for your own service;
• distribute malware, run command-and-control servers, or host exploit kits;
• send spam or host content promoted by spam;
• host content that is illegal where you or your visitors are, including child sexual abuse material, or that infringes others' rights;
• run open proxies, VPNs or relays for third parties, mine cryptocurrency, or serve as a general-purpose CDN or file host;
• attack, scan or overload other systems, or evade tuzy's limits (for example by creating many accounts).

We may suspend names or accounts that break these rules, sometimes automatically after reports from several networks, and we cooperate with valid legal requests. Report abuse at tuzy.dev/abuse or abuse@tuzy.dev.

Browser warning page

To protect visitors from phishing, browsers opening a tunnel of a new account first see a page saying the site is served through tuzy, with Visit site and Report abuse.

• Who sees it: only people opening a page in a browser. Webhooks, curl, API and fetch calls never see it.
• When it stops: automatically once the tunnel owner's account is 7 days old. A visitor who clicks Visit site doesn't see it again on that address for 7 days.
• When it comes back: if an abuse report against the account is upheld, the page is shown again for that account's tunnels, whatever its age.
• Automation: tools such as Playwright or screenshot services can send the request header tuzy-skip-warning: 1.

Limits

Each account has up to 10 names, a request-rate limit per tunnel, and a monthly allowance of long-running streams (50 hours of streams past their first 5 minutes). Limits may change to keep the service free and healthy.