The small print

Acceptable Use Policy

What may and may not be shared on VACUUM, how a report is handled, and what happens to an account that breaks these rules.

Draft — not in force. This document is a draft awaiting the owner's review.

This page is part of the Terms of Service. It says what VACUUM is for, what will get you removed, and how removal actually works.

It is short on purpose. A rule nobody reads protects nobody.

1. What VACUUM is for

Moments from your real life, shared with people who already know you.

You get connected by handing someone an invite code — in person, in a message, however you like. There is no search, no discovery, no suggestions, no public profile, and no feed a stranger can reach. Your audience is exactly the people you handed a code to.

Everything expires in 30 days. There is no archive and no library.

That shape is the reason this page can be short: there is no public surface to police. Nothing you post is visible to anyone you did not deliberately connect to, so the "community standards" a public platform needs do not apply here. What we need instead is a small list of things that are never acceptable, no matter how private the audience.

2. Never, under any circumstances

These are absolute. There is no context that makes them acceptable and no private audience small enough to permit them.

Child sexual abuse material

Zero tolerance. Any sexual or sexualised content involving a minor, in any form — photographic, recorded, drawn, generated, or edited — is absolutely prohibited.

This is the one thing VACUUM checks for mechanically. Every upload must pass a match against lists of known child sexual abuse material and known harmful abusive material before it can publish, through the Arachnid Shield service, operated by the Canadian Centre for Child Protection. We are completing our registration with that provider; until it is active, nothing publishes at all — the pipeline fails closed. A match blocks the moment from being published. If the matching service cannot be reached, we do not publish — we retry. There is no override and no way to turn it off.

Accounts responsible for this material are terminated permanently.

We will comply with our legal obligations regarding this material, including any duty to preserve it and to report it to the competent authorities.

Draft note — review before publication

I did not write "reported to NCMEC", and you should know why before you add it.

Your brief said matches are reported to NCMEC as legally required. Nothing in the repo supports that yet. NCMEC ESP registration is still an open V1-14 item — we are not a registered ESP today, so we have no channel to report through. D-2026-08-03-22 says jurisdiction "is not established anywhere in the verified docs" and that this "must be settled before the moderation and privacy sections can be called complete"; D-2026-08-04-11 §2 answers the jurisdiction fact (Brazilian entity) but explicitly routes the §2258A interplay to counsel as unresolved. And V1-07.82 flags the opposite risk: our current default of deleting matched material immediately "may destroy material a provider is required to preserve."

Naming a specific authority we do not report to would be a false statement in a published policy about child protection, which is close to the worst possible place to have one. So I wrote the general commitment, which is true and which we can keep.

After the counsel session, replace that sentence with the specific one. "We report this material to [authority]" is a strong, trust-building sentence and it is worth earning. It is also, per D-2026-08-03-20 §10 and D-2026-08-03-19 §A.7, exactly what a Paddle or App Review reviewer is looking for.

Anyone who cannot consent

Sexual content involving anyone who cannot consent, or who did not consent, is prohibited. That includes intimate images shared without the consent of the person in them — so-called revenge porn — and images obtained by deception, coercion, or surveillance.

If someone shared an image of you without your consent, email abuse@vacuum.social. You do not need a VACUUM account to contact us about that.

Anything illegal

Content that is illegal where you are or where we are, and content that promotes, arranges or facilitates serious crime.

Harming the people you are connected to

You are connected to a handful of people who know you. Do not use that to threaten, harass, stalk, or terrorise them. The fact that an audience is small does not make abuse private.

If someone you are connected to is doing this to you, you can block them yourself, immediately, from the People list — it severs the connection, deletes everything shared between you in both directions, and stops any future invite code from ever reconnecting you. They are not told. You can also report them.

3. Not what this is for

These are not crimes. They are just not what VACUUM is, and they will get your account closed.

No business use

VACUUM has no business accounts, no brand accounts, no creator accounts, and no advertising. There is no surface for them and none is coming — they are excluded by design, not discouraged by policy.

Do not use VACUUM to advertise, promote, sell, recruit, solicit, or distribute marketing of any kind, including to your own connections.

No selling content, and nothing here is for sale

The subscription buys access to the product, not access to content. Nobody sells anything on VACUUM, nobody buys anything from another member, and there is no mechanism that would allow it — no payments between members, no tipping, no paid subscriptions to a person, no marketplace.

Do not use VACUUM to distribute content you sell somewhere else, or to advertise a paid channel elsewhere.

No sexually explicit content

VACUUM is not a place for pornography or sexually explicit material, including between consenting adults.

We are not making a moral argument. We have no adult-content controls to offer you: no age verification, no content warnings, no blurred-by-default filter, and — deliberately, and permanently — no automated classifier that could sort explicit content from anything else. A service that cannot build those controls should not host the content that needs them.

Draft note — review before publication

This is the biggest product judgment in these four documents, and it is not ruled anywhere. It needs your decision and probably a decision record.

Nothing in the spec or any decision record prohibits consensual adult content. I drafted a prohibition anyway, because it is the only posture consistent with what we actually ship:

Play requires a two-action-default filter if adult sexual content is permitted (D-2026-08-03-19 §B.3 item 4). We have no filter and cannot build one — spec §11 bars NSFW classifiers "ever". So permitting it means either failing the Play requirement or breaking a permanent spec rule.
Paddle prohibits adult content and reserves judgment (D-2026-08-03-20 §10). Risk 3 calls approval "a live approval risk with a real probability of a manual review", and names this page as the mitigation. A private ephemeral photo-sharing app that permits explicit content is, from a reviewer's chair, the thing Paddle says it will not process payments for.
Apple's Guideline 1.2 posture is the same shape.

The cost is real and you should weigh it. "Private, invite-only, gone in 30 days" is a description of exactly what a couple in a long-distance relationship wants, and this rule tells them no. It is also close to unenforceable — nothing scans for it, and we only ever find out if the recipient reports it, which almost never happens between two people who chose each other. So in practice this is a rule that positions the product for reviewers and gives us grounds to act if something is reported, rather than one that changes what people do.

That is defensible, but it is a rule we cannot enforce, which is exactly the kind of thing the brand normally refuses to publish. Three options: (a) publish it as drafted and accept the honest gap; (b) narrow it to "explicit content may not be sent to anyone who did not ask for it" — enforceable, consent-shaped, and much more in keeping with the product, but weaker for Paddle; (c) rule it out of scope and accept the store risk. My recommendation is (a) for launch and revisit after Paddle approval, but it is your call and it should land as a dated decision record either way, because it is product behaviour, not copy.

No impersonation

Do not pretend to be someone else. Your connections recognise you by your name and avatar; do not use someone else's.

No attacking the service

No scraping, no reverse engineering to circumvent limits, no automated posting, no attempts to break rate limits or authentication, and no using another person's account.

4. How enforcement actually works

We are describing a small service run by one person. Here is the real process, not a generic one.

Reports come only from recipients. There is no public content, so there is nobody else to report anything. If nobody you shared with reports a moment, nobody outside your connections will ever see it — including us.

How to report. Long-press any photo or video in a moment, or use the report control inside a reply thread for something written to you. Pick one reason from a short list. It is one screen; it does not ask you to explain yourself.

What reporting sends us. The reported moment — the item you selected plus the others in the same moment for context — is re-uploaded from your device, along with who posted it, who reported it, and when. Nothing else: none of their other moments, no account data, no history. You are told this plainly before you submit.

What you get back. Confirmation that the report was received and will be reviewed. We do not send outcome notifications and we do not maintain a status page for reports. We would rather tell you that up front than leave you refreshing something.

The reporter is never revealed to the person reported. Ever.

A human reviews it. One person — the operator. Target: within 24 hours on weekdays, 48 hours at worst. Access to the review queue is restricted and audited, and it shows only the reported moment and the identifiers above.

If you can also just leave. Blocking or disconnecting is immediate, needs no permission from us, and deletes everything already shared between you in both directions. For most problems between two people who know each other, that is the faster and better answer, and it is always available.

5. What happens if you break these rules

We remove the account. That is the sanction: the account is disabled, any subscription is cancelled with a prorated refund (see the Refund Policy), and any outstanding invite codes stop working.

It is permanent, and there is no appeal. We do not have the capacity to run an appeals process honestly, and we would rather say so than operate one that is a form to nowhere.

Nobody is told. To anyone connected to a removed account, removal is deliberately indistinguishable from that person having blocked or disconnected from them. That is a safety property: if a ban looked different from a block, a blocker could be identified.

Content that fails the upload check never publishes at all. It is not delivered to anyone and no one is notified. The person who uploaded it sees the same neutral message they would see for a corrupt file — we do not tell them which check failed, because that would turn our upload endpoint into a tool for probing the abuse-material lists.

Draft note — review before publication

Two enforcement gaps worth your attention, both flagged in the terms as well:

A permanent, unappealable ban is the only sanction that exists. There is no warning, no strike, no suspension, no content removal as a sanction — I searched every decision record, the spec, the user stories and the backlog. So the ladder is: nothing, or gone forever. That is right for CSAM. It is disproportionate for a harassment report between two people who know each other, where the proportionate answer is "remove the moment, warn them" and we cannot give it. Worth ruling before launch, because the first time you need the middle rung you will not have it.
A hash match at upload does not currently ban anyone. V1-07.81 is explicit: "V1-07 makes no retention decision and no reporting decision. V1-11 owns both." So today a match blocks the moment and writes a match record, and nothing else happens to the account. I have written §2 as "accounts responsible for this material are terminated permanently", which is the ruled policy — but the automatic link from match to ban is not built, and V1-11 does not exist yet. Before publication, either V1-11 rules it or you accept that this is an operator-executed step off the match record.

6. Reporting something to us directly

abuse@vacuum.social — for content, conduct, non-consensual imagery, legal notices, and anything urgent. You do not need a VACUUM account to write to us.

support@vacuum.social — for everything else.

If you believe someone is in immediate danger, contact your local emergency services first. We are one person with a review queue; they are not.

The short version

Private moments, real people, 30 days.
Nothing sexual involving minors, ever. Checked at upload, and it ends the account.
Nothing illegal, nothing non-consensual, no harassing the people you are connected to.
No business use, no selling, no sexually explicit content.
Reports come from the people you shared with, a human reads them, and removal is permanent.
You can block or disconnect from anyone yourself, at any time, and everything between you is deleted both ways.

The other policies: Terms and Conditions, Privacy Policy, Refund Policy, Acceptable Use Policy.