Skip to content

Acceptable use policy

Last updated: 2026-10-01.

colding sends email through mailboxes you own and warms them up by exchanging mail with other customers' mailboxes. Both only work while every customer sends mail people have a reason to receive. This policy says what that allows and what it does not. It is part of the Terms of service, and using the service means you agree to it.

A workspace's owner also accepts this policy in the console, for everyone in the workspace. Until they do, the workspace can't connect mailboxes, send email, check addresses, create API keys or invite people. When we change the policy, the owner accepts the new version before the workspace starts anything new. Campaigns and warmup that already run keep going meanwhile.

What you may do

  • Send outreach to people at companies who have a business reason to hear from you: a role your product or service is for, a company you can name a reason for writing to, a contact you met or were referred to.
  • Send to lists you built or obtained lawfully and can account for: where each contact came from and on what basis you write to them. Under the GDPR that basis is usually legitimate interest for a business address; under the LGPD it is the same idea (art. 7, IX).
  • Send follow-ups in a sequence, as long as every message carries a way to opt out and the sequence stops the moment someone replies, bounces or opts out.
  • Connect mailboxes you own or administer, or that a client has authorised you in writing to operate for them.
  • Warm up any mailbox you connect, by letting it take part in the pool.
  • Send your app's own email from a mailbox you keep for transactional email: mail a person needs about something they did or asked for, such as a receipt, a password reset, a sign-in link or a notice about their account.

What you may not do

  • Mail people who said no. An unsubscribe, a "remove me" reply or a suppression stands for that address in your workspace until that person asks to hear from you again. Routing around it, in colding or elsewhere, is a breach.
  • Use lists you did not obtain lawfully: purchased lists, scraped consumer addresses, addresses harvested from websites without a business relationship, or lists a former employer or client owns.
  • Mail consumers without consent where the law requires it (the EU and UK for private addresses, Canada under CASL, Australia under the Spam Act). B2B outreach to a personal Gmail or Outlook address counts as consumer mail.
  • Send campaign mail without a way to opt out. Every campaign email must tell its recipient how to stop hearing from you: our opt-out line, or your own words in the message. The opt-out line is on by default, and the launch check warns you when it is off.
  • Lie in the message: a From name or domain that is not yours, a misleading subject, a reply-to that goes nowhere, a fake "Re:" or "Fwd:" on a first message, a company you do not represent.
  • Send the categories that get every neighbour's mail blocked: phishing, malware, credential harvesting, anything illegal where you or the recipient are, adult content, gambling, get-rich schemes, unregistered securities and token sales, multi-level marketing, loans or debt services marketed cold, counterfeit goods, or work for a client who does any of these.
  • Harass: writing to a person who told you to stop, mailing one person from several mailboxes to dodge their filters, threatening or demeaning content.
  • Connect a mailbox that is not yours to operate: a compromised account, an account whose provider terms forbid automated sending, or a client's mailbox without their written authorisation.
  • Abuse the warmup pool: marking warmup mail you received as spam, deleting it in bulk, forwarding warmup tokens, connecting throwaway mailboxes to inflate the pool, or warming a mailbox you intend to burn.
  • Send outreach as transactional email. Transactional email carries no opt-out line and isn't held to campaign limits, because it is mail a person asked for. Marketing, newsletters or cold outreach sent that way is a breach.
  • Circumvent the engine: daily caps, ramps, minimum gaps, the automatic pause on bounces and spam reports, plan limits, or a suspension.
  • Resell the service as your own sending platform without an agreement with us.

What we do on our side

  • Campaign messages carry an opt-out line by default (asking the reader to reply, or an unsubscribe link), and every campaign message carries a List-Unsubscribe header, which mail apps show as their own unsubscribe button. An opt-out is honoured at once, for every campaign in the workspace, not within the ten business days CAN-SPAM allows.
  • A bounce that says the address does not exist, a spam complaint we can see, or a "remove me" reply in English, Portuguese or Spanish suppresses the address in your workspace before the next send. A reply in another language is yours to act on.
  • The engine enforces a daily cap per mailbox, a ramp for new mailboxes and a minimum gap between sends. It pauses a running campaign when 5% or more of its emails bounce, or 0.1% or more are marked as spam, counted over the last 7 days once at least 50 have gone out, and tells you why.
  • A mailbox whose warmup mail keeps landing in spam is slowed down first. If it gets worse, or if its own mail keeps bouncing, it leaves the pool for a fixed period, so one mailbox cannot pull the pool down.
  • Each mailbox shows its warmup health in the console, with the reading that set it. When something is wrong it reads watch, slowed down, quarantined or blocked: a slowed-down mailbox sends no campaign mail for now, and a quarantined or blocked one leaves the warmup pool until a set date.
  • We may suspend an account or a workspace that breaches this policy, at once and without refund where the breach is deliberate, and we cooperate with lawful requests from authorities and from the people affected. To appeal, write to [email protected].

Reporting

Received mail you did not want from a colding customer, or misuse of the service: [email protected], or the unsubscribe link in the message itself, which needs no account. We answer every report, and act on abuse as soon as we confirm it.