Acceptable use and abuse reports

What Tombstone is for

Tombstone is for looking at your own mailbox and cleaning up your own accounts. Connect an inbox you control, see which companies have been emailing you, and use the drafts to ask them to delete your data. That is the whole intended use.

What you may not do

• Do not connect a mailbox you do not own. Not a partner's, not an ex's, not a colleague's, not one you happen to have the password for. This is the rule we care about most.
• Do not submit someone else's email address to the public breach checker. Check your own.
• Do not send a deletion request on another person's behalf without their clear, documented authorization. These letters assert legal rights that belong to the person whose data it is.
• Do not present a draft as legal advice, and do not edit one to imply it comes from a lawyer or a law firm. Every letter is a user-directed request, not an attorney communication, and it says so.
• Do not use Tombstone to harass a company or a person, including by generating requests in volume to bury a recipient.
• Do not attack or overload the service: no scraping, no automated clients, no attempts to bypass the rate limits on the public breach checker, no probing for vulnerabilities without contacting us first, no reverse-engineering, and no reselling access.
• Do not use Tombstone commercially during the private beta. It is offered for personal, non-commercial use.
• Do not upload or transmit unlawful content through any field in the app.

Reporting abuse

If you believe someone is using Tombstone against you, or you have received something generated by it that you think is abusive, email abuse@tombstonepro.com.

Please include, where you can: what happened, when, any email or message you received (full headers help a lot), and how we can reach you. You do not need a Tombstone account to file a report.

We acknowledge reports within five working days. Where a report is substantiated we may warn the account, suspend it, or delete it, and we will tell you the outcome. We do not share your identity with the person you reported unless the law requires it.

Security vulnerabilities

Security issues go to security@tombstonepro.com, not to the abuse address. Please give us a reasonable window to fix an issue before disclosing it publicly. We will not pursue action against good-faith research that stays within these rules: no accessing other people's data, no degrading the service, and no social engineering. There is no bug bounty, this is a student project, but we will credit you if you would like that.

Copyright and trademark

Tombstone hosts no user-published content, so there is little here to infringe, but if you believe material on this site infringes your copyright or misuses your trademark, write to abuse@tombstonepro.com with the work in question, the URL where it appears, your contact details, and a statement that you hold the rights or act for the rights holder. We will review and remove infringing material promptly.

Company names, logos, and domains shown in your account list belong to those companies. They appear only to identify a service you have an account with.

Enforcement

We may suspend or delete an account that breaches this policy, with notice where it is reasonable to give it and without notice where the breach is serious or ongoing. Deleting your account removes your data from our database; see data deletion.