Acceptable Use Policy

This policy is part of the Terms of Service of letr.dev, operated by Viascom GmbH.

1. Why this policy exists

letr.dev sends from IP addresses that all customers share. One customer's spam, phishing or bad list lands every other customer in the spam folder. This policy says what you may send through letr.dev, what you may not, and what happens when something goes wrong. We apply it when your account goes live, while you send and when we receive a report.

2. Permitted use: transactional email

2.1 letr.dev is for transactional email: messages that a recipient's own action or an existing relationship triggers, sent one at a time or in small batches to people who expect them. Examples:

sign-in links, one-time codes and password resets;
order, booking and payment confirmations, receipts and invoices;
shipping and delivery notices;
account notices: changes to settings, security alerts, expiry warnings;
notifications from an application the recipient uses: comments, mentions, assignments, reports they subscribed to;
replies and messages between users of your service, where the recipient has agreed to receive them;
notices you are required by law or contract to send.

2.2 A message may carry a short reference to your other products or a footer, but its purpose must be the transaction. If a message would still be sent without the recipient's action or relationship, it is marketing, and letr.dev is not for it.

3. Prohibited use

3.1 Marketing and bulk mail: newsletters, campaigns, promotions, announcements, cold outreach, invitations and re-engagement mail, even if the recipient agreed to them. Use a marketing tool for those.

3.2 Lists you did not build yourself: purchased, rented, traded, scraped or harvested addresses, addresses from a data breach, and addresses you cannot show a relationship with.

3.3 Deceptive mail: phishing, pretending to be someone else, forged or misleading headers, sender names or subjects, hidden or misleading links, and anything that imitates a bank, an authority, a brand or letr.dev itself.

3.4 Harmful content: malware, exploit code, links to either, and content that facilitates fraud.

3.5 Illegal content and content that is illegal to send to the recipient: among others threats, harassment, incitement to violence, child sexual abuse material, infringement of copyright or trademarks, and breaches of sanctions law.

3.6 Content and businesses we do not serve, because recipient mail providers and blocklist operators treat them as high-risk and the shared reputation cannot carry them: adult content and escort services; gambling and betting; payday loans and other high-cost short-term credit; debt collection; list brokers, lead generation and affiliate marketing; multi-level marketing; cryptocurrency and investment offers to the public; pharmaceuticals, nutritional supplements and medical treatments sold without the required authorisation; weapons; counterfeit goods.

3.7 Mail to addresses that bounced or complained before: you must stop sending to an address after a hard bounce or a complaint. letr.dev keeps a suppression list per account for this and will not send to a suppressed address; do not work around it with new addresses or accounts.

3.8 Technical misuse: sending from a domain you do not control; sharing one account between unrelated businesses or reselling letr.dev without our written consent; using several accounts to get around limits, pauses or a decline; probing, scanning or load-testing our systems beyond your own normal use; using the test recipients for anything but tests.

4.1 You send only to recipients who expect the message because of their action or relationship with you. Where the law of the recipient's country requires consent, for example for any advertising element under Art. 3 para. 1 lit. o of the Swiss Unfair Competition Act or Art. 13 of the EU ePrivacy Directive, you obtain it before sending.

4.2 You keep a record of how and when each address was obtained (the action, the form, the date, the IP address or an equivalent) for as long as you send to it, and you provide it to us within 2 business days when we ask because of a report.

4.3 Where the law requires an opt-out or where recipients may reasonably want one (for example notifications they can switch off), every such message includes a working way to stop them, and you honour it within 10 days. Transactional messages that the recipient needs, such as receipts and security notices, need no opt-out.

4.4 You answer recipients' requests under data protection law yourself. letr.dev forwards to you any request about your mail that reaches us. The API offers DELETE /v1/recipients/{email} to erase an address from what letr.dev holds for your account.

4.5 You send from your own verified domain with a working reply address or a monitored mailbox named in the message. Mail from addresses that reject replies (noreply) is allowed where the message tells the recipient how to reach you.

5. Thresholds we enforce automatically

5.1 Bounces: an account pauses at a bounce rate of 5 % over the last 7 days.

5.2 Complaints: an account pauses at a complaint rate of 0.3 % with at least 2 complaints over the last 7 days.

5.3 Both rates count once the account has sent to 50 recipients in the window. GET /v1/metrics shows the rates letr.dev evaluates and how far the account is from a pause. We warn the account owner by email when the account is 80 % of the way to a threshold, or at a complaint rate of 0.1 % with at least one complaint, at most once a week per kind.

5.4 Limits: 50 recipients per email, 15 MB per email as sent, the daily limit of the account's step (50, 500, 2'000 or none), the monthly ceiling you chose, and 600 API requests a minute per account (requests without a valid key count per IP address, per /64 for IPv6). A request that reaches a limit is refused with the status and code the documentation names; it is not a breach of this policy.

6. How we check and enforce

6.1 After an account is live, a person at letr.dev checks the company register or, for a private person, the website or repository, the domain's age and registrant, whether the website matches the signup and has a privacy policy, the use case and how recipients opt in, the previous provider and the domain's blocklist history. An account that fails a check is declined with the reason and a full refund while its first renewal is not paid, otherwise paused.

6.2 While you send, we watch bounce and complaint rates, feedback loops from mail providers, blocklist listings of our IP addresses and reports to [email protected] and [email protected]. We do not read your email content to do this; we look at delivery events, headers in reports and the metadata we keep for 30 days. On suspicion of a breach of this policy an operator may open the content of individual emails; each access needs a written reason and is recorded in your account history, and you see its time on the email.

6.3 Steps, in order, for a suspected breach:

Warning. We email the account owner what we saw and what to change, with a deadline where one makes sense.
Pause with a stated reason. We pause the account and, where email is still queued, cancel it. The pause email names the reason. For phishing, malware, a sanctions match, a suspected account takeover or a provider or authority requiring it, we pause first and skip the warning.
Your answer. Write to us through Support in the dashboard or to [email protected] with what caused it and what you changed. We answer within 1 Swiss business day, and within 4 business hours when the account is paused. A person at letr.dev resumes the account once the cause is named and fixed. From the resume on, only emails sent since then count toward the rates until 7 days have passed.
Decline or termination. An account that fails the review is declined. A repeated breach, a serious one, or a cause you do not fix ends the contract without notice under the Terms of Service.

6.4 Suspected account takeover: we pause the account, revoke every API key and SMTP credential, cancel the scheduled email the keys created and email you what was sent and when. You create new keys; we resume once you confirm the account is yours again.

6.5 Records: pauses, resumes, declines, revoked keys, cancelled queues and content views are recorded in the account history letr.dev keeps. The time of each content view is shown to you on the email. Notes about abuse reports record the date, the reporting desk, the message ID and the action, never the reporter's address or the message content. For an abuse or takeover case we may export the metadata of your email of its message history, 30 days or 365 with the message history add-on (sender, recipients, subjects, tags, events, no content) and keep that file until the case is closed. The history is deleted 30 days after the account ends.

6.6 Reports and authorities: we answer blocklist operators and complaint desks within 1 business day. We hand data to an authority only on a request we have verified, within what the law that applies to the contracting company requires, and we log every request. We inform you of a request about your account unless the law forbids it.

7. Reporting abuse

Report spam, phishing or other abuse sent through letr.dev to [email protected], with the full headers of the message. Mail operators reach us at [email protected]. We acknowledge within 1 business day.

8. Changes

We change this policy as mail providers' requirements and the law change. A change that restricts what you may send is announced 30 days in advance by email to the account owner; a change that only clarifies or relaxes may take effect at once. The current version is at letr.dev.

Viascom GmbH, Appenzell, 02.11.2026