Acceptable Use Policy

1. Who does this policy apply to?

This policy applies to everyone who uses a Nameless Proxy account: the account holder, every sub-user, every API key, and anyone who uses your proxy credentials or your IP whitelist. You are responsible for all traffic sent with your credentials, including traffic from people you share them with.

This policy forms part of our Terms of Service. If the two documents differ on a point, the stricter rule applies. "We" and "us" mean Nameless Proxy and ProxyGoat LLC, the company that runs it.

2. Why does a no-KYC service have strict rules?

Because we do not check identity, we check behaviour. We never ask for ID, a selfie or documents, at any spend level. In exchange, every account accepts clear limits, and the gateway enforces the most important ones technically.

The rules also protect you. Residential and mobile IPs belong to real households and carrier subscribers. Abuse by one customer can get an address blocked for everyone who shares it, including you.

3. What can I use Nameless Proxy for?

You may use Nameless Proxy for lawful purposes, including:

• Web scraping of public data, within the rules in section 5 (web scraping).
• SEO and SERP tracking by country and city (SEO and SERP tracking).
• Price monitoring of public product, travel and marketplace pages (price monitoring).
• Ad verification and brand protection: checking how ads, creatives and landing pages appear in each location (ad verification).
• Social media management of accounts you own, or manage with the owner's permission (social media management).
• Market and academic research based on publicly available information.
• Geo-testing of your own apps, websites, content and content delivery.
• Personal privacy: keeping your home IP address away from the sites you visit (personal privacy).

A use that is not listed is allowed only if it is lawful and does not fall under section 4.

4. What is prohibited?

You must not use Nameless Proxy, directly or through your own customers, for any of the following:

• Fraud of any kind, including phishing, payment fraud, refund fraud and impersonation of people or companies.
• Carding: testing, buying, selling or using stolen payment card data.
• Account takeover: accessing accounts that are not yours, or that you are not authorised to manage.
• Credential stuffing and brute force: trying stolen or guessed logins against any service.
• Spam: unsolicited bulk email, SMS, direct messages, comments or forum posts.
• Sending email through our proxies (SMTP), even legitimate mail.
• DDoS, flooding and stress testing of any system through our network, including your own.
• Scanning: port scans, vulnerability scans or exploit attempts against systems you do not own or have no written permission to test.
• Malware: distributing it, or running command-and-control (C2) servers, botnets or phishing kits.
• Child sexual abuse material (CSAM): any access, upload or distribution. We report it to the competent authorities.
• Harassment: threats, stalking, doxxing or intimidation of any person.
• Ticket scalping and purchase bots: automated buying of event tickets, limited sneakers or other limited stock.
• Bonus abuse: multiple accounts to claim sign-up bonuses, promotions, free trials or betting offers more than once.
• Fake accounts and ban evasion: creating accounts in bulk, or returning to a platform after a ban or suspension.
• KYC and verification bypass: defeating identity, age or location checks at banks, exchanges, payment apps, gambling sites or any other service.
• SMS verification abuse: receiving or relaying one-time codes for accounts that are not yours, or running phone-number verification services.
• Click and ad fraud: faking impressions, clicks, installs or traffic.
• Illegal content: accessing, storing or distributing content that is illegal where you are or where the target is.
• Sanctions evasion: serving sanctioned persons or territories, or hiding your location to get around sanctions or export controls.
• Evading law enforcement: using the service to hide a crime, obstruct an investigation, or contact victims or witnesses.
• Reselling for banned uses: giving or selling access to anyone who uses it for any item above.

5. What are the rules for scraping and automation?

Scraping and automation are allowed when they stay within these limits:

• Public data only. Do not log in to accounts you do not own, and do not bypass paywalls or access controls.
• Respect the site. Follow robots.txt and site terms where they apply to you, and keep request rates low enough not to degrade the target.
• Personal data needs a lawful basis. Under the GDPR, personal data includes names, location data and online identifiers, even on public pages (Art. 4). Collect only what your purpose needs (data minimisation, Art. 5).
• Check the law for your project. US courts have reached different results depending on the claim: contract, CFAA, copyright or DMCA. This policy is not legal advice.

Code and setup help is in the Python proxy guide and the browser automation guide.

6. Which targets are blocked at the gateway?

Some categories are blocked for every customer, on residential and mobile proxies alike, whatever the reason for the request:

• Banking and payment portals: online banking, card processors, payment gateways and money-transfer services.
• Government portals: tax, benefits, immigration, identity and other e-government services.
• Crypto-exchange account pages: sign-up, login, verification and withdrawal pages of exchanges.
• Outbound mail: SMTP ports 25, 465 and 587.

For HTTPS traffic, the gateway sees the destination hostname and port, but not the encrypted content (RFC 9110, CONNECT method). A request to a blocked target fails with an error. If you think a hostname is blocked by mistake, write to support with that hostname. We check it, but we do not unblock the categories above. We may add targets that attract abuse at any time.

7. What are my responsibilities?

As an account holder, you must:

• Keep your account number, password, API keys and proxy credentials private. Anyone who holds them can use your balance.
• Set a password and two-factor authentication (TOTP) if more than one person can reach your dashboard.
• Give each team member or client a separate sub-user, so that one person's misuse can be stopped without stopping everyone.
• Comply with the law where you are and where your target is, and with the target's terms where they bind you.
• Tell us at [email protected] as soon as you learn that your credentials were misused.

8. How do we enforce this policy?

We act on abuse reports, on reports from partner networks and on requests the gateway blocks. Depending on the case, we may:

1. Block a target or a request pattern for all customers.
2. Suspend a sub-user, a port or the whole account while we check. A suspended account receives the error account_suspended at login.
3. Terminate the account. Termination for abuse is final, and the balance and unused traffic are not refunded.
4. Answer valid legal requests as set out in our Terms of Service. We can only hand over what we hold, and our privacy policy lists it item by item.

We may act without prior notice when the abuse is serious or still going on.

9. How do I report abuse?

Email [email protected] with the IP address, the time with timezone, the target and any log lines. We reply as a priority. The abuse page explains what to include and what happens next.

10. Can this policy change?

Yes. We may update it, for example to add blocked targets or new types of abuse. The date at the top of this page shows the current version, and material changes are listed in our changelog. If you keep using the service after a change, the new version applies to you.