Acceptable Use Policy

1. What This Policy Is

This Acceptable Use Policy sets the rules of conduct for everyone who uses ToolPool.Garden, operated by IllumAlign LLC: account holders, pool admins, tool owners, and borrowers. It supplements the Terms of Service and the Liability Waiver; if this policy and the Terms conflict, the Terms control.

It covers both the content you submit (tool and skill listings, photos, chat messages, reviews, pool names and descriptions, profile text and images) and how you behave toward other users. In this policy, "content" means all of it.

The Prohibited Items list is part of this policy.

This policy governs the platform. The community spaces we run outside it, such as our Discord server, are governed by the Community Code of Conduct instead, and conduct in either place can carry consequences in the other.

Breaking these rules can lead to content removal, warnings, removal from a pool, account disabling, account deletion, and, where the conduct is unlawful, referral to law enforcement.

2. Eligibility and Accounts

• You must be 18 or older to hold an account. Providing a false birth date to pass the age check is a violation.
• Register with accurate information and keep it current. Do not impersonate another person or claim an affiliation you do not have, and do not register an account for another person to use as themselves. A group may hold an account of its own, which is how it lists the equipment it owns collectively.
• You may hold more than one account. You may not use one to get around an enforcement action: if we disable an account of yours, or a pool admin removes you from a pool, do not come back with another account, with someone else's, or with a fresh invite.
• You are responsible for activity under your account. Keep your password private, except that a group account's password may go to the people the group authorizes to use it. Enabling two-factor authentication adds extra protection.
• Do not claim an email invite that was addressed to someone else, and do not use a join code to enter a pool you know it was not intended to admit you to.

3. Respect the Anonymity System

A tool owner's identity is hidden from other users until the owner chooses to reveal it. You must not undermine that choice:

• Do not attempt to identify, "out", or publicly speculate about the identity of an anonymous tool owner or an anonymous reviewer, in chat, in reviews, in pool descriptions, or anywhere else on the platform.
• Do not pressure, threaten, or bribe an owner to reveal themselves. Reveal is always the owner's decision.
• Do not put another person's identifying information (name, address, phone number, employer, and the like) into a review body, a chat message, a tool description, or any other content without their consent. The review form warns you about this: attribution can be hidden later, but text cannot be scrubbed.
• Anonymity is a user-to-user feature only. The platform always knows which account is behind an anonymous listing or review, and identity can be disclosed in response to valid legal process, as described in our Privacy Policy.

4. Lending Rules

• Lending on ToolPool.Garden is free, person-to-person, non-commercial sharing. Do not charge, request, or accept payment, deposits, or fees of any kind from another user for the use of a tool, whether through the platform or around it. The pool's monthly subscription keeps the pool running; it is not a payment for tool use.
• Do not use the platform to run a rental business, advertise a commercial service, or solicit customers.
• Only list items you own or are expressly authorized by the owner to lend. Listing property you do not have the right to lend, including stolen or misappropriated property, is prohibited.
• Describe tools honestly, including their condition and any defects relevant to safe use. Set the tool's protectiveness rating in good faith so requesters know how much oversight you expect before lending it; the rating reflects how protective you feel about the tool, not how dangerous it is.
• Do not list anything on the Prohibited Items list.
• Borrowers: do not lend a borrowed tool onward to anyone else, and return tools as agreed in the chat. The discussion checklist exists to surface expectations before anyone commits; use it honestly.
• The platform does not witness, enforce, or adjudicate the terms two users agree between themselves, and it does not resolve disputes about borrows. See the Liability Waiver.

5. Content You Must Not Post or Share

You must not create, upload, transmit, link to, or facilitate any content that, in our reasonable opinion:

• Constitutes, promotes, facilitates, organizes, or admits to an illegal act of any kind;
• Sexually exploits or endangers minors in any way, including child sexual abuse material, grooming, or sexualized depictions of minors, whether real, drawn, or AI-generated. Such content is removed, preserved as the law requires, and reported to the authorities;
• Depicts an identifiable person intimately without their consent, including AI-generated or altered "deepfake" depictions. The Terms of Service describe our dedicated removal process: report the material to [email protected] and we will remove it within 48 hours of a valid request;
• Encourages, depicts, or threatens sexual violence, sexual assault, or any other form of sexual exploitation;
• Is pornographic or sexually explicit, or contains gratuitous or serious depictions of violence;
• Encourages, glorifies, or provides instructions for self-harm, suicide, eating disorders, or the harmful use of any substance;
• Promotes, supports, or threatens terrorism, violent extremism, hate organizations, or mass violence, or incites hatred or violence against any person or group;
• Makes a credible threat to the safety of any person or animal;
• Is fraudulent or deceptive, including scams, phishing, fake listings, fake giveaways, or impersonation intended to deceive;
• Contains or links to malware, exploit code, or other malicious code or instructions;
• Offers, promotes, or facilitates illegal, unsafe, counterfeit, or stolen goods or services. For physical items, the Prohibited Items list controls what may not be listed or lent;
• Discloses another person's private or identifying information without their consent (see the anonymity rules above); or
• Infringes someone else's copyright, trademark, or other rights. The Terms of Service describe how to file an infringement complaint and how we handle them.

6. Conduct That Is Not Allowed

Do not use the platform to:

• Harass, threaten, stalk, or intimidate anyone, or encourage others to do so.
• Post content that is hateful, discriminatory, or demeaning toward a person or group on the basis of race, ethnicity, national origin, religion, sex, gender identity, sexual orientation, disability, or age.
• Defraud or deceive other users, including fake listings, fake reviews, review manipulation (trading, extorting, or retaliating with reviews), or misrepresenting who you are.
• Build a relationship of trust or dependency with another user to exploit, manipulate, or abuse them, including systematically targeting people who are vulnerable.
• Run a pool as a front for anything other than tool sharing among people who trust each other: no hate groups, no scams, no illegal marketplaces.
• Spam other users, in chat or through pool invites.

7. Platform Integrity

• Do not probe, scan, or test the security of the platform without our prior written permission, and do not attempt to bypass authentication or authorization (including pool membership checks or invite-only access) or access another user's account or data. Security testing is covered by the next section.
• Do not scrape, harvest, or bulk-collect user data, listings, or map data, and do not access the service with automated tools except as the platform explicitly allows.
• Connecting an AI assistant or a script of your own is one of the things the platform explicitly allows, whether you do it with an API token from your account settings or by allowing the app when it sends you to our connection page. Keep a token to yourself: it acts as your account, so giving it to another person is account sharing, and everything done that way is treated as done by you. The same goes for an app you allow, so allow one only if you trust whoever runs it. End the access in your settings if you stop using it or think someone else has it: revoke the token, or disconnect the app. The rest of this policy applies to what a program does exactly as it applies to what you do by hand, and using one to bulk-collect other people's listings is still bulk collection.
• Do not upload malware. On toolpool.garden, do not interfere with the operation of the service or place unreasonable load on it. Tests that affect the stability of test.toolpool.garden are covered by the next section.
• Do not circumvent an enforcement action (for example, by returning to a pool you were banned from through a new account).

8. Security Testing and Vulnerability Reports

You are welcome to look for security problems in ToolPool.Garden, but ask us first. Email [email protected], or message us on a messaging platform where we have an account, such as our Discord server at https://discord.gg/DfgGwQ3NyY. Say what you want to test and how you plan to test it, and wait for our written permission before you start. A reply by email or on that platform is written permission. Testing without that permission violates this policy, and depending on what you do it may also be unlawful.

Permission is specific. It covers the scope, the accounts, and the time window we agree on in writing, and nothing outside that. If you want to widen the scope, ask again.

While you are testing, and whether or not we granted permission:

• Test only against accounts and pools you own or that we set up for you. Do not read, copy, or modify another user's account, data, chats, or pools, and stop as soon as you have enough to show the problem exists.
• On toolpool.garden, do not run denial-of-service or load tests, mass-register accounts, send bulk email, or do anything else that degrades the service for other people. That limit holds even after we give you permission to test.
• Do not use one finding as a foothold to go looking for others outside the agreed scope, and do not install backdoors, add persistence, or leave anything behind when you are done.
• Report what you find to [email protected] with enough detail for us to reproduce it, and give us a reasonable chance to fix it before you tell anyone else. Do not publish user data you came across, in a write-up or anywhere else.

On test.toolpool.garden you may run denial-of-service or load tests, mass-register accounts, send bulk email, or do anything else that degrades that site or affects its stability. We want people to do that. The other rules in this section still apply there.

Do not come to us expecting to be paid. We do not run a bug bounty program, and nothing in this policy entitles you to a reward, fee, or other compensation for finding, testing for, or reporting a vulnerability. Permission to test is not an offer to buy the results.

If you find something real and you ask us about payment, we may decide to pay you something. That decision is ours alone and we make it case by case, with no schedule, minimum, or appeal. Holding a vulnerability back, or threatening to publish or sell it, to press us for money is a violation of this policy and we will treat it as one. We will fix what we can, and we will credit you by name if you would like that.

Nothing in this section grants you rights over the platform beyond permission to test what we agreed to test, and we may withdraw that permission at any time.

9. Legal Compliance

You must comply with all laws that apply to you when using the platform, including laws governing the possession, transfer, and lending of the items you list or borrow. Where local law restricts who may possess or operate an item, it is the owner's and the borrower's responsibility to comply; the platform does not verify licenses or permits.

10. Reporting Violations

• Report a chat message or a user through the in-app reporting flow. You choose whether the report goes to the pool's admins or to the pool admins and the platform.
• Report an entire pool through the in-app flow; pool reports go directly to the platform.
• Report a review from the Report control shown next to it on a user's profile; review reports go directly to the platform.
• To report an intimate image shared without consent, email [email protected]; we remove such material within 48 hours of a valid request, as the Terms of Service describe.
• Anything else, or anything urgent: [email protected].

Do not file knowingly false reports; that is itself a violation.

11. How We Moderate

Moderation happens at two layers. Pool admins handle most member-level issues inside their own pool: they work their pool's reports queue, talk problems through in chat, and can remove or ban members from the pool. The platform handles everything else, and everything pool admins cannot or should not: reports escalated to the platform, reports about pools and reviews, and the serious cases listed in this policy.

When you report a chat message, the admins who receive the report see the reported message and who wrote it, even if the author is anonymous elsewhere; moderation outranks in-chat anonymity, and every report filed is recorded.

We may use automated systems, which may include matching against databases of known illegal imagery and spam, fraud, and malware detection, to help identify harmful content, in some cases proactively, as described in our Privacy Policy. Automated flags and user reports are reviewed by a human before serious action, such as disabling an account, is taken.

A typical case moves through detection (a report or an automated flag), review, action, and, if you disagree, appeal. In some cases the law requires us to remove or restrict content very quickly, including within hours, in response to a lawful order; where that happens we may act without prior notice.

12. Enforcement

Pool admins may remove or ban members from their own pool. The platform may remove content, warn users by email, disable or delete accounts, disable pools, and delete reviews, tools, or pools. Every platform enforcement action is recorded in an audit log. Enforcement is at our discretion; we consider severity, intent, and history, and we do not commit to warnings before acting.

Certain categories involving the most serious harms, including child sexual abuse material, intimate images shared without consent, and credible threats of violence, are subject to mandatory legal handling: removal, preservation where the law requires it, and reporting to the authorities, regardless of any appeal.

13. Appeals

If you believe a moderation decision about your content or your account was wrong, email [email protected] and tell us what was decided and why you disagree. A human will reassess the content and the original decision, and we will tell you the outcome: upheld, reversed, or modified.

14. Repeat Violations and Bad-Faith Reports

Repeat violations escalate: what earns a warning the first time can disable or delete an account the second. Severe violations skip the ladder entirely. We may also decline to act on, or deprioritize, reports and appeals from anyone who frequently submits clearly unfounded ones, and knowingly false reports are themselves a violation of this policy.

In deciding what action to take and how long it lasts, we consider the number and gravity of the violations or unfounded reports, the intent behind them where we can identify it, the user's history, and any other relevant circumstances.

15. Changes

We may revise this policy as the platform evolves. Material changes will be announced, and where this policy is incorporated into the Terms of Service, a new Terms version will require re-acceptance.