Draft prepared for attorney review. These documents are first drafts: they are not legal advice and have not been adopted by Varrock Inc. Points awaiting a business decision are marked [DECISION: …] and points for counsel [COUNSEL: …]; nothing here is in force.

Acceptable Use Policy

Draft prepared for review by counsel. Draft date: 2026-10-06. This is a first draft produced for attorney review; it has not been adopted by Varrock Inc. and is not legal advice. Points that need a decision by the company or by counsel are marked [DECISION: …] or [COUNSEL: …] and are collected under "Open decisions" at the end.

This Acceptable Use Policy (the "Policy") sets out what you may not do with the OasisGUI software, the OasisNet mesh software, and the services Varrock Inc. operates around them. It forms part of the Website Terms of Use and is intended to form part of the End User License Agreement. [COUNSEL: eula.md does not currently reference this Policy, and its entire-agreement clause (EULA section 20.1) would exclude it; add an incorporation clause to the EULA (for example in section 3 or 4) and list this Policy in EULA section 20.1, or limit this Policy to the Terms of Use.] [DECISION: canonical filename — links in this Policy follow the file on disk (terms-of-service.md) although the document is titled "Website and Service Terms of Use"; rename either the file or the title set-wide, see README 5.3.] How Varrock handles personal data is described in the Privacy Policy.

1. Who this Policy applies to#

1.1. This Policy applies to every person and organization that downloads, installs, runs or distributes the Software, visits the Website, or uses a Varrock Service ("you").

1.2. If you install the Software on machines other people use, or operate a Mesh that other people join, you must take reasonable steps to ensure that those people comply with this Policy; if you are a Business User, you are responsible for their compliance. Acts of your employees, contractors, agents and automated systems, including AI agents you launch through the Software, are treated as your acts. For Consumers this section applies subject to section 13.4.

1.3. This Policy is published by Varrock Inc., a Delaware corporation ("Varrock", "we"). Varrock's registered agent is LegalInc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, USA.

2. Definitions#

2.1. "Software" means OasisGUI (the desktop application, also called "Oasis"), the per-host runner daemon (oasis-runner), the OasisNet binary (oasisnet), the virtual-machine helpers, the mobile application [DECISION: confirm Oasis Mobile is distributed to customers and through which channel; otherwise remove it from this definition until it is.], the command-line tools, and any update to them that Varrock makes available.

2.2. "Website" means oasisgui.com and any other website Varrock operates for the Software, including its documentation and in-browser demo.

2.3. "Varrock Service" means a network service Varrock itself operates for the Software. As of the draft date this is the Website, the update manifest the Software fetches from https://oasisgui.com/downloads/latest.json and, once it is in service, the mobile push gateway at https://push.oasis.cooking that Varrock operates (Privacy Policy section 6). The push gateway is the default gateway in the Software, but as of the draft date it is not in service (no delivery key is provisioned), and a Host's runner contacts it only after you register a phone with that Host. Mesh coordinators, relays, exit nodes, runners, mail servers, virtual machines and browser sessions run on machines you choose and control; they are not Varrock Services. [DECISION: whether push goes live and stays the shipped default, or ships self-host-only; if it goes live, confirm it as a Varrock Service here and align with the Privacy Policy and the Subprocessor List.]

2.4. "Mesh" means a private WireGuard network created with OasisNet, including its coordinators, relays, mesh DNS, chat relay and exit nodes.

2.5. "Host" means any computer, virtual machine, container, phone, emulator or other device on which you run any part of the Software or which you connect to through it.

2.6. "Exit Node" means a Mesh member that has enabled its exit-node capability so other members can route internet traffic through it.

2.7. "Third-Party Provider" means any service the Software connects to on your behalf with your own credentials or keys, including AI providers (such as those behind Claude Code, Codex, Kimi Code, OpenRouter and ElevenLabs), backup storage providers, and any service you reach through a browser, device or terminal session.

2.8. "Authorized" means you own the Host, network, account or service in question, or its owner has given you permission in advance, in a form you can show, to use it in the way you are using it.

2.9. Capitalized terms not defined in this Policy have the meaning given in the End User License Agreement or the Website Terms of Use. For the purposes of those documents: "Host" includes everything the EULA calls "Your Infrastructure"; "Third-Party Provider" means the provider of what the EULA calls a "Third-Party Service"; "Website" means what the Terms of Use call the "Site"; and "Consumer", "Business User" and "EEA Consumer" have the meaning given in Terms of Use section 2. [DECISION: harmonize defined terms across docs/legal (see README) rather than keeping this mapping clause.]

3. Lawful use#

3.1. You may use the Software, the Website and the Varrock Services only in compliance with the laws that apply to you, to the Hosts you use and to the people whose data or systems you touch.

3.2. You may not use the Software to plan, assist or carry out anything unlawful where you are, where the Host is, or where the affected person or system is.

3.3. The Software is a tool for operating computers you are Authorized to operate. None of its capabilities (installing helpers on remote Hosts, opening browser sessions, running AI agents without permission prompts, routing traffic through other machines) is an authorization to use them against systems or people who have not agreed to it.

4. Access to systems and networks#

4.1. Authorized Hosts only. You may install the Software on, connect it to, and operate through it only Hosts you are Authorized to use. This covers every connection the Software can make, from SSH and runner installation to remote displays, browser and device sessions.

4.2. No unauthorized access. Subject to section 4.6, you may not use the Software to access, or attempt to access, any computer, account, network, data or service without authorization or beyond the authorization you have. This includes guessing or testing credentials, exploiting vulnerabilities, bypassing authentication, and using credentials, keys, certificates, invite codes or tokens not issued to you for that purpose.

4.3. Credentials you hold for others. The Software can distribute credentials onto Hosts (SSH keys and certificates, AI-provider token sets, API keys placed in a Host's runner). You may distribute a credential only to Hosts and people its issuer permits, and you must revoke it when that permission ends.

4.4. No interference. You may not use the Software to disrupt, degrade or overload any network, Host or service you do not control or are not Authorized to test, including by denial-of-service, flooding, malformed traffic, or tampering with the security, segmentation or firewall rules of a network you are not responsible for.

4.5. No interception. You may not use the Software to intercept, monitor, record or redirect communications you are not a party to and are not Authorized to intercept. Transcript mirroring (the Library), shared desktops and live-desktop views are for your own sessions and for people who have knowingly joined a workspace, not for surveilling others without a lawful basis and, where the law requires it, their consent.

4.6. Security research. Lawful testing of systems you are Authorized to test is not prohibited. Good Faith Security Research on Varrock's own Website and Varrock Services, within the scope and rules of the Vulnerability Disclosure Policy, is not a breach of this Policy. [DECISION: adopt and publish the drafted Vulnerability Disclosure Policy together with this Policy; until then this cross-reference is to a draft.] [COUNSEL: the EULA (section 4.1(e)) and the Terms of Use carry no matching carve-out for good-faith security research; add one or confirm that incorporation of this section suffices (see Vulnerability Disclosure Policy section 7.3).]

5. OasisNet: meshes, coordinators, relays and exit nodes#

5.1. Your own infrastructure. The Software ships with no coordinator and contacts none by default. Unless you adopt a coordinator or relay that Varrock provides to you under a separate agreement, every coordinator, relay, mesh DNS resolver, chat relay and Exit Node runs on a Host a Mesh member chose, and you are responsible for those Hosts and for the traffic they carry. [DECISION: confirm Varrock offers no hosted coordinator or relay to customers; if it does, define it as a Varrock Service in section 2.3.]

5.2. Authorized Hosts in a Mesh. You may enroll only Hosts you are Authorized to enroll, and make a Host a coordinator, replica, relay or Exit Node only if you are Authorized to run that role on that Host and its network. On rented infrastructure the hosting provider's terms also apply.

5.3. Invites and names. A Mesh invite code is a bearer credential: anyone holding it can join. Share an invite only with the person it was created for, and do not use an invite not issued to you. Do not choose a peer, person or mesh DNS name that impersonates another person or organization or misleads other members about which Host or person it refers to.

5.4. Exit Nodes: only hosts you are authorized to use. You may enable the Exit Node capability only on a Host you are Authorized to use as an internet gateway, on a network whose operator permits that use. Routing other people's internet traffic through a Host you were given access to for another purpose (an employer's machine, a university network, a cloud server whose provider forbids proxy or VPN use) breaches this Policy. When you use someone else's Exit Node, you may do so only with its owner's permission, and everything you do through it is attributed to you.

5.5. Exit Node operators. Traffic from other members leaves the internet with your Host's public address. You are responsible for choosing who may use your Exit Node, and you may not offer one to the public or to people you cannot identify as a way of hiding the origin of traffic.

5.6. No prohibited use of exits or relays. You may not use a Mesh, relay or Exit Node to evade a block, ban or rate limit a third party has applied to you, to conceal the origin of abusive traffic, or to reach a service from a place where it may not lawfully be used.

5.7. Firewall and routing state. The access lists, public-exposure lockdown and on-device guards OasisNet manages apply to Hosts you administer. You may not use OasisNet to alter firewall or routing state on a Host or network you are not Authorized to administer, to disable protections another administrator placed on a shared Host without their agreement, or to announce or interfere with address space, routes or DNS names belonging to a network you do not control.

6. Malware and harmful code#

6.1. You may not use the Software, the Website or a Varrock Service to create, store, distribute, deploy, command or control malware, ransomware, spyware, botnets, cryptojacking software, exploit kits or any other code designed to damage, disable, take control of or exfiltrate data from a system without the owner's authorization.

6.2. You may not distribute a modified or repackaged build of the Software that contains harmful code, misrepresents itself as an official Varrock release, or is designed to defeat the security measures described in the End User License Agreement.

6.3. You may not use the Software's virtual machines, containers, emulators or browser sessions as a launch point for attacks on third parties. Analyzing malware inside an isolated virtual machine on a Host you are Authorized to use is not, by itself, a breach.

7. Use of the Website and the update manifest#

7.1. The Website and the update manifest exist to let people learn about, download and keep up to date the Software. You may not:

(a) scrape, crawl or download the Website or the manifest by automated means at a rate or in a manner that burdens the service beyond what the Software itself does (it checks the manifest at launch and about every ten minutes);

(b) probe, scan or test the vulnerability of the Website or a Varrock Service, or breach its security, except as permitted by the Vulnerability Disclosure Policy (section 4.6);

(c) mirror or serve altered copies of the manifest or installers in a way that could cause someone else's installation to receive a build that is not an official Varrock release;

(d) interfere with delivery of the Website or the manifest to anyone else, or frame or present the Website as your own.

8. Email, messaging and content#

8.1. Mail server. The Software includes an optional, off-by-default mail server that sends and receives email directly from a Host you administer. If you enable it, you are its operator. You may not use it to send unsolicited bulk or commercial email, to forge headers or senders you are not Authorized to use, to relay mail for parties you have not vetted, or in breach of the CAN-SPAM Act, EU rules on unsolicited communications or similar laws. You are responsible for the SPF, DKIM and DMARC records you publish and for abuse reports addressed to your domain.

8.2. Messaging. You may not use mesh chat, sticky notes, shared desktops or any other feature that puts content in front of another person to harass, threaten, defame or impersonate anyone, to distribute unlawful content, or to message people who have asked you to stop.

8.3. Content you process. The Software does not host your content; it runs on your Hosts. You are responsible for every file, transcript, backup, snapshot and message you store, share or mirror with it, including data-protection compliance when it contains other people's personal data. You may not use the Software to store or distribute content that infringes a third party's rights, that is child sexual abuse material, or that is otherwise unlawful.

9. Browser, device and automation sessions#

9.1. The Software can drive headless browsers, Android containers and iOS simulators, show their screens live, and let AI agents operate them. You may use these capabilities only in compliance with the terms, robots directives, rate limits and access controls of the services you reach, and with applicable law.

9.2. You may not use browser or device sessions to bypass a service's bot-detection, access control, paywall, CAPTCHA, geographic restriction or rate limit where doing so is contrary to that service's terms or to law; to create or operate accounts in breach of a service's terms; to scrape personal data without a lawful basis; or to pass an automated system off as a human where the counterpart has a legal right to know. [COUNSEL: the Software includes browser-fingerprint consistency work aimed at passing Cloudflare Turnstile on ordinary sites (src-tauri/src/browser_manager.rs); confirm the wording permits ordinary use of one's own browser profile while prohibiting circumvention contrary to a site's terms.]

10. AI agents and Third-Party Provider terms#

10.1. Your accounts, their terms. The Software launches and orchestrates AI coding agents (such as Claude Code, Codex and Kimi Code) and calls model providers (such as OpenRouter and ElevenLabs) using accounts, subscriptions and API keys that belong to you. You must comply with each provider's terms, usage policies and limits. Varrock is not a party to your agreement with any Third-Party Provider and does not resell, proxy or guarantee their services.

10.2. Account routing. The Software can assign one AI-provider account to many Hosts, switch accounts per Host and show usage across a fleet. You may use these features only within what the provider's terms allow for your plan. You may not use them to share an individual subscription across people or organizations contrary to those terms, to evade a provider's limits, suspension or ban, or with credentials you are not Authorized to use.

10.3. Autonomous agents. The Software can run agents with permission prompts disabled, restore those flags after a reboot, and let agents operate the Oasis desktop itself. You are responsible for what an agent does with that autonomy (commands, file changes, messages, service calls) on every Host it can reach. You may not direct or allow an agent to do anything you may not do under this Policy, including generating malware, carrying out unauthorized access, producing material the provider's usage policy prohibits, or circumventing the provider's safety measures.

11. Export controls and sanctions#

11.1. The Software contains encryption and is subject to United States export control law, including the Export Administration Regulations (15 C.F.R. Parts 730-774), and may be subject to other countries' export laws. You may not export, re-export, transfer or make the Software available in violation of those laws. The full statement of Varrock's export and sanctions position is in Export Control and Sanctions; where that document and this section differ, that document governs. [COUNSEL: confirm the ECCN and licence-exception route (5D002 / mass-market 5D992.c under License Exception ENC §740.17(b)(1), or publicly-available treatment); it affects whether the coordinator, relay and exit functions need a classification request.]

11.2. You represent that you are not, and you may not use the Software, the Website or a Varrock Service if you are:

(a) located in, organized under the laws of, or ordinarily resident in a country or territory subject to comprehensive U.S. or EU sanctions or a U.S. arms embargo, or to which the EAR prohibits export of the Software [COUNSEL: verify the list at adoption and on each revision — the draft set elsewhere (EULA section 16.2; Export Control and Sanctions section 2) names Cuba, Iran, North Korea, Syria and the Crimea, so-called Donetsk People's Republic and so-called Luhansk People's Republic regions of Ukraine; Syria's OFAC program was terminated in 2025 while EAR restrictions remain; Russia and Belarus are reached via 15 C.F.R. §746.8 rather than "comprehensive sanctions"; align the formulation exactly with EULA section 16.2 and export-control-and-sanctions.md.];

(b) listed on, or owned or controlled by a person listed on, the U.S. Treasury Specially Designated Nationals and Blocked Persons List, the U.S. Commerce Entity List or Denied Persons List, the EU consolidated sanctions list, or a similar list maintained by a government whose law applies to you or to Varrock;

(c) acting on behalf of anyone described in (a) or (b).

11.3. You may not use the Software, a Mesh or an Exit Node to provide software, services or access to anyone described in section 11.2, or for any end use prohibited by Part 744 of the EAR, including nuclear, chemical, biological or missile end uses and prohibited military end uses or users.

11.4. [DECISION: whether to geo-block embargoed jurisdictions at the download and update endpoints, and who maintains the list.] [COUNSEL: Varrock has no accounts and cannot screen anonymous downloads; whether the section 11.2 representation plus geo-blocking is sufficient under OFAC and the EAR, and whether paid business licences require counterparty screening. Record the conclusion in the internal export memo, not in this Policy.]

12. Reporting abuse#

12.1. If you believe someone is using the Software, a Mesh, an Exit Node, the Website or a Varrock Service in breach of this Policy, please report it to [DECISION: abuse mailbox]. Until a dedicated mailbox exists, reports may be sent to sales@oasisgui.com, the only mailbox currently published on the Website. Reports and the data in them are handled as described in section 5.6 of the Privacy Policy, which states the purpose and legal basis (Article 6(1)(f) GDPR), the recipients under section 13.2(b) and (d) of this Policy, and the retention period (left to be decided there). [DECISION: create a dedicated abuse mailbox (for example abuse@oasisgui.com), decide who reads it, and do not publish a response-time commitment until that is settled.]

12.2. Include the date and time with time zone, the public IP address or domain involved, relevant logs or headers, and what happened. Do not send passwords, private keys, invite codes or other people's private communications.

12.3. Because the Software has no accounts and no telemetry (its only contact with Varrock is the signed update check described in the Privacy Policy, which carries no identifier), and because meshes, relays, exit nodes and mail servers run on Hosts their operators control, Varrock usually cannot identify a Host's operator from a report and cannot disable a Host or Mesh remotely. The right first contact is usually the operator of the Host or network concerned, or its hosting provider. Varrock will nonetheless review reports and may act under section 13.

12.4. Security vulnerabilities in the Software should be reported under the Vulnerability Disclosure Policy, not through the abuse channel. [DECISION: security mailbox]

13. Consequences of breach#

13.1. A breach of this Policy is a breach of the End User License Agreement and of the Website Terms of Use. Whether it is a material breach, and the notice and cure that apply, are determined under EULA section 17 for the Software and under the Terms of Use for the Website. [COUNSEL: the Terms of Use contain no termination clause of their own; add one or confirm that refusal of service under section 13.2(b) is the only remedy needed for the Website. This section depends on the EULA incorporating this Policy (see the preamble marker).]

13.2. If you breach this Policy, Varrock may, to the extent permitted by law and without prejudice to any other remedy: (a) terminate your licence in accordance with EULA section 17 (which provides for notice and, for curable breaches, a thirty-day cure period, and for immediate termination only on the grounds listed there), after which you must stop using the Software and delete your copies; (b) refuse to serve the Website, downloads or the update manifest to a network address, range or organization; (c) decline to enter into, or terminate, any business licence, support or other agreement with you; (d) report the conduct to the relevant Third-Party Provider, hosting provider, network operator or law-enforcement authority; and (e) take legal action. [COUNSEL: align with EULA section 17.2, which allows immediate termination only for breaches of sections 4.1(e), 4.1(f) and 16; decide whether breaches of sections 4, 6 and 11 of this Policy should be added to that immediate-termination list; for EU consumers, termination without reasonable notice except on serious grounds is presumptively unfair (Directive 93/13/EEC Annex 1(g)). "Suspend" has been removed because the EULA has no suspension concept; add one there if wanted.]

13.3. The Software contains no licence check, kill switch or remote-command channel to Varrock. The only input Varrock can send to an installed copy is the signed update manifest, and the Software installs an update only when you choose to (EULA section 7). Termination under this Policy therefore does not by itself change the state of your systems, a Host, a Mesh or a mail server, and Varrock will not claim otherwise. [COUNSEL: confirm this limitation should be stated expressly; it is accurate to the code and avoids implying a remote-disable capability.]

13.4. If you are a Consumer habitually resident in the EU, the EEA or the UK, sections 1.2, 13 and 14 of this Policy apply subject to EULA section 15 and Terms of Use section 15, and nothing in this Policy limits any right or remedy under the mandatory consumer-protection law of the country where you habitually reside; a term that would be unfair under the national law implementing Directive 93/13/EEC does not bind you. [COUNSEL: EU consumer-protection carve-out wording, consistent with the EULA and Terms of Use; UK and Swiss consumers.]

14. Relationship to other documents; changes#

14.1. This Policy supplements the End User License Agreement and the Website Terms of Use. The rules of conduct in sections 3 to 11 apply in addition to the restrictions in those documents; on any other matter (including warranties, liability, termination, consumer rights, governing law and forum) the EULA governs the Software and the Terms of Use govern the Website, and a separately signed written agreement with Varrock prevails over all three. This Policy is governed by the law and forum provisions of the document into which it is incorporated (EULA section 19; Terms of Use section 18), including their provisions for Consumers in the EU, EEA and UK. Personal data is covered by the Privacy Policy; open-source components by the Third-Party Notices. [COUNSEL: precedence order between this Policy, the EULA (section 20.1) and the Terms of Use (section 20.1); whether this Policy need not restate the Delaware law and forum clause, and whether a standalone law clause is needed if the Policy is published as a page on its own (README 5.2).]

14.2. Nothing in this Policy obliges Varrock to monitor use of the Software, and Varrock has no means to do so beyond the web-server records described in the Privacy Policy. [COUNSEL: align with the Privacy Policy's statement of what Varrock actually receives (update-manifest requests and any retained web-server access logs).]

14.3. Varrock may revise this Policy. The current version is published on the Website with its effective date. For the Website and the Varrock Services, a revised Policy applies to use after its effective date, which for changes that materially restrict what you may do is at least [DECISION: notice period — align with Terms of Use section 19.1, currently 30 days] after publication. For installed Software, a revised Policy applies from the first version you install after its effective date, as EULA section 18 provides; copies you already hold remain subject to the Policy that accompanied them. Changes required by law, or that only clarify or relax restrictions, may take effect on publication. [COUNSEL: acceptance-by-installation and change mechanics against EU consumers (Directive 93/13/EEC Annex 1(j)); whether an in-app notice is needed, since the Software has no account or notice channel other than release notes.]

14.4. Questions about this Policy may be sent to [DECISION: contact mailbox]. The only mailbox published on the Website as of the draft date is sales@oasisgui.com.

Open decisions#

Every marker used above, to resolve before adoption.

Product facts verified in the repository on the draft date: src-tauri/tauri.conf.json, src/updater.ts (update endpoint, cadence); oasisnet/src/exitnode.rs, docs/exit-vpn.md (self-owned exit flag); oasisnet/src/main.rs (bearer invites); src-tauri/src/mesh_manager/mesh_config.rs (no built-in default coordinator), src/changelog.json 1.4.10 ("Mesh ships with no coordinator by default"); docs/enterprise/00-overview.md (off-by-default SMTP; Oasis Mobile distribution channel not documented); docs/enterprise/06-fleet-vms-agents.md (agent providers, account routing, autonomy flags; live device display, no screen recording); docs/enterprise/02-security.md, docs/enterprise/07-enterprise-readiness.md (no session recording); src-tauri/src/browser_manager.rs; src-tauri/src/browser_snapshots.rs (last screencast frame is a display cache only); runner/oasis-runner/src/notify/push.rs, docs/enterprise/05-operations.md (push gateway default, not live); website/index.html (sales@ is the only published mailbox).

Source: docs/legal/acceptable-use-policy.md in the repository · draft for attorney review · 25 [DECISION] markers and 27 [COUNSEL] markers on this page.