> ## Documentation Index
> Fetch the complete documentation index at: https://docs.phoneuse.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Acceptable use

> What you may not do with a phone you drive through PhoneBase, and what we do about it.

This page is short on purpose. It says what is not allowed, where those rules
come from, and what happens when they are broken.

It is the minimum policy PhoneBase ships with, and it is not a contract. A full
terms of service is being prepared for launch; until it is published, this page
is the acceptable-use rule that applies. Where the two ever disagree, the
published terms win.

## Your model supplier's rules reach you through us

PhoneBase's copilot sends your instructions to a third-party model provider,
[OpenRouter](https://openrouter.ai/terms), and runs the model's replies against
your phone. That means their rules apply to what you ask for here, not only to
what we do.

**Your use of the copilot must comply with your model supplier's usage
policies.** Those policies are theirs to write and to change, and we pass them
on rather than restating them: read
[OpenRouter's Terms of Service](https://openrouter.ai/terms) for the current
text.

This is the part people are most often surprised by. A request our own rules do
not mention can still be refused upstream, and a refusal that arrives from the
model provider is not a PhoneBase fault.

## Three things you may not use a phone for

These are ours, and they are about the device rather than the model.

1. **Fraud.** Do not use a phone to deceive a person or a service for gain.
   That includes payment fraud, fake engagement, fabricated identities and
   anything whose purpose is to make a counterparty act on a false belief.
2. **Taking accounts that are not yours.** Do not use a phone to sign in to,
   recover, or hold an account you are not authorised to hold. Credential
   stuffing, SMS interception for somebody else's login, and working through a
   list of accounts all fall here.
3. **Getting around a platform's own protections.** Do not use a phone to
   defeat another service's security or integrity controls. Rate limits,
   device attestation, bot detection, region locks and account-linking
   protections are that service's decisions about its own product.

The second and third are worth reading together. PhoneBase gives an agent a
real handset with a real number, which is exactly the shape of thing those
protections exist to see. Having a real device does not make you authorised to
use it against somebody else's account.

## What we do when this is broken

**We may throttle, suspend, or terminate.** That is the right this policy
reserves.

What that means in practice today is withdrawal of access. An API key can be
revoked, and from its next request it is refused with the reason it was refused
for, which is a sentence your client can print. A device can have its
entitlement revoked, and `operator` is one of the recorded reasons for that.

Withdrawing access is not a deletion. The receipt ledger is a separate record
and revoking a credential does not touch it, so what already happened stays
readable.

## If you are unsure

Ask before you build it. Describe the workflow to us at the address on
[phonebase.co](https://phonebase.co/) and we will tell you whether it is
something this product is for. That is a cheaper conversation than discovering
the answer after your access is withdrawn.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.