Acceptable Use Policy

Updated October 3, 2026

XOXO is for sending newsletters to people who asked for them. Every account sends through shared infrastructure, so one account’s spam can land everyone else’s email in the spam folder. This policy sets out the rules that keep email sent through XOXO out of the spam folder.

This policy is part of our Terms of Service. It covers the app, your emails, and your hosted and embedded forms, and it adds to the law rather than replacing it.

It applies to everyone who uses XOXO, including the collaborators you invite and any AI agent you connect to your account. You’re responsible for what they do.

Permission

Only email people who explicitly asked to hear from you. That means each subscriber:

Signed up through one of your XOXO forms, or through another sign-up you can document, like a form on your own site or a checkbox at checkout that wasn’t already ticked
Gave that permission to you, not to a partner, a sister brand, or someone who handed you the list
Knew what kind of email they were signing up for

The same goes for subscribers you import, add by hand, or bring in through a connection. Be ready to show when, where, and how each person signed up, and send us that proof if we ask. We may hold your sending while we check.

XOXO’s own forms always ask new subscribers to confirm their address before they join. You don’t have to re-confirm a list you import, but it’s the best protection for your deliverability, and everyone else’s.

Never email:

Lists that were bought, rented, borrowed, traded, or shared with you
Addresses that were scraped, harvested, guessed, or found in public directories
Co-registration, lead generation, or enrichment lists
People you’d like to reach but who never signed up, including cold outreach to businesses
People who unsubscribed, hard-bounced, or reported your email as spam, even on another service
An old list that never clearly opted in, including through a “permission pass” email asking them to opt in now

Send what people signed up for. If someone subscribed to your weekly essays, don’t start sending them daily sales.

A big change in what you send, or a list you haven’t emailed in a long time, is when complaints happen. Start with the people who’ve heard from you recently.

Sending

Every email you send through XOXO needs to:

Say clearly who it’s from, with a sender name and address that aren’t misleading
Have a subject line that honestly reflects what’s inside
Include your real physical mailing address (a home address or PO box works), which you set in Settings
Keep XOXO’s unsubscribe link working and easy to find
Label sponsored or paid content wherever the law requires it

XOXO adds an unsubscribe link and one-click unsubscribe to every email, and opt-outs take effect right away. Don’t hide the link, ask people to unsubscribe some other way, or add anyone back once they’ve left.

Your emails also need to follow the anti-spam and privacy laws that apply to your subscribers, like CAN-SPAM in the US, CASL in Canada, and GDPR and ePrivacy rules in the EU and UK.

You can’t:

Forge or alter email headers, or send as a person, organization, or domain you aren’t authorized to send for
Use link shorteners, redirects, or look-alike links to disguise where a link goes
Send email just to find out which addresses still work
Collect replies to email sent through another service that breaks that service’s rules or this policy
Send one-to-one messages, receipts, password resets, or other transactional email through XOXO
Open multiple accounts, or rotate domains, sender names, or addresses, to spread out sending, get past spam filters, or get around our limits

Bounces and complaints

Bounces and spam complaints are how inboxes decide whether mail is welcome. XOXO removes addresses that bounce permanently, including ones that bounced for another sender on XOXO, and anyone who marks your email as spam, from your audience automatically. People who report spam can’t be added back.

Keep both as low as you can. Tracking emails shows each send’s rates next to the ranges we consider healthy, and explains what happens when a send goes over. Those ranges are guides, not bright lines, and we look at the whole picture.

High rates almost always mean a list problem, not a content one. Find where the list came from, stop sending to people who didn’t clearly opt in, and remove subscribers who haven’t opened or clicked in a long time.

Emailing spam traps, addresses that exist only to catch senders using bad lists, is a violation even when your rates look healthy.

Content

Don’t use XOXO to send, host, or link to anything that:

Is illegal, or promotes or helps with illegal activity
Sexually exploits or endangers children, in any form
Harasses, threatens, bullies, or doxxes anyone, or incites violence or hatred against people for who they are
Promotes terrorism, violent extremism, or human trafficking
Encourages suicide, self-harm, or eating disorders
Defames anyone, or deceives people about money, health, identity, or safety
Presents manipulated or AI-generated media, like deepfakes, as real, or depicts a real person in sexual content without their consent
Impersonates a person, brand, or organization, or is designed to look like it came from one
Tries to collect passwords, payment details, or other credentials, including simulated phishing and security awareness tests
Contains or links to malware, spyware, or anything else designed to harm devices or data
Infringes someone else’s copyright, trademark, or other rights (our Terms of Service explain how to report it)

Restricted businesses

Some kinds of email draw complaints and hurt deliverability for everyone, even when they’re legal. We don’t allow XOXO to be used for:

Affiliate marketing as the main purpose of your list
Get-rich-quick or work-from-home schemes, pyramid schemes, or multi-level marketing
Payday or short-term loans
Credit repair or debt relief offers
Cryptocurrency promotions, token sales, or giveaways
Sweepstakes or contest-entry lists, lotteries, or gambling
Prescription drugs, peptides, research chemicals, or unlicensed supplements
Lead generation, list brokering, or list resale
Sexually explicit content, escort services, or adult dating
Counterfeit goods, or fake followers, likes, or reviews
Regulated goods sold unlawfully, like weapons, drugs, or tobacco

Writing about these subjects is fine. A newsletter that covers crypto or personal finance can send, but one that exists to sell a token or a loan can’t.

If your newsletter sits in a gray area, email us before you send. We’d rather talk it through than stop your sending.

Forms

Your forms are where people give you permission, so they need to be honest. Every form needs to make clear who’s collecting the address and what people will get.

Don’t:

Sign people up without their knowledge, including through bots, scripts, or forms filled in for someone else
Hide the sign-up inside something else, like a contest entry or a download, without telling people they’re joining a newsletter
Reward sign-ups in ways that invite fake or throwaway addresses
Use a form to collect anything our Terms of Service rule out, like sensitive personal information or data from children under 13
Use a form page for anything this policy prohibits, or to send people somewhere else under false pretenses

Using XOXO

Don’t interfere with XOXO or use it in ways that harm other accounts or their subscribers. You can’t:

Probe, scan, or test XOXO’s security without our written permission (if you think you’ve found a vulnerability, please email help@xoxo.email with “Security” in the subject)
Break or get around our limits, reviews, or security measures, or send requests designed to overload the service
Reverse engineer, decompile, or otherwise try to extract XOXO’s source code
Scrape, crawl, or mirror the service, or collect data from it by automated means, apart from AI agents you connect to your own account
Use XOXO to host files or images for anything other than your emails and forms
Use your form pages for search spam, like link farms or keyword stuffing
Share sign-in details, or create accounts by automated means
Pay with a card you aren’t authorized to use, or file chargebacks to avoid paying for what you’ve used
Resell or sublicense XOXO, or use it to build a competing service
Sign up again after we’ve closed your account, or use a different account to keep sending while one is paused

How we enforce this policy

We keep watch over sending across XOXO, not just when something goes wrong.

Before a send. Every email you send to your subscribers gets an automated review, including an AI check and a check of its links against lists of known phishing and malware sites. If the review doesn’t approve a send, a person on our team looks at the email before anything goes out. First sends and new lists get a closer look.
During a send. We check every send’s bounces and complaints as it goes out, and pause the rest of it for our team to review if they run too high. Sends from new senders, from XOXO’s shared address, and to subscribers you haven’t reached lately go out in stages, so there’s time to check before most of the list is mailed.
After a send. We watch bounces, complaints, and reports from subscribers. Our email delivery providers watch every account’s sending too, including mail that reaches spam traps, and can pause it on their own.

If we find a problem, we may decline or stop a send, review your future sends by hand, remove content, pause your sending, or suspend or close your account.

We usually start by explaining the problem and giving you a chance to fix it. When a problem is serious or keeps happening, we can act right away. If we close your account, we take steps to keep it from coming back under a new one.

Where the law requires it, or someone’s safety is at risk, we report activity to the relevant authorities. We always report child sexual abuse material.

If you think we’ve made a mistake, reply to our email or write to help@xoxo.email. Tell us what happened and what you’ve changed, and we’ll take a fresh look.

Reporting abuse

If you got an email through XOXO that you didn’t sign up for, or you’ve seen a form or page that breaks this policy, email help@xoxo.email with “Abuse” in the subject. Forward the email you received, or include the page’s web address.

We read the reports we get, though we can’t reply to each one. Unsubscribing from the email itself stops it right away, and marking it as spam tells us too.

Changes to this policy

We may update this policy from time to time. Since it’s part of our Terms of Service, changes follow the notice rules in Changes to these terms.