Acceptable Use Policy

Last updated: May 23, 2026

The spirit

shy-tomato is a recipe app, run by one person. This policy exists so the service stays useful, affordable, and pleasant for everyone — including me, sitting here paying the Vertex AI bill. The rules below aren't lawyer-bait; they're the things that, if you do them, make the service worse or more expensive for everyone else. So please don't.

If you're not sure whether something you want to do is okay, email me at [email protected].

1. Prohibited content

Don't upload, paste, save, or attempt to import:

  • Content that's illegal where you live or where I operate the service (the United States).
  • Content that infringes someone else's copyright, trademark, or other intellectual property — including pasting links to pirated material as a way to extract a recipe from it.
  • Sexual content involving minors. I report this without exception.
  • Content that promotes hate, harassment, or violence against people because of who they are.
  • Content that's defamatory, fraudulent, or designed to deceive.
  • Malware, exploit payloads, or anything that would harm other users or the service.

shy-tomato is a recipe app. The content people put in it should be about cooking.

2. Prohibited conduct

Don't:

  • Scrape, crawl, or copy shy-tomato beyond personal use. Personal use means reading recipes you imported, using the search, browsing the public Explore feed at human speed. It does not mean automating the site to mirror it or to build a competing service.
  • Flood the service with imports. Paste-import has a real per-call cost (Vertex AI). I rate-limit per account, and accounts that try to bypass those limits — through multiple accounts, scripts, or anything else — will be suspended.
  • Share accounts. One account per person. If you want family members to use shy-tomato, each of them can have their own free account; shared household features will come later.
  • Bypass the Pro gate. Meal planning is a paid feature. Don't try to hit the underlying APIs to use it for free.
  • Try to access other users' data. No probing for IDOR bugs to read someone else's recipes, no guessing at session tokens, no exploiting unintended endpoints. If you find a security issue, please report it instead — see section 5.
  • Misrepresent yourself. Don't sign up under someone else's email, impersonate me, or impersonate another user.
  • Use shy-tomato to harm or harass anyone. This includes other users, me, and people outside the service.

If you're a security researcher and you want to test something, write to me first and we'll figure out a scope.

3. Rate limits and abuse defense

Extraction (importing a recipe from a paste) has a real cost per call. I cap usage per account to keep the service sustainable. Specifically:

  • Paste imports are throttled per user per day.
  • Repeated failures or clearly-abusive patterns trigger a temporary block.
  • If your account is blocked, you can email me at [email protected] to appeal. I read every appeal.

These limits exist to defend the service, not to upsell you. Heavy-but-good-faith usage by a real cook is fine — write to me if you keep hitting limits.

4. DMCA and intellectual property

shy-tomato displays recipes imported from sources around the web. My posture on third-party content is described in the Terms of Service under "Third-party recipes I display": I persist facts plus an AI-generated description, I never republish publisher prose, and I hotlink hero images to the source CDN with a fallback only if the source 404s.

If you're a creator, publisher, or rights-holder and you believe content on shy-tomato infringes your rights, you can file a DMCA notice. Full instructions and contact details for my designated DMCA agent are at shytomato.com/dmca.

I respond promptly to valid notices and have a counter-notice process for users whose content is taken down in error.

Repeat infringers. In accordance with the Digital Millennium Copyright Act, I terminate the accounts of users who are determined to be repeat infringers. "Repeat infringer" generally means a user against whom I've received and acted on two or more valid DMCA notices, but I exercise judgment on borderline cases.

5. Reporting violations and security issues

  • Abuse, harassment, or illegal content on the service: email [email protected] with the URL or recipe ID and a brief description.
  • Security vulnerabilities: email [email protected]. Please don't publicly disclose before I've had a chance to fix it. I appreciate responsible disclosure and will credit you if you'd like.
  • DMCA takedown requests: shytomato.com/dmca.

6. Enforcement

When something violates this policy, I generally take one of these actions:

  • Warn. First-time issues that look like misunderstandings usually get a warning by email.
  • Suspend. Continued or moderate violations result in a temporary suspension. You won't be able to sign in until I lift the suspension.
  • Terminate. Serious violations (illegal content, repeat infringement, attempts to compromise the service or other users) result in account termination without warning.

Every enforcement action is recorded in an internal audit log. Terminations are not reversible. If your account is terminated, you will not be able to sign in to use shytomato.com/me/export yourself — but I will provide your data on request at [email protected] for 30 days after termination.

If you think I got it wrong, write to me at [email protected]. I read every appeal.

7. Changes

I'll update this policy as needed. Material changes get an email; small changes are just posted. Continued use after a change means you accept it.

8. Contact

Email: [email protected]

Mail: Wescott Sharples, 3727 77th Pl SE, Mercer Island, WA 98040, USA

DMCA: shytomato.com/dmca