Acceptable Use Policy

Version 2026-09-20.1 · effective September 20, 2026

This policy is part of the Terms of Service and applies to everyone who uses Lunar Canoe, which is operated by Magic Ingredient LLC. It covers what you upload, what you ask a model to make, and what you do with the result.

It is written in plain English on purpose. It is the document you actually need to understand, and "I did not realise" is not a defence we can act on after the fact.

The short version. Do not make video of a real person without their permission. Never make sexual content involving a real person's likeness. Never make anything sexual involving a minor, or anything that sexualises a minor, under any circumstances, in any style, at any apparent age. Do not use someone else's work or brand as if it were yours. If you publish what you make here, say it was made with AI.

Contents

1. Images of real people: the consent rule
2. Minors
3. Sexual content
4. Non-consensual intimate imagery, and how to get it removed
5. Deceptive depictions and impersonation
6. Other people's work: copyright, trademarks and characters
7. Harmful, illegal and abusive content
8. Disclosure when you publish
9. Platform integrity
10. What we do about it
11. Reporting a violation
12. What we do not do

1. Images of real people: the consent rule

Reference images are how Lunar Canoe keeps a subject looking like itself across shots. That is the feature. Unchanged, it is also the mechanism for making video of a real person doing something they never did. So this is the rule that matters most here.

You may upload an image showing a real, identifiable person only if at least one of these is true:

1. The person is you.
2. You have that person's permission, in a form you could actually produce if we asked — a signed release, a written model agreement, a clear message from them agreeing to this specific kind of use. Verbal agreement, "they wouldn't mind", and a photo you took at an event are not permission.
3. You hold the rights another way — for example you are the person's legal guardian and the use is lawful (subject to section 2), or you have a licence from a rights holder that covers this use.

Permission must cover what you are actually doing: creating AI-generated video that depicts that person. Permission to take a photograph is not permission to animate it. A stock-photo licence is very often not a licence to generate a synthetic likeness — check the licence you actually hold.

Making this representation falsely is a violation of this policy and of the Terms, independently of whatever else you then make.

Not built yet: we intend to ask you to affirm this at the point of upload and to record the affirmation against the file. That is specified in assent-and-consent.md in our policy repository and is not implemented today, so no such record exists for uploads made now.

Public figures. At launch, do not upload images of, or attempt to generate the likeness of, public figures — politicians, candidates, officials, celebrities, executives, or anyone else who is publicly known. We understand satire and commentary are legitimate. We cannot adjudicate them reliably, so the rule is flat: no public figures. Several US states now give people an enforceable property right in their voice and visual likeness, and some of them impose liability without regard to whether the use was commercial.

Deceased people. The same rule applies. Rights of publicity survive death in a number of states, and "they have died" is not consent.

Withdrawal. If a person tells us they are depicted in content on the Service without their permission, our default is to remove it, and to ask you for the permission you affirmed you had. If you cannot produce it, the content stays down.

2. Minors

Do not upload an image of anyone under 18, and do not attempt to generate a depiction of a minor, real or imagined, in any sexual, suggestive, or exploitative context. There is no exception to this, and no context in which we will discuss it.

Specifically prohibited, without exception:

• Child sexual abuse material (CSAM) of any kind, including material that is entirely synthetic, stylised, animated, cartooned, or produced in a non-photographic style.
• Content that sexualises a minor, including "aged-up" depictions of a real minor, "de-aged" depictions of an adult intended to appear as a minor, and content that presents a child in a sexualised way without nudity.
• Prompts, reference images, style instructions or workarounds intended to produce any of the above, whether or not they succeed.
• Uploading an image of a child in order to have a model generate video of that child, even where the content is not sexual and even where you are the child's parent or guardian. We do not offer this and we will not.

We do not scan for this. We have no upload classifier, no age-estimation model and no CSAM hash matching. US law imposes a reporting duty on what we actually know about, not a duty to search (18 U.S.C. § 2258A(f)), and we would rather say plainly that we do not scan than imply a detector that does not exist. Building one is planned; see section 12.

What does happen. We act on what we are told. A report in the child-safety category carries our fastest clock — we act within 24 hours — and you can file one at lunarcanoe.com/report without an account (section 4). On a credible report the account is terminated immediately and without warning.

Where we obtain actual knowledge of apparent child sexual abuse material, US law requires us to report it to the National Center for Missing & Exploited Children's CyberTipline as soon as reasonably possible, and to preserve the material and related records for one year in a secure location with restricted access. The operator does that by hand: there is no automated reporting pipeline and no automated preservation hold, and building both is on the list. We cooperate with law enforcement.

Our model providers apply their own filters in this area and may refuse a request. Attempting to work around those filters is a separate violation (section 9).

3. Sexual content

Lunar Canoe is not a tool for making pornography, and we do not support it.

Absolutely prohibited:

• Any sexual or intimate content depicting a real, identifiable person — including yourself. This is a flat rule. Consent does not make it acceptable here, because we cannot verify consent at the scale or the standard that this category demands, and because a synthetic intimate image of a real person is the single most damaging thing this product could be used to make.
• Anything covered by section 2.
• Sexual content involving apparent coercion, incapacity, or non-consent.
• Sexual content involving animals.

Also prohibited: sexually explicit content generally, whether or not any real person is depicted. Our providers' safety filters are likely to refuse it in any case; our rule does not depend on theirs.

4. Non-consensual intimate imagery, and how to get it removed

Non-consensual intimate imagery ("NCII") is prohibited on Lunar Canoe. That includes intimate visual depictions of an identifiable person published or created without their consent, and it expressly includes digital forgeries — intimate depictions created or altered with software, machine learning or artificial intelligence so as to appear indistinguishable from an authentic image of that person.

How to request removal

Anyone can make this request. You do not need an account, you do not need to identify the person who uploaded the content, and there is nothing to pay.

File it at lunarcanoe.com/report. It is a plain form, it needs no credentials and no JavaScript, and it works on a locked-down network. If you would rather write to a person, email support@enginyyr.com with the subject line "NCII removal request" — the same process applies, it is just slower to reach us.

Tell us:

1. Your name, and an email address we can reach you at;
2. An electronic signature — your full legal name, typed;
3. Where the material is — a link, an asset id, or a description of where you encountered it;
4. What the problem is, in your own words;
5. A good-faith statement that what you have told us is true;
6. That the depiction was published without the depicted person's consent — and, if you are not that person, your relationship to them or your authority to act.

If items 5 or 6 are missing we still file the notice and the clock still starts; we come back to you for the missing piece rather than dropping it. Items 1 to 4 we cannot proceed without.

You do not have to send us a copy of the imagery, and we would rather you did not.

What happens then

• You get a reference (it looks like LC-…) the moment the notice is filed. Keep it. There is deliberately no public way to look a complaint up: anything that reads one back to an unauthenticated caller would leak the reporter's contact details and a description of intimate imagery.
• We act within 48 hours of receiving the request. That deadline is set by statute, it starts when the notice arrives rather than when we get round to it, and the system tracks it and alerts when it is about to be missed.
• We delete the file itself, not just the listing. The object is removed from our storage and purged from the content-delivery cache. If either step fails it is retried until it confirms, and the complaint cannot be closed as actioned until every file the notice named is confirmed gone.
• We remove every byte-identical copy we hold, across all accounts. Files are stored under the hash of their contents, so one removal takes down every account's copy of exactly those bytes, in the same operation and inside the same 48 hours. Be clear about what that does not cover: a re-encode, a crop, a screenshot or a re-compression produces different bytes and is not caught by it. "Known identical copies" is what the statute asks for and byte-identical is what we deliver; if you find a variant, send us another report and we will remove that too.
• The bytes cannot come back. A removed file's hash is held, and an attempt to upload exactly those bytes again is refused — by anyone, on any account. An operator can lift that hold, but only deliberately and with a recorded reason.
• We keep the receipt. What we removed, when, why, and whether the storage delete and the cache purge each confirmed, in a log that cannot be edited or deleted and that outlives the file, the complaint and the account.
• We reply at the address you gave us. Today that reply is written by a person: no acknowledgement email is sent automatically, because there is no mail transport wired up yet. The reference in the response is your immediate proof of filing.

We do not require you to prove the content is unlawful before we act. Where we remove content in good faith on a request that later proves mistaken, we are not obliged to restore it, and we will not treat a good-faith request as an abuse of the process.

If the request concerns a person under 18, say so — it is a separate category with a faster clock (24 hours) and it is handled first.

The other categories

The same form takes all of them, and each carries a deadline:

Only the first row is law. The rest are promises we made and can be held to; missing one is a broken promise rather than a legal violation, and we would rather you knew which is which.

What this process does not yet include

• No counter-notice flow. If your content was removed and you think that was wrong, write to support@enginyyr.com; there is no self-serve counter-notice and no statutory waiting period implemented.
• No proactive scanning. We do not search for this material. The duty attaches to what we are told about.

5. Deceptive depictions and impersonation

Do not use Lunar Canoe to make people believe something happened that did not.

Prohibited:

• Depicting a real person saying or doing something they did not — including endorsing a product, holding a view, confessing, committing a crime, or appearing in a place they were not.
• Impersonating a real person, a business, an organisation or a government body, or generating content that presents itself as coming from one.
• Elections and civic processes. No synthetic depictions of candidates, officials, election workers or polling places; no content about when, where or how to vote; no content suggesting an election outcome or that a process was compromised.
• Fabricated news and events. No synthetic footage presented as documentary or journalistic record of a real event — an attack, a disaster, a crime, a public-health emergency, a military action.
• Fraud. No content for use in scams, romance fraud, investment fraud, phishing, or to defeat identity verification or "liveness" checks.
• Synthetic voice of a real person, where the Service produces audio.

Clearly fictional storytelling with invented characters is what this product is for, and none of the above prevents it.

6. Other people's work: copyright, trademarks and characters

Do not use the Service to infringe someone else's rights.

• Do not upload material you do not have the rights to — photographs, stills, artwork, film frames, or footage — as a reference image or a boundary still.
• Do not attempt to reproduce a copyrighted character, a distinctive copyrighted work, or a recognisable protected design. Prompting "in the style of [living artist]" to reproduce that artist's distinctive expression is not acceptable here even where a model will do it.
• Do not use someone else's trademark, logo or trade dress in a way that suggests affiliation, sponsorship or endorsement.

Copyright complaints. File at lunarcanoe.com/report under "copyright", or email support@enginyyr.com. Alongside the items in section 4, tell us which copyrighted work you are relying on, give an address or telephone number, and state under penalty of perjury that the information is accurate and that you are authorised to act. A notice missing one of those is still filed and still starts the clock; we come back to you for it. We act within 72 hours.

We have not registered a designated agent with the US Copyright Office. So the 17 U.S.C. § 512(c) safe harbour is not available to us, and we do not claim it. That is a gap we intend to close; in the meantime copyright notices are received, logged and acted on exactly as described above.

We suspend repeat infringers. three upheld copyright complaints against one account suspend it. The counter and the suspension are both recorded. There is no counter-notice flow yet — see the end of section 4.

7. Harmful, illegal and abusive content

Do not use the Service to create, store or distribute content that:

• Harasses, bullies, threatens or intimidates a person or a group, or that is created to humiliate a specific person;
• Attacks people on the basis of race, ethnicity, national origin, immigration status, religion, caste, disability, disease, age, sex, gender, gender identity or sexual orientation, or that promotes a hateful ideology or its symbols;
• Depicts graphic violence gratuitously, glorifies or incites violence, or promotes, praises or provides material support for terrorism or violent extremism;
• Encourages or instructs self-harm, suicide or disordered eating;
• Provides instructions for serious harm — weapons, explosives, chemical, biological, radiological or nuclear material, or malware;
• Promotes illegal goods or services, including drugs, weapons sales and human trafficking;
• Sexualises or endangers a child in any way not already covered by section 2;
• Is otherwise unlawful where you are or where we are.

8. Disclosure when you publish

If you publish, broadcast, post or distribute video made with Lunar Canoe, disclose that it is AI-generated, clearly enough that an ordinary viewer would understand it before they form a view about what they are watching. A caption, a title card, an on-screen label or a platform's synthetic-media label all work.

If the video depicts a real person — which, under section 1, means you or someone who has given you permission — disclosure is not optional and not a matter of style.

Do not remove, obscure, strip or misrepresent provenance markers applied to Output by us or by a model provider, and do not claim that Output is authentic camera footage.

Note that our export step re-encodes clips into one file and that this does not preserve C2PA Content Credentials that a model provider applied to the individual clips. An exported film should not be presented as carrying valid content credentials. See section 7 of the Terms.

9. Platform integrity

Do not:

• Attempt to evade, disable, degrade or work around a model provider's safety filters, or any control we put in place — by obfuscated prompting, encoding, splitting a prohibited request across scenes, iterating against a filter to find what gets through, or asking the director to help you do any of it. Circumventing a provider's filters can also void protections we rely on, so we treat it as a serious violation in its own right, whether or not it produces prohibited content. (We do not run our own content classifier today; that makes this rule more load-bearing, not less.)
• Create a new account, or use another person's account, to get around a suspension or termination.
• Probe, scan or test the security of the Service; interfere with it; or place an undue burden on it.
• Access the Service by automated means beyond what we offer, scrape it, or resell access to it.
• Extract, compute, store or transmit biometric identifiers — face geometry, face templates, face embeddings — from anything you get from the Service, or use the Service as a step in identifying a person.
• Use the Service to build a competing model, or to generate training data for one.
• Falsify who you are or misrepresent your affiliation.

Connecting an agent

You may connect an AI agent or other software to your account through a connection method we offer, such as our MCP endpoint. You are responsible for everything done through a connection you authorise, as if you had done it yourself, including anything this policy prohibits. You can revoke a connection at any time, or ask us to revoke it at support@enginyyr.com. Section 10 applies to agent access in the same way as to the rest of your account: we may limit or suspend a connection, and a restriction or suspension of your account applies to it as well.

10. What we do about it

Enforcement is proportionate to what happened, with one exception.

The ladder. These are the states an account can be in, and each move is recorded in a log that cannot be edited or deleted:

A sanction can carry an expiry, and lapses on its own when it does.

We may also remove content without sanctioning an account, decline to render a particular request, and hold the content hash of removed material so the same bytes cannot be uploaded again.

On termination for a violation, unspent credits are forfeited — see section 9 of the Terms.

Appeals. If you think we got it wrong, reply to the enforcement email or write to support@enginyyr.com. Tell us what you think happened. We will look again. There is no self-serve appeals endpoint yet; this is a human reading an email. We cannot promise an outcome, and we will not reinstate content in the categories in sections 2, 3 or 4.

Every notice, removal, ladder move and missed deadline is written to an append-only log that survives the content, the complaint and the account it describes. Nothing in it can be rewritten to flatter us, which is the point of keeping it.

11. Reporting a violation

lunarcanoe.com/report takes all of it — one form, five categories, no account needed. support@enginyyr.com reaches the same place if you would rather write.

Tell us what you saw, where, and how you came across it. Links and asset ids help. If you are reporting content that depicts you, say so — a credible first-party complaint from the person depicted is the strongest signal we get, and our default response to one is removal.

We do not disclose your identity to the account you are reporting. Nothing you send us is verified before we act on it, and that is deliberate: demanding proof of identity from someone reporting their own intimate images is its own harm. The trade-off is that a false report is possible, which is why an operator reads every one and why every removal is recorded and reversible by a deliberate act.

Categories, with their deadlines, are in the table in section 4.

12. What we do not do

For clarity, because it matters to people deciding whether to upload a photograph:

• We do not run face recognition, and we do not intend to. We do not extract, compute, store or transmit face geometry, face templates or face embeddings from your uploads, and we do not match a face in one upload against a face in another. There is no "find other clips of this person" feature and there will not be one. Whatever automated safety checking we add later will be limited to questions like "is a face present" and "does this appear to depict a minor" — never "who is this" — and any vendor we use will be contractually barred from retaining a biometric template.
• We do not scan your content at all today. No classifier, no age estimation, no hash matching. We act on reports. We would rather tell you that than let you assume a safety net that is not there.
• We do not use your content to train models.
• We do not sell your content, and we do not publish it. There is no gallery, no discovery feed and no public profile. Projects are private by default and stay that way unless you export them yourself.

Attribution: the structure of the restricted-purposes list and the report-abuse section is adapted from the 37signals Use Restrictions policy, © 37signals LLC, used under CC BY 4.0. The AI-specific prohibitions in sections 1 to 5, 8 and 9 are original drafting. Sources and licences are recorded in README.md alongside these documents.