Last updated 12 August 2026
Acceptable use
Written with examples, because a policy nobody can apply to their own situation is not a policy.
Fine — this is what Keyway is for
- A font, preset, LUT, brush or template pack you made
- Project files, sample packs or stems from your own work
- A mod, plugin, script or config you are giving away
- A guide, checklist, spreadsheet or notes document
- A beta build or early access for your own community
- A giveaway entry page or event resource
- Anything you have the right to share, gated behind a step or two
Never allowed
Malware and unwanted software
Anything that damages a device, gains unauthorised access, mines cryptocurrency without consent, or installs itself alongside what the visitor asked for. This includes "cracks", "keygens" and "cheats" that bundle a payload, which is most of them.
Phishing and credential harvesting
Any destination that asks a visitor for a password, a payment card, a recovery phrase, a 2FA code or an identity document while pretending to be someone else. This is the category we act on fastest and without notice.
Impersonation
Presenting yourself as a company, creator or service you are not. Using a brand's name and logo to make a link look official is impersonation even when the destination is harmless.
Content you do not have the right to share
Pirated software, films, music, courses, ebooks or paid assets. "I found it elsewhere" is not a right to redistribute it.
Illegal content
Anything illegal where you are or where your visitors are. Child sexual abuse material is reported to the relevant authorities and the link is removed immediately and permanently.
Harassment and endangerment
Doxxing, targeted harassment, threats, or content that puts a person at risk. Also: IP-logger destinations, which exist to capture a visitor's address and location without their knowledge.
Adult content with no warning
Adult material must be clearly labelled in the title or description so a visitor knows before they start. An unlabelled one is removed.
Automated and bulk creation
Scripted link creation, evading rate limits by rotating addresses, or generating links in bulk for a spam campaign. The limits are 40 links per day per address and 8 steps per link; a creator will never notice them.
The grey areas, decided
URL shorteners as a destination
Allowed, but flagged for review. Pointing a locker at a shortener hides the real destination from your visitor and from us, which is what an abuser wants — and also how a lot of honest creators share files. So it is permitted and it moves the link up the review queue. Where you can, link directly.
Chains of lockers
Not allowed. A Keyway link cannot point at another Keyway link; it is refused at creation. Pointing at a different link locker to build a chain is against this policy — each additional gate is friction your visitor did not agree to.
Requiring a subscribe
Not possible, and not permitted to imply. Social steps in Keyway are visits, and the unlock page says so. Do not write a label or a note that claims a subscription is required or has been verified. Beyond being untrue, incentivised engagement breaks the rules of every platform involved — see the social steps page.
Paid content behind a free-looking link
Allowed if honest. Pointing at your own store or membership is fine. Presenting a purchase page as a free download is deceptive and is removed.
Collecting emails at the destination
Allowed at the destination; never inside a step. Keyway has no email step and will not add one. What your own page does after the visitor arrives is between you and them — and subject to your own privacy obligations.
What happens when a link breaks these rules
- A report is filed, or a heuristic flags the link at creation. Neither disables anything on its own.
- A person reviews it. Report volume never triggers an automatic takedown — that mechanism is trivially weaponised against a competitor.
- If it breaks the rules, the link is disabled. Visitors see a safety notice and are not forwarded anywhere. The action and its reason go into the audit trail.
- Serious cases also block the destination domain, preventing future links to it. Existing links to that domain are reviewed individually rather than removed wholesale.
- You can appeal. Emailabuse@subtounlock.app with the slug. We read appeals and we do reverse mistakes.
To report a link, use the report form or the button at the bottom of any unlock page. No account and no email address required.