# Carnival content policy Carnival hosts simple, temporary websites: a menu, opening hours, a piano tuner's rates. These rules cover every file, every link and anything your site loads. 1. **Nothing unlawful or harmful.** No child sexual abuse material (we report it to NCMEC). No intimate images shared without consent. No threats, harassment, hate or incitement to violence. No promotion of self-harm. No sale of illegal goods. No content that infringes someone's copyright or trademark. 2. **No phishing, fraud or malware.** No pages that ask for passwords, card or bank details, government ID numbers, one-time codes or crypto-wallet phrases. No fake shops, giveaways or investment schemes. No software downloads, no "paste this into your terminal" tricks and no crypto miners. No redirecting visitors elsewhere, and no hiding what a page does. 3. **No sexually explicit content.** No pornography, no explicit sexual text or images, and no advertising of sexual services. 4. **No impersonation.** Don't pretend to be a person, business, brand, government body or online service you are not. That includes Carnival, Meta and Muse. Mentioning brands you sell, accept or appear on ("order on DoorDash") is fine. Carnival is static-only: no server code, and no secrets such as API keys. ## Enforcement - Rules and AI models check every deploy before it goes live. - Live sites are re-checked, and people review reports. - A deploy that breaks a rule is not published. Your agent gets a reason code, and for a house rule you can fix, the file, line and fix. - We may take any site down, and we suspend accounts for serious or repeated violations. We email you the reason either way. To report a site, go to . If you think we got it wrong, email with the request ID. ## Outcomes Our checks are automated: rules, and AI models that run on Cloudflare. A person reviews every report, and every takedown our checks make on their own. - **Rejected.** The deploy is not published. Your agent gets the error [`CONTENT_REJECTED`](https://carnival-staging.dev/docs/errors/CONTENT_REJECTED.md) with a reason: for a house rule, the rule, file, line and fix; otherwise only the category of what was found. The category `checks_unavailable` means our checks couldn't finish and nothing was judged: your agent can try again a minute later. After 5 rejections in one day (UTC), publishing pauses for 24 hours ([`REJECTION_COOLDOWN`](https://carnival-staging.dev/docs/errors/REJECTION_COOLDOWN.md)). - **Published, then reviewed.** Some deploys go live and are queued for a closer look: checked again, or reviewed by a person. If that finds a rule broken, the site is taken down as below. - **Suspended (410).** The site goes offline, and visitors see that it was taken down (HTTP 410). If our checks took it down on their own, visitors see that it is under review until a person confirms the takedown or puts the site back. A suspension can be reversed on appeal. - **Removed (451).** For legal removals: a copyright notice under the [copyright policy](https://carnival-staging.dev/copyright.md), a request under [Take It Down](https://carnival-staging.dev/take-it-down.md), or a court order. The site goes offline, and visitors see that it is unavailable for legal reasons (HTTP 451). - **Account suspended.** For serious or repeated violations we suspend the whole account: its live sites go offline, its agents are disconnected, and the same email address can't sign up again. We suspend an account for: - child sexual abuse material; - a serious violation, such as phishing, malware, fraud or intimate images shared without consent, on an account less than 7 days old or with an earlier violation; - a third violation within 90 days; - a third copyright strike within 12 months ([repeat infringers](https://carnival-staging.dev/copyright.md#repeat-infringers)). A violation counts once a person has upheld it. A takedown reversed on appeal never counts. Takedown emails link to the entry below for what we found. ### Rule 1: Nothing unlawful or harmful - **Child sexual abuse material.** We aim to remove it within 1 hour and to report it to NCMEC within 24 hours. The account is suspended, the files are kept as evidence as the law requires, and we don't tell the account holder. - **Intimate images shared without consent.** Removed (451) on a request under the US TAKE IT DOWN Act: we aim to within 12 hours, and the law allows 48. Identical copies elsewhere on Carnival are removed too, and the files can't be published again. See [Take It Down](https://carnival-staging.dev/take-it-down.md). - **Copyright infringement.** Removed (451) after a valid notice from the copyright owner. The site's owner can send a counter-notice, and a third strike within 12 months suspends the account. See the [copyright policy](https://carnival-staging.dev/copyright.md). - **Other unlawful or harmful content**: threats, harassment, hate or incitement to violence, promotion of self-harm, sale of illegal goods, trademark infringement. The deploy is rejected, or the site suspended (410). ### Rule 2: No phishing, fraud or malware - **Phishing**: pages that ask visitors for passwords, card or bank details or other secrets under false pretences. The deploy is rejected, or the site suspended (410). - **Fraud**: fake shops, giveaways, investment schemes and other scams. The deploy is rejected, or the site suspended (410). - **Malware**: software downloads, "paste this into your terminal" tricks, crypto miners and other code that harms visitors or their devices. The deploy is rejected, or the site suspended (410). - **Unsafe links**: links to sites, or files loaded from sites, known to be dangerous. We check addresses against Google Web Risk before a site goes live and after. The deploy is rejected, or the site suspended (410). - **House rules**: fixable technical rules, such as no forms that collect passwords, card or bank details, ID numbers or one-time codes, no redirects and no hidden or obfuscated code. A deploy that breaks one is rejected, and your agent gets the rule, file, line and fix. ### Rule 3: No sexually explicit content - **Sexually explicit content**: pornography, explicit sexual text or images, and advertising of sexual services. The deploy is rejected, or the site suspended (410). ### Rule 4: No impersonation - **Impersonation**: pretending to be a person, business, brand, government body or online service you are not. The deploy is rejected, or the site suspended (410). ### Other problems - **Spam**: content made to mislead visitors or search engines, such as hidden text stuffed with keywords. The deploy is rejected, or the site suspended (410). - **Known harmful files**: a file we removed before for breaking this policy. We keep a fingerprint (hash) of files we remove and refuse them in any deploy: a deploy that includes one is rejected, and a live site serving one is taken down. - **Anything else** that breaks this policy or the [terms](https://carnival-staging.dev/terms.md): the site is suspended (410). ## How fast we act When a report reaches us, we aim to: | Report | We aim to | |---|---| | Child sexual abuse material | Remove it within 1 hour, and report it to NCMEC within 24 hours | | Phishing, malware or fraud | Take the site down within 1 hour of confirming the report | | Intimate images (Take It Down) | Remove them within 12 hours; the law allows 48 | | Copyright notice | Act within 1 business day | | Impersonation, sexually explicit content | Act within 2 business days | | Anything else | Act within 3 business days | ## Appeals If you think we got it wrong, reply to the email we sent you, or write to with the request ID your agent got or the site's address. A person reviews every appeal. If we were wrong, we put the site back with the time it had left (if you already have 3 live sites, end one first), and the takedown never counts toward suspending your account. For a copyright removal, send a counter-notice instead: see the [copyright policy](https://carnival-staging.dev/copyright.md#counter-notices).