Acceptable Use Policy

The rules for permitted and prohibited use of SnitchOS.

Effective September 8, 2026

References to a managed service provider and its “Client Tenants” cover a company using SnitchOS for its workforce: it becomes the Customer, its tenant the Client Tenant.

1. Parties and definitions

SnitchOS is a product of OS Labs Inc, 705 Lakeview Plaza Blvd, Columbus, OH 43085, United States (“SnitchOS”, “we”, “us”). The managed service provider licensing it is the Customer; its downstream clients are Client Tenants; and the employees and contractors on monitored company-owned devices are Monitored Users.

For monitored endpoint data, the Customer and its Client Tenant act as data controller, SnitchOS as data processor, on the Customer's documented instructions. This policy binds the Customer, anyone it authorizes to administer SnitchOS, and every Client Tenant it onboards; the Customer is responsible for the acts and omissions of people it grants access.

2. Permitted use

SnitchOS is built for one purpose: giving an MSP and its Client Tenants visibility into how company-owned, managed Windows endpoints are used at work. Permitted use requires all of the following.

2.1 Eligible devices

  • The device is company-owned or company-controlled, managed by the Customer or its Client Tenant.
  • The device is used by an identified Monitored User in an employment or contractor relationship.
  • The agent is deployed through a legitimate channel, an RMM, Microsoft Intune, or Group Policy, under the Customer's administrative authority.

2.2 Lawful notice and a lawful basis

Before monitoring a Monitored User, the Customer or its Client Tenant must have a lawful basis and provide any notice or obtain any consent applicable law requires: New York, Connecticut, and Delaware, for example, require advance written notice of electronic monitoring. Under the GDPR, it must identify a lawful basis and meet staff-transparency duties; under US state laws like the CCPA/CPRA, it must honor notice and rights owed to personnel.

2.3 A legitimate business purpose

Monitoring must serve a legitimate, proportionate purpose: productivity measurement, security, resource planning, attendance, or compliance evidence. Data produced may be used only for those purposes, within the tenant collected.

3. Prohibited uses

You must not use SnitchOS, or permit anyone else to, for any of the following.

3.1 Monitoring personal or unauthorized devices

Do not install the agent on a personal, BYOD, or other device outside the Customer's or Client Tenant's administrative control.

3.2 Covert or undisclosed monitoring where notice is required

Do not use SnitchOS to monitor people secretly where the law requires notice or consent; surveilling staff without legally required notice, or hiding the agent’s presence to defeat it, is prohibited.

3.3 Unlawful discrimination or retaliation

Do not use SnitchOS data to unlawfully discriminate against, harass, or retaliate against any person for a protected characteristic or protected activity such as organizing, whistleblowing, or exercising a legal right, or to target lawful off-duty conduct where prohibited.

3.4 Attempting to capture what the product deliberately excludes

SnitchOS records input counts only and does not intentionally extract the content excluded in Section 4. Do not attempt to defeat the product's collection limits or pair it with a keylogger or other extraction tool.

3.5 Circumventing tenant isolation

Do not access, correlate, or export data belonging to another tenant, or bypass the row-level, object-storage, or API scoping that separates tenants; do not view data for any Client Tenant you lack access to, or use the service to build a cross-tenant profile of any individual.

3.6 Reselling or exporting data unlawfully

Do not sell, rent, or transfer Monitored User data to a third party except as the employment relationship and applicable law allow, or export personal data across borders without a valid transfer mechanism, for example appropriate Standard Contractual Clauses where the GDPR applies; exports remain subject to this policy.

3.7 Interfering with the service or its security

Do not:

  • Probe, scan, or penetration-test the SnitchOS infrastructure without SnitchOS's prior written authorization.
  • Gain unauthorized access to any account, tenant, host, or backend, or share admin credentials or Microsoft Entra or Google sign-in sessions.
  • Take action that degrades, overloads, or disrupts the service, including automated traffic that exceeds documented limits.
  • Upload malware, or use the service to stage attacks on third parties.
  • Remove or obscure proprietary notices, or use the service in violation of export-control or sanctions law.

4. What the product will not do

Several limits above are enforced by the product, not only policy, as part of how SnitchOS is designed to be used responsibly.

  • Counts, not content. Input is measured as keystroke_count, mouse_click_count, and mouse_distance_px. Keys pressed are never recorded and never leave the endpoint.
  • A visible service. The agent runs as SnitchOSAgent and appears in Task Manager and services.msc; it is not hidden or designed to be undetectable.
  • Admin-uninstallable. A local administrator can remove the agent with msiexec /x {ProductCode}, locally or as an RMM uninstall job. There is no remote uninstall: the dashboard’s retirement action tells the endpoint to stop collecting and does nothing else, so removal is always the installer. The agent is installed as a system component, so it is removed with msiexec /x rather than Settings → Apps. SnitchOS is not a rootkit and is not tamper-proof against the device’s administrator, because MSPs need that for support.
  • No typed or stored-content extraction. Clipboard, file, message, audio, webcam, and password data are not extracted. Website records keep scheme, host, and path only; query strings and fragments are stripped. Screenshots and metadata can still display sensitive information.

5. Consequences of violation

If SnitchOS reasonably believes this policy has been violated, we may take action proportionate to the violation, including the following.

  • Requesting information and a remediation plan from the Customer.
  • Suspending or throttling access to affected tenants, accounts, or features.
  • Removing or disabling specific content, rules, or configurations.
  • Suspending or terminating the account or agreement under the Terms of Service.
  • Preserving records and cooperating with lawful requests from courts or regulators.

Where a violation creates imminent risk to the service, other tenants, or individuals, SnitchOS may act first and notify the Customer promptly. A violation by the Customer, its personnel, or a Client Tenant does not relieve it of obligations under the agreement, including indemnification. Nothing here limits any remedy available to SnitchOS at law or under the Terms of Service.

6. Reporting abuse

If you believe SnitchOS is used in violation of this policy, report it to the SnitchOS contact form with the tenant, account, and enough detail to investigate. We review reports promptly and take appropriate action. Monitored Users with questions about their employer’s SnitchOS use should raise them with their employer, the data controller; we can direct genuine abuse reports to the right contact.

7. Changes to this policy

We may update this policy as the product, the law, or our practices change. A material change updates the effective date, and continued use after it takes effect means acceptance. This policy works alongside our Privacy Policy, Data Processing Addendum, and Terms of Service; where they conflict, the Terms govern.

8. Contact

For questions about acceptable use, or to report a suspected violation:

SnitchOS is a product of OS Labs Inc, 705 Lakeview Plaza Blvd, Columbus, OH 43085, United States.