Acceptable use

normalbrowser makes automation harder to distinguish from a human. That capability is useful for QA against your own fraud controls, for research, for accessibility and availability monitoring, and for collecting public information at reasonable rates. The same capability is useful for things we will not be part of. This page says which is which, so nobody has to guess and so we have something concrete to point at when we cancel a license.

What this is for

• Testing and automating systems you own, or that you have written permission to access.
• Authorised security work: penetration tests, red-team engagements and bug-bounty programmes within the published scope.
• Evaluating your own bot defences, the intended case. If you run a detection stack, this is how you find out what it misses.
• Academic and industry research into fingerprinting and detection.
• Monitoring and collecting publicly available information at a rate that does not degrade the service you are collecting it from.

What it is not for

These are grounds for immediate cancellation without refund, and where the law requires it, for reporting.

• Account takeover and credential attacks. Credential stuffing, password spraying, brute forcing, or signing in to accounts that are not yours.
• Fraud. Payment fraud, chargeback fraud, fake reviews, fake engagement, manufactured traffic, or misrepresenting a machine as a person where that misrepresentation is the point of the transaction.
• Bypassing access controls you were never granted. Defeating a paywall, a licence check, or an authentication system belonging to someone else.
• Denial of service. Traffic volumes intended to degrade or exhaust a target, however distributed.
• Harassment and surveillance of individuals. Including scraping targeted at a private person, and evading a block that a person or platform has put in place against you.
• Circumventing sanctions or export controls, or operating on behalf of an entity subject to them.
• Collecting personal data without a lawful basis, or in breach of a data-protection regime that applies to you.
• Material involving minors, non-consensual intimate imagery, or content that is illegal to possess or distribute in any jurisdiction you or we operate in.

Where it is genuinely unclear

Some legitimate work sits near the line, and we would rather discuss it in advance than discover it afterwards. Competitive price monitoring, ticketing, sneaker releases and large-scale account creation are all things people ask about. Some of it is lawful in some places and a breach of contract in others, and terms of service are not the same thing as law.

Our position: we do not police your contracts with third parties, and we do not pretend that a site's terms of service are criminal law. But we will not help with a use whose purpose is to defraud someone, and we reserve the right to decline a customer without giving a detailed reason. If you are unsure, write to support@normalbrowser.com before you buy, a clear answer costs us both less than a cancelled license.

How this is enforced

Honestly: mostly it is not, because we cannot see what you do. The browser runs on your machine and connects to your targets through your proxies. We receive license key checks and nothing else, no URLs, no page content, no credentials. See the privacy page for exactly what that request contains.

What that means in practice is that enforcement happens when something reaches us from outside: an abuse report, a legal request, a payment dispute, or a customer telling us what they are doing. When it does, we cancel the license. We are stating this plainly rather than implying a monitoring capability we do not have, because a policy that overstates its own enforcement is not a policy, it is a marketing line.

Reporting abuse

If you believe someone is using this product against your systems, write to support@normalbrowser.com with the detail you can share, timestamps, addresses, request patterns. We will act on credible reports, and we will tell you what we did.