# Spam guard

> Limits per network, the spam filter, a harder check in a surge, blocked visitors and the «Possible spam» folder.

Someone may flood your chat: write from a hundred incognito tabs, paste ads, or try to spend the company's monthly limit of AI conversations. The «Spam guard» block in the project's «Project» section sets what the chat does about it. Owners and admins of the company change these settings; operators open «Project» read-only, block visitors from the inbox and lift blocks. Nothing is ever deleted: a conversation the guard holds back waits in the inbox under «Possible spam».

Our cloud has its own guards in front of every project, the same for everyone: a challenge at the network's edge during a flood, a short proof of work before every new conversation, and limits on how fast one address may write. The settings below are yours, on top of them.

## The settings
| Setting | Default | What it does |
|---|---|---|
| Hide spam | On | A message the classifier is sure is spam (ads, gibberish, an attempt to make the bot ignore its rules) gets a short «nothing in the rules answers this». No person is called, no model writes an answer, nothing is charged. The conversation goes to «Possible spam». A rude or angry customer is not spam: they still get an answer |
| Harder check in a surge | On | When new conversations come ten times faster than in the project's busiest hour of the week (and at least 30 an hour), the visitor's browser does 3–4 seconds of extra work before the first message, while they type. Nobody is refused, so a newsletter that brings a crowd costs no answers |
| Trust visitors your site signed | On | A customer your site signs in the chat ([Visitor identity](https://tolkly.io/docs/en/identity.md)) skips the per-network limits and the spam filter: their account on your site already exists |

## Limits
Under «Advanced: limits». A network is a block of addresses one home, office or hosting customer usually holds (IPv4 /24, IPv6 /48), so a hundred incognito tabs are one network. 0 turns a limit off.

| Limit | Default | Past it |
|---|---|---|
| AI conversations an hour from one network | 20 | People answer, as when the monthly limit is spent. Nothing is charged |
| Conversations for people an hour from one network | 5 | The conversation still reaches the inbox, under «Possible spam», without a Telegram topic. The group gets one summary an hour instead of a topic per conversation |
| AI conversations a day | A tenth of the company's monthly limit (100 of 1 000) | People answer until the day's count drops. A flood spread over many networks spends a tenth of the month a day, not the whole month in an hour. Leave it empty for automatic |
| Block the address for | 24 hours | See [Blocking](#block) |

A conversation the bot answered with a source counts; a refusal or spam does not.

## «Possible spam»
The inbox lists the folder under the other views while it holds anything. A conversation lands there when it went past «Conversations for people», when the classifier was sure it is spam, or when its visitor is blocked. It is in no other view, gets no Telegram topic and plays no sound. Open it and press «Not spam» to bring it back: if it waits for a person, its topic opens in Telegram then.

## Blocking
In a conversation's menu, «Block the visitor». From then on the chat refuses the visitor's messages and files and tells them it no longer takes their messages, so a person blocked by mistake knows to reach you another way. Their conversations go to «Possible spam».

A block holds the visitor's chat on that browser and, if your site signed them, their account, until someone unblocks them. It holds their address only for the hours set in «Block the address for», since a mobile operator puts thousands of people behind one address. A new incognito tab from the same address is blocked for those hours too.

Every block is listed in «Project», in the «Blocked visitors» block, with who blocked and when. Any member of the team unblocks, there or in the conversation's menu.