diff --git a/deno.json b/deno.json
index 7581193..063a776 100644
--- a/deno.json
+++ b/deno.json
@@ -13,7 +13,7 @@
   "exclude": ["./public"],
   "imports": {
     "@/": "./src/",
-    "@nostrify/nostrify": "jsr:@nostrify/nostrify@^0.9.7",
+    "@nostrify/nostrify": "jsr:@nostrify/nostrify@^0.12.1",
     "~/fixtures/": "./fixtures/",
     "hono": "https://deno.land/x/hono@v3.10.1/mod.ts",
     "hono/middleware": "https://deno.land/x/hono@v3.10.1/middleware.ts",
diff --git a/src/pipeline.ts b/src/pipeline.ts
index 56d7bb2..83fd4f5 100644
--- a/src/pipeline.ts
+++ b/src/pipeline.ts
@@ -22,6 +22,16 @@ import { nip05Cache } from '@/utils/nip05.ts';
 
 const debug = Debug('ditto:pipeline');
 
+let UserPolicy: any;
+
+try {
+  UserPolicy = (await import('../data/policy.ts')).default;
+  debug('policy loaded from data/policy.ts');
+} catch (_e) {
+  // do nothing
+  debug('policy not found');
+}
+
 /**
  * Common pipeline function to process (and maybe store) events.
  * It is idempotent, so it can be called multiple times for the same event.
@@ -32,6 +42,14 @@ async function handleEvent(event: DittoEvent, signal: AbortSignal): Promise<void
   debug(`NostrEvent<${event.kind}> ${event.id}`);
   await hydrateEvent(event, signal);
 
+  if (UserPolicy) {
+    const [_, _eventId, ok, reason] = await new UserPolicy().call(event, signal);
+    if (!ok) {
+      const [prefix, ...rest] = reason.split(': ');
+      throw new RelayError(prefix, rest.join(': '));
+    }
+  }
+
   await Promise.all([
     storeEvent(event, signal),
     parseMetadata(event, signal),