This is like saying "You have the right to privacy. The police can tap your phone, but you have nothing to worry about as long as you're not breaking the law."

"we're open source, you can use it for anything you can imagine. But you can't use it for these specific things."

Then there's the added rub of the source not really being source code, but a CSV file.

That's fine. If you want to set that expectation, great! But don't call it open source.