Acceptable Use Policy

1. The short version

• Use the Service lawfully, on data you have the right to submit.
• Keep direct identifiers and sensitive data off the event stream; use the supported mechanisms for identity and special-category data.
• Don’t distribute malware, don’t mislead people with your links or messages, don’t probe what isn’t yours.
• When something looks wrong, tell us: [email protected].

2. Prohibited data

The event stream — track() and screen() events, crash and performance context, session data — is designed to carry pseudonymous data only, and the Service enforces that server-side: an event carrying a field the platform classifies as identifying is rejected, not quietly cleaned. The SDKs additionally drop a short list of obvious identifying key names from track() properties as a convenience — a courtesy, not a filter you may rely on, and it does not cover screen views, crash or performance context, or data you attach elsewhere. These safeguards are defense in depth, not permission: you must not submit the following to the event stream at all:

• direct identifiers — names, email addresses, phone numbers, physical addresses;
• government-issued identification numbers (Social Security, passport, driver’s license, or equivalents);
• payment-card or financial-account data (PAN, CVV, bank account numbers);
• authentication secrets — passwords, API keys, tokens, private keys;
• special-category data — health information, biometric or genetic data, and data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, sex life, or sexual orientation;
• precise geolocation, or any continuous location tracking of an identified person.

The following additional restrictions apply throughout the Service:

• Protected health information regulated under HIPAA. We do not offer a business associate agreement; do not submit PHI created or received by or for a HIPAA-covered entity.
• Children’s data. Do not use the Service with an App directed to children under 13, and do not knowingly submit personal data of children under 13, without our prior written agreement. Where your App serves minors at all, compliance with children’s-privacy law (COPPA and its equivalents) is your responsibility.

3. Abuse of the platform

• No unlawful use, and no content or data that infringes anyone’s rights.
• Identity: do not misrepresent who you are, whom you act for, or your authority to act for them.
• Distribution: no malware, spyware, or deceptive software through the Service’s build-distribution infrastructure; distribute only builds you have the right to distribute, signed under credentials you are entitled to use.
• Links: no phishing, no misleading destinations, and no link-cloaking of prohibited content through the Service’s link infrastructure.
• Plans and trials: do not split one App’s use across organizations or trials, or disguise your use, to evade an allowance, a usage limit, or a charge. Reducing or sampling what your Apps send is not evasion or circumvention under this AUP.
• Messages: if you deliver communications to End-User devices through the Service, no spam, no deception about the sender or purpose, and honor opt-outs. Compliance with messaging and electronic-communications law is yours.

4. Security & integrity

• Do not attempt to access another customer’s data, probe or test the Service’s isolation against data that is not yours, or interfere with the Service or other customers’ use of it.
• Do not circumvent rate limits, quotas, consent enforcement, or other technical safeguards, and do not falsify the origin of data you submit.
• Do not share, sell, or misuse credentials, and do not resell or provide the Service to third parties as a service bureau without our written agreement.
• Good-faith security research is welcome when it is performed against your own organization and data, respects rate limits and other users, and is reported to [email protected] before public disclosure. We confirm receipt within five business days, a person follows up, and we agree a disclosure timeline with you; absent agreement, 90 days from your report is reasonable. Research within those bounds will not be treated as a breach of the Terms, and we will not bring or support legal action against you for it — including under the Computer Fraud and Abuse Act or analogous computer-crime laws — nor ask that you be prosecuted. Anything beyond those bounds — including any test that touches data that is not yours — requires our prior written permission. Good-faith security research on the Software (Terms Section 8), reported to [email protected] before disclosure, is treated the same way.

Hosted testing. Load, stress or capacity testing of the Service, or another test reasonably likely to disrupt it or affect other users, requires our prior written permission. The agreed plan must identify authorized targets, organizations and accounts, the time window and duration, aggregate traffic and concurrency caps across all participating workers, apps, environments and credentials, and stop conditions and a means to stop promptly. Respecting a published or per-client rate limit alone is not permission or assurance of capacity. Stop when an agreed condition occurs or we direct a stop to protect the Service. Permission for one plan covers no different targets, scope or window.

Lawful offline Software research and ordinary nondisruptive testing of your App within its existing permissions require no additional hosted-test permission. The research protection does not override anti-disruption rules or technical safeguards. We may proportionately throttle, suspend or stop affected hosted activity under Terms Section 18, with its notice and restoration duties. Protective action does not itself make otherwise protected lawful research a breach or revoke our promise not to bring or support legal action for it. Nothing here conditions mandatory statutory rights on advance permission or authorizes access to another person’s data.

5. Copyright complaints

The Service hosts builds our customers upload and serves install pages and links for them. If you believe material distributed through the Service infringes your copyright, send a notice with the substance of 17 U.S.C. § 512(c)(3) — identification of the work, the location of the material, your contact details, the required good-faith and accuracy statements, and your signature — to our designated agent under 17 U.S.C. § 512(c)(2):

Copyright Agent, Pharen
1315 NW Mall St Ste 1, Issaquah, WA 98027, USA
Phone: +1 425 502 5164
Email: [email protected]

The same details are on file in the U.S. Copyright Office’s DMCA Designated Agent Directory. On a valid notice we disable access to the material and notify the customer who distributed it; we accept counter-notices and restore material where the law provides; and we terminate the access of repeat infringers in appropriate circumstances.

6. Enforcement

Violations are handled under the Terms (Section 18): where suspension is necessary we suspend the narrowest slice practicable, with notice where practicable, and Section 18 states how a suspension of ingestion is signaled and what the SDKs keep while it lasts. Material violations of Section 2 or 4, and materially false information about who you are, whom you act for, your authority to act for them, or the authority of the person who accepted the Terms or an Order for you (Section 3 and Terms Section 18), may lead to immediate suspension or termination only on the grounds Section 18 permits, subject to its notice and cure requirements. To report abuse of the Service — including a link or build you believe is malicious — contact [email protected].