Acceptable Use and API Policy

1. Coverage

This policy applies to Vorlaxen web clients, the versioned platform API and any credentials or integrations issued for them. Administrative endpoints and permissions are restricted to authorised operators and are not public developer interfaces.

2. Prohibited activity

• Illegal, fraudulent, deceptive, infringing, harassing or privacy-invasive activity.
• Credential theft, unauthorised access, vulnerability exploitation or attempts to obtain another user’s data.
• Malware, denial-of-service activity, automated abuse, spam or circumvention of rate limits and access controls.
• Reverse engineering intended to defeat security, scraping contrary to an expressed restriction, or falsifying request identity.
• Using personal data obtained through the service without an independent lawful basis and appropriate notice.

3. API responsibilities

Clients must protect credentials, request only necessary access, validate responses, handle errors and revocation safely, and avoid embedding secrets in public software. Undocumented behaviour must not be treated as a stable contract.

Vorlaxen may apply proportionate rate limits, revoke compromised credentials and restrict abusive traffic. Security research should stop before accessing, altering or exfiltrating real user data and should be reported to hello@vorlaxen.com.

4. Enforcement

Potential violations may result in traffic restriction, credential revocation, account suspension or lawful reporting. Decisions will consider severity, repetition, user safety and available evidence. Mandatory appeal or complaint rights remain unaffected.