Addon publisher agreement

This agreement is between you, as the publisher of an addon, and the operator of Prototype. You accept it once per listing, and again whenever we publish a new version of these terms.

You accept it on behalf of your organisation. If you are not authorised to bind your organisation, do not publish a listing.

You keep every right in your addon. We claim no ownership of your code, your brand, or anything your addon produces.

You grant us a licence to display your listing, your name, and your description in the marketplace and anywhere we promote it. You can withdraw that licence by unpublishing.

You confirm you have the right to publish what you publish, including any trademark or image in your listing.

Do not request scopes your addon does not use. Ask for the narrowest set that works.

Do not use data you receive for anything the authorising organisation would not expect. In particular, do not sell it, and do not use it to train a model.

Do not attempt to reach data outside the scopes you were granted, probe for other organisations' data, or work around a rate limit.

Do not impersonate Prototype, imply we endorse you, or use our name in a way that suggests your addon is official.

Do not publish anything unlawful, misleading, or designed to deceive the person authorising it.

Treat tokens and signing secrets as credentials. Store them encrypted, never in client-side code, and never in a public repository.

Use a token only for the addon it was issued to.

Tell us within 72 hours if a token, a secret, or organisation data you hold is exposed. Use the contact address on your listing so we can reach you.

Delete organisation data you no longer need, and delete it when a grant is revoked.

You are the controller of what you copy out of Prototype. Your own privacy obligations to that data are yours, not ours.

Keep a working contact address on the listing. We use it to tell you when your addon is failing or when we have to act on a report. An address that bounces is grounds for suspension.

Keep the description honest about what the addon does with the data it reads.

Tell us if you stop maintaining the addon, so we can mark it and stop new organisations adopting it.

We can remove or suspend any listing at any time, with or without notice, including where we believe it is unsafe, misleading, abusive, unmaintained, or in breach of this agreement.

We will tell you why where we reasonably can, and you can ask us to reconsider.

Suspension removes the listing and revokes its grants. It does not by itself delete data you already hold, which stays your responsibility to delete.

Listing an addon is not an endorsement, an audit, or a security review. The Verified badge means we checked who you are, not that we checked what your code does.

Organisations authorise you directly. What happens on your servers is between you and them.

You indemnify us against claims, losses, and costs arising from your addon, your use of organisation data, or your breach of this agreement.

Our total liability to you under this agreement is limited to the greater of the fees you have paid us in the preceding 12 months, or nothing, because publishing is free.

Nothing in this agreement excludes a right that cannot lawfully be excluded, including consumer guarantees under Australian Consumer Law.

We can change these terms. A materially adverse change takes effect 30 days after we tell you, and you will be asked to accept the new version before your next publish.

You can end this agreement by unpublishing your listings. We can end it by removing them.

The security, liability, and indemnity clauses survive.