Legal & Policies (Beta)

Limited beta version. Operator: Arui, individual developer. Contact: aruimanju@foxmail.com.

[LIMITED BETA VERSION] Limited public beta; for the limited beta and revised before commercial launch. Operator: Arui, individual developer, contact: aruimanju@foxmail.com.

1 Service: creator-hosted bot platform. Beta grants free trial credits; no real charges; payments in provider test mode.
2 Accounts: email+password (verification required); registration IP recorded (abuse/fraud control); device list & force-logout available; export & deletion rights.
3 Use: follow the AUP; calls billed at the bot price (beta credits); failed calls fully refunded; usage guardrails apply.
4 IP: your input is yours; bot implementations belong to creators; platform takes anti-copy measures but does not promise absolute secrecy.
5 Liability: beta "as is", no warranties; bot output is creator-generated; no indirect damages; liability capped at amounts actually paid in the last 12 months (beta: 0).
6 Deletion: request in Settings, 7-day cooling-off (cancellable); then deletion/anonymization per the Privacy Policy (ledger/audit de-identified); creator deletion delists their bots.
7 Changes: announced revisions; continued use = acceptance; serious violations ban-able (appealable).
8 Law: operator is an individual; jurisdiction: the law of the operator's place of residence.

[LIMITED BETA VERSION] Operator: Arui, individual developer, contact: aruimanju@foxmail.com.

Collected (as implemented): email/password hash (Argon2); registration IP & subnet; device records (IP/UA, Redis 7d); conversation content (until deleted); usage records (tokens/cost, no content); ledger & top-ups (append-only); API keys (hash+prefix); invite records; audit logs; email tokens (24h/30min expiry).

Third parties (as called): model providers (GLM/DeepSeek/Qwen) — system prompt + bot definition + last-12-turn window + new message; embedding provider (KB chunks only); BYOK — conversations go directly to the chosen provider with the creator's key (OpenAI store:false); E2B sandbox — code package + message/input/history + creator secrets (one-shot sandbox, default-deny egress via platform proxy); tier-3 creator servers — pseudonymous HMAC ID + message (no email; per-domain confirmation); SMTP (recipient + body); Cloudflare Turnstile (token+IP); Stripe test mode (amount metadata only). No analytics/tracking; no data sales.

Cookies: two first-party functional cookies only (session; CSRF). No tracking/ad cookies — no banner needed.

Security: Argon2; hash-only/evelope-encrypted keys; masked logs; SSRF-guarded egress; request bodies never logged.

Rights: export (one-click zip/JSON, 24h link); correction; deletion (7-day cooling-off); reports via bot pages.

Deletion & anonymization: deleted — conversations, keys, KBs, deliveries, code packages, secrets, BYOK, tokens, sessions, exports; anonymized — user skeleton (placeholder email, empty hash, cleared IP/invite code); retained de-identified — ledger/settlements/top-ups (accounting), audit logs (security), invite/promo records (anti-fraud).

[LIMITED BETA VERSION] Consent recorded before first publish.

1 Identity: any registered account; no verification in beta.
2 Content: you retain rights and licence the platform as needed to serve; you warrant ownership & compliance; listings reviewed, violations delisted (appealable).
3 Code bots (tier 2): one-shot sandbox, default no egress, allowlist domains via forced proxy (per-IP SSRF checks); no platform credentials — model calls via one-time capped tokens; secrets envelope-encrypted write-only, output masked; static scan on upload; resource limits enforced, undelivered runs unbilled.
4 Revenue: set your price (locked per version); paid calls pay price − commission (25% today, changes announced); free bots: creator pays model costs (actual usage, pre-auth capped); beta earnings are trial credits; refunded calls earn nothing.
5 Compose: opt-in (default off); other compose bots may call you at your price; disable anytime.
6 Prohibitions: malicious code, mining, attacks, credential access, infringement, credit farming — delist/freeze/ban.
7 Changes: announced revisions bind on continued publishing; account deletion delists bots (beta credits forfeited).

[LIMITED BETA VERSION] Reports & appeals: aruimanju@foxmail.com.

Prohibited: (1) illegal content (CSAM, terrorism, incitement); (2) malware & attacks (including sandbox escape, credential access); (3) fraud & abuse (credit farming, invite abuse, phishing); (4) infringing others' rights (copyright/trademark/privacy; scam deepfakes); (5) high-risk outputs (weapons, controlled substances, forgery); (6) service abuse (guardrail/limit evasion, API reverse-engineering).

Enforcement: report on bot pages (once/UTC-day/user/bot) → auto-pull at distinct-reporter threshold (default 5, tunable) → admin review (dismiss/delist, audited) → appealable; serious violations → account ban.

Cookies: two first-party functional cookies only; no tracking/ad cookies; no banner required.

Authoritative copies live in the repository docs/legal/ directory. BotHub