VoxaraRules for bots, webhooks and the API
Bots are accounts driven by code. They get the same access a member gets, so the person running one is held to the same standard as a person, plus the points below.
1. You are responsible for your bot
- A bot acts under the account that created it. Everything it posts, deletes, moderates or sends is yours. The Community Guidelines apply to it in full.
- Keep tokens secret. A bot token or a webhook URL is a credential; treat it like a password, keep it out of source code and public repositories, and reset it in the portal the moment you suspect it has leaked.
- Bots are marked BOT everywhere and cannot pretend to be people. Do not build a bot that hides that it is automated.
2. Data your bot receives
- A bot sees messages and events in the spaces it is added to, and in direct messages it sends. That data belongs to the people who wrote it.
- Use it only to provide the bot's stated function. Do not store message content beyond what the function needs, do not build profiles of people, and do not sell, share or publish what the bot sees.
- Do not send people's Voxara data to other services without a clear reason that the space's members would expect. If your bot keeps data, delete it when the bot is removed from the space or on request.
- If your bot reaches people outside Voxara (mirrors messages elsewhere, emails people, and so on), say so in the bot's description, and get the space's agreement before adding it.
3. Things a bot must not do
- Spam: unsolicited direct messages, mass mentions, flooding channels, repeated identical posts.
- Evade rate limits or any other restriction. Limits are documented; a bot that hits them backs off.
- Scrape or harvest member lists, profiles or message history for use outside the bot's function.
- Moderate in ways the space's owner has not sanctioned. Moderation abilities come from the roles a space gives your bot; using them against the wishes of that space's owner gets the bot removed and can get the account suspended.
- Impersonate Voxara, another bot or a person; use a name or picture that suggests official status.
- Circumvent the client: do not build a replacement client that lets people sign in with a password through a bot, and do not use bot access to bypass privacy settings (for example to reach someone who has turned off direct messages).
4. Webhooks
A webhook is a one-way URL into one channel. Whoever holds the URL can post there. The same rules apply: no spam, no impersonation, keep the URL secret, reset it if it leaks. Webhooks cannot read anything.
5. What Voxara may do
- Revoke tokens, remove bots from spaces, or delete bots that break these terms or cause trouble for the service, with or without notice depending on severity.
- Change the API. We try to keep changes compatible and to document them, but the service is young and some changes will break things. Build defensively and watch the documentation.
- Apply rate limits and ceilings (numbers are in the documentation) and adjust them as needed.
6. No warranty for the API
The API and SDK are provided as is. We are not responsible for what your bot does, for data your bot loses, or for changes to the API affecting your bot. The disclaimers and limits of liability in the Terms of Service apply.
7. Your code
Your bot's code is yours. Voxara claims no rights in it. The SDK and example bots we publish may be used, copied and modified for building on Voxara without restriction.
8. Contact
Questions about these terms or about a bot: [email protected].