Acceptable Use Policy

1. Prohibited content

Products listed on the Quox Marketplace must not contain, distribute, or facilitate any of the following:

1.1 Malicious software

• Malware, viruses, trojans, worms, or any other malicious code
• Spyware, keyloggers, or surveillance software
• Cryptocurrency miners or any software that uses computing resources without explicit user consent
• Ransomware or any software that restricts access to data or systems for payment
• Software with hidden or undisclosed functionality
• Backdoors, remote access tools, or any undisclosed communication channels

1.2 Illegal content

• Content that violates UK law or the laws of any jurisdiction where the Product is distributed
• Child sexual abuse material (CSAM) or any content that sexualises minors
• Content that promotes or facilitates terrorism or violent extremism
• Content that infringes third-party intellectual property rights (copyright, trademarks, patents, trade secrets)
• Content that facilitates fraud, identity theft, or financial crime

1.3 Harmful content

• Hate speech or content that promotes discrimination based on race, ethnicity, religion, gender, sexual orientation, disability, or national origin
• Content that promotes or facilitates gambling in jurisdictions where it is illegal or unlicensed
• Content that promotes or facilitates the sale of controlled substances, pharmaceuticals, or regulated goods without appropriate licences
• Content that promotes self-harm, violence, or harassment
• Deliberately misleading content designed to deceive users

2. Prohibited behaviour

Developers and End Users must not engage in the following conduct on or through the Marketplace:

2.1 Marketplace manipulation

• Manipulating reviews, ratings, or download counts (including purchasing, incentivising, or exchanging reviews)
• Creating fake or duplicate accounts to inflate metrics or circumvent enforcement actions
• Misrepresenting Product capabilities, features, or compatibility in listings
• Engaging in drip pricing or hidden charges not disclosed in the Product listing

2.2 Security violations

• Circumventing, disabling, or interfering with Quox's security measures, access controls, or authentication systems
• Attempting to gain unauthorised access to Quox's systems, networks, or other users' accounts or data
• Scraping, crawling, or automated extraction of data from the Marketplace beyond what is permitted by the Quox API
• Reverse engineering, decompiling, or disassembling any part of the QuoxCORE platform or its proprietary components

2.3 Competitive and deceptive practices

• Developing Products that replicate core QuoxCORE functionality without disclosure in the Product listing
• Collecting user credentials, payment information, or authentication tokens outside of Quox's designated systems
• Impersonating Quox, its employees, or other Developers
• Using the Marketplace to promote or redirect users to competing platforms without disclosure

3. Technical requirements

All Products listed on the Marketplace must comply with the following technical requirements. These requirements exist to protect the security, performance, and stability of the QuoxCORE platform and its users.

3.1 API usage

• Products must use the official Quox Plugin API exclusively. Direct access to internal QuoxCORE APIs, services, or databases is prohibited.
• Products must not access localStorage, cookies, or browser storage outside their assigned namespace.
• Products must not use eval(), Function() constructor, or dynamic imports that bypass the Plugin API sandbox.

3.2 Network and resource constraints

• Products must not make direct external network requests. All external communication must use the collector proxy provided by the Plugin API.
• Frontend bundle size must not exceed 100KB of JavaScript (compressed). Total asset size (including images, fonts, and other resources) must not exceed 5MB.
• Backend containers (where applicable) are limited to 256MB RAM and 0.5 CPU cores. Products that exceed these limits will be throttled or terminated.

3.3 Code quality

• Products must not introduce memory leaks, excessive CPU usage, or other resource exhaustion patterns.
• Products must handle errors gracefully and must not cause crashes in the host QuoxCORE environment.
• Products must not modify, override, or monkey-patch global objects, prototypes, or shared resources outside their namespace.

4. Data handling

Developers must comply with all applicable data protection laws, including UK GDPR, when handling user data through their Products.

4.1 Data collection and permissions

• All data collected by a Product must be declared in the Product manifest. Products must not collect data beyond the permissions declared in the manifest.
• Products must obtain appropriate consent before collecting, processing, or storing personal data.
• Products must provide users with clear information about what data is collected and how it is used, in accordance with the Developer's privacy policy.

4.2 Data minimisation

• Products must collect only the minimum data necessary for their stated functionality.
• Products must not collect, store, or transmit user data for purposes unrelated to the Product's core functionality (including selling data to third parties or using it for advertising).

4.3 Data deletion

• When a user uninstalls a Product and requests data deletion, the Developer must delete all user data associated with that user within 30 days.
• Developers must provide a mechanism for users to request deletion of their data, as required by UK GDPR.

4.4 Data transfers

• If user data is transferred outside the United Kingdom, appropriate safeguards must be in place (such as Standard Contractual Clauses or adequacy decisions).
• All sub-processors used by the Product must be disclosed in the Developer's privacy policy.

5. Security requirements

Developers are responsible for the security of their Products and must adhere to the following requirements:

5.1 Credential management

• Products must not contain hardcoded credentials, API keys, tokens, passwords, or secrets of any kind in source code, configuration files, or bundled assets.
• All credentials must be managed through the Quox Plugin API's secure configuration system or the Developer's own secure backend.

5.2 Data protection

• Products must not exfiltrate data from the user's Quox workspace to external systems without explicit user consent and disclosure in the Product manifest.
• All backend services operated by the Product must use HTTPS (TLS 1.2 or later) for communication.
• Products must encrypt sensitive data at rest and in transit.

5.3 Vulnerability response

• Developers must respond to security vulnerability reports within 48 hours of notification.
• Critical vulnerabilities (those that could lead to data breach, remote code execution, or privilege escalation) must be patched within 7 days or the Product will be suspended from the Marketplace.
• Developers must maintain a security contact (email address) displayed on their Developer profile.

6. Enforcement

Quox reserves the right to enforce this AUP at its sole discretion. Enforcement actions are proportionate to the severity of the violation.

6.1 Enforcement actions

Depending on the nature and severity of the violation, Quox may take one or more of the following actions:

• Warning: A written notice identifying the violation and requiring remediation within a specified period (typically 7 days).
• Suspension: Temporary removal of the Product from the Marketplace and/or temporary suspension of the Developer's account. The Developer may remedy the violation and request reinstatement.
• Termination: Permanent removal of the Product from the Marketplace and termination of the Developer's account.
• Permanent ban: Permanent prohibition from the Marketplace, including all associated accounts and entities.

6.2 Automatic review triggers

Three or more user reports against a Product within a 30-day period will trigger an automatic review of the Product by the Quox Marketplace team. During this review, the Product may remain available unless the reports indicate a critical security or safety concern.

6.3 Kill switch

For critical violations that pose an immediate risk to user safety, data security, or platform integrity, Quox reserves the right to immediately disable a Product across all installations without prior notice. This includes, but is not limited to, confirmed malware, active data exfiltration, or exploitation of security vulnerabilities.

6.4 Revenue and commissions

No refund of commissions will be issued for Products removed due to AUP violations, unless the Developer is subsequently found not to be in breach. Pending payouts may be withheld to cover refund obligations to affected End Users.

6.5 Appeals

Developers may appeal enforcement actions by contacting [email protected] within 14 days of the action. Appeals will be reviewed within 10 business days. The decision on appeal is final.

7. Reporting violations

7.1 How to report

If you believe a Product or Developer is violating this AUP, you can report the violation through any of the following channels:

• In-app: Use the "Report" button on the Product listing page in the Marketplace.
• Email: Send a detailed report to [email protected], including the Product name, Developer name, and a description of the violation.
• Security vulnerabilities: For security-specific reports, email [email protected]. If the vulnerability is critical, please mark the subject line as "URGENT."

7.2 Response timeline

• Acknowledgement: All reports will be acknowledged within 2 business days.
• Initial assessment: An initial assessment will be completed within 5 business days of acknowledgement.
• Resolution: Non-critical violations will be resolved within 14 business days. Critical security or safety violations will be addressed immediately (see Section 6.3).
• Reporter updates: The person who submitted the report will receive an update on the outcome once the investigation is complete.

7.3 Confidentiality

Reports are treated confidentially. The identity of the reporter will not be disclosed to the Developer unless required by law or with the reporter's consent.

8. Governing law

This AUP shall be governed by and construed in accordance with the laws of England and Wales. Any disputes arising from or relating to this AUP shall be subject to the exclusive jurisdiction of the courts of England and Wales.

9. Modifications

We may update this AUP from time to time. We will provide at least 30 days' notice of any material changes by posting the updated policy on the Marketplace and notifying affected Developers by email. The updated policy will indicate the new "Last updated" date at the top of this page.

10. Contact

For questions about this Acceptable Use Policy, please contact us:

Email: [email protected]
Abuse reports: [email protected]
Security reports: [email protected]
Address: Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom