ALYT Developer Platform Acceptable Use Policy

In force from 2026-09-04, approved by Fizzify Inc. Adapted from the GitHub Acceptable Use Policies and the GitHub Bug Bounty Program Legal Safe Harbor (github/site-policy, https://github.com/github/site-policy/tree/main/Policies/acceptable-use-policies and https://github.com/github/site-policy/blob/main/Policies/security-policies/github-bug-bounty-program-legal-safe-harbor.md) under CC0 1.0 Universal, with the abuse-reporting paragraph adapted from the 37signals Use Restrictions Policy (https://github.com/basecamp/policies/blob/master/abuse/index.md) under CC BY 4.0. Version: [0.1] Effective date: 2026-09-04

Short version: the sandbox shares hardware with real homes. Do not take more than your share, do not look at anyone else’s, and do not try to reach anything you were not given. Capitalised terms have the meaning given in the Terms of Service.

1. Laws

You are responsible for using the Platform in compliance with all laws that apply to you, including export control, privacy and computer misuse laws.

2. The shared inference

ALYT’s AI inference runs on the same hardware that serves real households. Access to it is approval-gated and quota-limited.

You may not:

1. use it for anything other than developing and testing a Connector or client for ALYT;
2. generate bulk content, run benchmarks, mine data, or resell or proxy access to it;
3. split work across accounts or keys to exceed your quota;
4. send prompts designed to extract system prompts, model weights, other tenants’ data, or to make the model act against ALYT’s policies;
5. send data about a real household to it from the Sandbox unless the household has agreed and your Connector declares it.

We may pause your inference access without notice when households need the capacity.

3. Other tenants

Every developer gets a Sandbox tenant. It is yours; other tenants are not.

You may not:

1. read, enumerate, scrape or probe any tenant, property, room, device or Household other than your own;
2. use information you obtain by accident about another tenant for any purpose, and you must report it (section 8);
3. use a key issued to another Account, or attempt to guess or forge keys, key identifiers or tenant identifiers;
4. use the API to collect personal data about other developers or households.

4. The connector runtime and the network

A Connector runs inside an Installation, with the network access its descriptor declares. That declaration is a contract, not a hint.

You may not, from Sandbox code or a submitted Connector:

1. attempt to reach private, link-local or loopback addresses (for example the 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 ranges, 127.0.0.0/8 or ::1) except the device addresses the Household has paired with your Connector;
2. attempt to reach ALYT’s internal services, the message broker, databases, other containers, or the host;
3. open listeners, tunnels or reverse connections not declared in the descriptor;
4. scan ports, sweep address ranges or fingerprint hosts beyond the discovery method the descriptor declares;
5. send Household data to any destination not declared in the descriptor, including any AI model.

5. Credentials in submissions

A Submission must not contain any credential, of yours or of anyone else’s: API keys, passwords, OAuth tokens, private keys, certificates, cloud account identifiers with secrets, or a vendor’s undocumented signing key. Credentials belong in the per-installation secrets the platform provides. A Submission that contains a credential is refused, and the credential is treated as compromised.

6. Rate limits and quotas

Rate limits and quotas are binding. They are shown to you in the portal before you reach them.

You may not:

1. retry in a tight loop, ignore 429 responses, or ignore Retry-After;
2. create extra accounts or keys to obtain more capacity;
3. place undue load on the Platform through automation, load testing without written consent, or excessive polling where a subscription exists.

If your usage is significantly excessive compared to other developers doing similar work, we may throttle, suspend or revoke keys until it is reduced.

7. Content and conduct

You may not use the Platform for content or activity that:

1. is unlawful or promotes unlawful activity;
2. infringes anyone’s copyright, trademark, patent, trade secret or privacy;
3. impersonates any person, brand or ALYT, including by naming a Connector so that it appears to be ALYT’s own or a vendor’s official integration without authority;
4. contains or delivers malware, or uses the Platform as attack infrastructure;
5. harasses, threatens or defrauds anyone, including ALYT staff and reviewers;
6. sends unsolicited commercial messages to households or other developers.

8. Security research

We want to hear about vulnerabilities, and we do not want good-faith researchers to fear legal action.

8.1 Rules

1. Test only against your own Sandbox tenant and the Platform surfaces listed at https://developers.alyt.com/.well-known/security.txt.
2. Do not test against real households, other tenants, self-hosted Installations you do not operate, or vendors’ systems.
3. Do not access, modify or delete data that is not yours. If you reach it by accident, stop, record what you saw, and report it.
4. Do not degrade the Platform. No denial of service, no volumetric testing, no social engineering of staff.
5. Give us [90] days to fix an issue before disclosing it. We will keep you informed.

8.2 Safe harbour

If you follow these rules in good faith, we will not pursue civil or criminal action against you and will not refer you to law enforcement for that research. We consider such research authorised under the Computer Fraud and Abuse Act, the DMCA and California Penal Code section 502(c). We cannot bind third parties such as device vendors; if your research touches their systems, their rules apply. If in doubt, ask first.

8.3 Contact

Report vulnerabilities to security@alyt.com. The same address, our PGP key and this policy are published at https://developers.alyt.com/.well-known/security.txt under RFC 9116. We acknowledge reports within [5] business days.

9. Reporting abuse

Report a breach of this policy to info@fizzify.co with the account, connector or behaviour involved, how you found it, and any URLs or screenshots. We will not disclose your identity to the reported account.

10. Enforcement

We may throttle, suspend or revoke keys, refuse or unpublish a Connector, or close an Account for a breach of this policy. We act to protect households first. Where lawful and practical we will tell you why and how to appeal at info@fizzify.co.