Acceptable Use Policy

Last updated: July 20, 2026

This Acceptable Use Policy ("AUP") applies to everyone who uses Morphing (morphing.app, the "Service"), and especially to Builders who create applications that collect data from and communicate with their own end-users and customers ("End-Users"). It is incorporated into our Terms of Service. As a Builder, you are the controller of your End-Users' data and are responsible for your application's compliance with law. We may remove content and suspend or terminate accounts that violate this AUP.

1. What Builders May Not Build or Collect

You may not use the Service to build applications, flows, or tooling that do any of the following:

• Unlawful collection or sale of data. Collect, use, share, or sell End-User personal data without a valid lawful basis and any required consent, or in violation of applicable privacy law or of the promises in your own privacy notice.
• Biometric data without consent. Collect or process biometric identifiers (such as fingerprints, faceprints, or voiceprints for identification) without the specific, informed consent required by law and any mandated notices and retention limits.
• Apps that unlawfully target children. Direct an application to children, or knowingly collect personal data from children, in violation of applicable law (for example, COPPA or GDPR children's-consent rules), including without required verifiable parental consent.
• Surveillance, stalking, or harassment tooling. Build tools intended to track, monitor, surveil, or harass individuals without their knowledge and consent, including stalkerware, covert location tracking, or tools that facilitate abuse or intimidation.
• Unconsented profiling. Profile or score individuals, or make automated decisions with legal or similarly significant effects, without a lawful basis, required disclosures, and any consent or safeguards the law requires.
• Special-category data without a lawful basis. Collect or process special-category or sensitive data (such as health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, precise geolocation, or government identifiers) without a valid lawful basis and appropriate safeguards.
• Spam and messaging without consent. Send SMS, email, WhatsApp, or other messages to recipients who have not opted in, fail to honor opt-out (STOP) requests, or otherwise violate applicable messaging law and carrier or platform requirements (e.g., TCPA, CTIA, A2P, and Meta/WhatsApp policies). See the SMS/WhatsApp consent and opt-out rules in our Privacy Policy (Section 5) and Terms of Service.
• Other unlawful, deceptive, or harmful uses. Facilitate fraud, phishing, credential theft, discrimination against protected groups, or any activity that is unlawful in the jurisdictions where your End-Users are located.

2. Prohibited Plugin and Marketplace Content

Plugins and applications published to the marketplace, and code you run on the Service, must not contain or facilitate:

• Malware and malicious code: viruses, trojans, worms, ransomware, spyware, or any code designed to harm users or systems.
• Cryptocurrency miners: unauthorized cryptocurrency mining or resource consumption.
• Phishing and scams: content designed to deceive users or steal credentials or personal information.
• Intellectual-property infringement: unauthorized use of copyrighted material, trademarks, or other intellectual property.
• Adult/NSFW content: pornography, sexually explicit material, or content inappropriate for general audiences (restricted).
• Hate speech and harassment: tools that promote discrimination, hatred, or harassment based on race, religion, gender, sexual orientation, or other protected characteristics.
• Ratings and review manipulation: artificially inflating or deflating ratings through fake reviews, multiple accounts, or coordinated manipulation.
• Illegal activities: content that facilitates illegal activities, including drugs, weapons, fraud, or hacking.

3. Prohibited Behavior on the Platform

You must not:

• Attempt to bypass or disable security scanning or sandbox isolation.
• Reverse engineer, decompile, or extract source code from the platform's core infrastructure.
• Launch denial-of-service attacks or otherwise overload platform systems.
• Create multiple accounts to bypass rate limits or abuse platform features.
• Attempt to gain unauthorized access to other users' accounts, data, or systems, or to data belonging to another Builder's workspace.
• Scrape or harvest user data, plugin code, or marketplace listings without permission.
• Impersonate other users, developers, or Morphing staff.

4. Security Requirements

Code you publish or run on the Service must: pass automated security scanning where required; declare required permissions accurately; avoid dangerous JavaScript patterns (e.g., eval(), Function()); respect sandbox boundaries; and not attempt to access unauthorized browser APIs or system resources.

5. Enforcement

Violations of this policy may result in content removal, warnings, temporary suspension, permanent account termination, and, for illegal activity, referral to law enforcement — depending on severity and history. We reserve the right to remove content and suspend accounts at our discretion. Decisions may be appealed through our support process.

6. Reporting Violations

If you discover a violation, email abuse@morphing.app with the application or plugin name/ID, a description of the violation, and any evidence. For critical security issues, email security@morphing.app. Reports are handled confidentially, and we aim to respond within 48 hours.

7. Changes to This Policy

We may update this Acceptable Use Policy from time to time and will post the updated version here with a revised date. Continued use of the Service after changes take effect constitutes acceptance.

8. Contact

General: support@morphing.app
Abuse reports: abuse@morphing.app
Security issues: security@morphing.app