MockFlow Developer Terms

Thanks for building on MockFlow. These Developer Terms are an agreement between you and A Produle Systems Pvt Limited, the company that makes MockFlow (“MockFlow”, “we”, “us”). They apply when you use the MockFlow API, create an API key or service token, or register an OAuth app. They sit alongside the MockFlow Terms of Service and the Privacy Policy, which still cover your MockFlow account. If these terms and the Terms of Service disagree about the API, these terms apply.

If you accept these terms for a company or other organisation, you confirm you can agree on its behalf, and “you” means that organisation.

1. Words we use

• API means the MockFlow Boards API at api.mockflow.com, its OpenAPI document, the OAuth endpoints, the MockFlow MCP servers, and the sample code, SDKs and documentation we publish for them.
• Credentials means personal API keys, workspace service tokens, OAuth client IDs and client secrets, authorization codes, access and refresh tokens, and webhook and callback signing secrets.
• Your app means any software, script, integration, agent or service that calls the API, whether it serves only you or other people.
• User means a person who connects their MockFlow account to your app through OAuth, or whose boards your app reaches with a key.
• MockFlow content means what people keep in MockFlow: spaces, boards, items, sticky notes, comments, chat, files, images, generated output, and the details of the people in a workspace.

2. What you can build

While you follow these terms, we give you a limited, non-exclusive, non-transferable, revocable licence to use the API to build, test and run your app so that it works with MockFlow. You need a MockFlow account in good standing. You don’t need our approval to build: a script for your own boards, a tool for your team, or an app other people connect are all welcome. If we later list apps in a MockFlow directory, being listed may involve a review.

The API works with what you and your users can already see and change in MockFlow. A key or token never gives more access than the MockFlow account behind it: if that account cannot open a board, neither can your app.

3. Keys, tokens and secrets

• Keep credentials on a server you control. Don’t put them in a web page, in a mobile or desktop app you ship, in a public repository, on a board, or in a support message. An app that runs on people’s devices should be registered as one that cannot keep a secret, and use PKCE.
• Each credential is for the app it was made for. Don’t sell, share or lend it, or let one app use another’s.
• You are responsible for what is done with your credentials, including by people you gave them to.
• If a credential may have been exposed, revoke or rotate it in the developer console, and let us know at support@mockflow.com if anyone else’s boards may have been reached. We’ll help.
• Test keys are labelled for testing, not for running a production service.
• A workspace service token belongs to the workspace. Only the workspace owner can create one, and it stays the workspace’s responsibility after you move on.

4. OAuth apps

An OAuth app acts for each person who connects it, so people need to be able to trust it. When you register one:

• Say who you are. Your app’s name, description and logo should honestly describe you and what the app does, and stay up to date. Don’t imitate MockFlow or another company.
• Ask for what you use. Request the scopes your app’s features need, and add more when you add features.
• Let people choose. Connect accounts only through MockFlow’s consent screen. Never ask for or store anyone’s MockFlow password.
• Use redirect addresses you control.
• Stop when access ends. When someone disconnects your app or deletes their account, or if your app is disabled, revoke their tokens with the revoke endpoint, stop calling the API for them, and follow section 5 for their data.
• Be reachable. Give your users a way to contact you. MockFlow support helps with MockFlow, and will point people to you for questions about your app.
• Publish a privacy policy if people outside your own team use your app, saying what it does with their MockFlow content, and follow it.

5. Boards and people’s data

MockFlow content belongs to the people and workspaces who create it. When your app works with it:

• Use it to provide the features of your app that the user asked for, and keep it only as long as those features need it.
• Don’t sell, rent or trade it, or use it for advertising or to profile people.
• Don’t use it to train or improve a machine learning model that serves anyone other than that user, unless the user has clearly agreed first.
• Delete what you hold for a user within 30 days after they disconnect your app or ask you to, unless the law requires you to keep it.
• Respect what a workspace has chosen. If a board is private or its sharing is restricted, your app keeps it that way.
• Follow the privacy and data protection laws that apply to you and your users.

Webhook deliveries and callbacks carry MockFlow content too, so this section applies to what your endpoint receives. Check each delivery’s signature before you act on it.

Exporting, syncing or backing up a user’s own boards at their request is a good use of the API and is welcome.

6. Mida and AI credits

With the ai:generate scope your app can run Mida, MockFlow’s AI, using the AI credits of the account behind the key or token. If other people use your app, let them know when it will spend their credits. Generated output is MockFlow content, so section 5 applies to it, and you are responsible for how your app uses it.

7. Keeping the platform safe

Almost everyone building on MockFlow will never need this section. It exists so we can act against the rare app that harms users or the platform. You agree not to, and not to help anyone else:

• get around rate limits, plan limits, credit limits or access controls, for example by spreading calls across many keys or accounts;
• reach MockFlow in ways the API doesn’t offer, such as scraping the web app or calling its private endpoints;
• reverse engineer or extract the source code of MockFlow, except where the law allows it;
• build an app whose main purpose is to replicate MockFlow, or extract workspaces in bulk without their owners choosing to move;
• send spam, or use sharing, comments, chat, invitations or notifications to reach people who didn’t ask for them;
• create or upload content that is illegal, deceptive, harmful, or infringes someone else’s rights;
• introduce malware, access other people’s data without permission, or disrupt or overload MockFlow;
• use the API in breach of the law, including export control and sanctions laws.

Security research. If you find a vulnerability, please report it privately to support@mockflow.com and give us reasonable time to fix it before telling anyone else. We won’t pursue legal action against research done in good faith that follows these terms, uses only your own accounts and data, stops as soon as you reach someone else’s data, and doesn’t degrade MockFlow for others.

8. Limits, plans and fees

API access comes with MockFlow plans at no extra charge today. Calls count against the rate limits and plan limits of the account behind the key or token; the current limits are in the developer docs. We may adjust limits to keep MockFlow fast and reliable for everyone. If we ever introduce fees for the API or some of its features, we’ll tell you in advance, and you can choose not to use what they cover.

9. Versions and changes to the API

The API is versioned by date, and a key stays on the version it was made against until you move it. We will give reasonable advance notice, in the changelog and by email, before we retire or break a published version. We may need to change something without notice to fix a security issue, to follow the law, or to stop abuse. Features marked beta or preview may change or be removed. We may also build MockFlow features that overlap with what your app does; these terms don’t limit that.

10. Names and logos

You may say your app works with MockFlow, for example “for MockFlow” or “works with MockFlow”. Please don’t use MockFlow, or something confusingly similar, as your app’s or company’s name or logo, or suggest that MockFlow made or endorses your app unless we’ve agreed in writing. We may show your app’s name and logo where people connect it, and in directories or announcements of apps that work with MockFlow; tell us if you’d like us to stop.

11. Security

Protect credentials and MockFlow content with security suited to what your app holds, and keep your app and its systems up to date. If credentials or MockFlow content in your care are reached by someone who shouldn’t have them, tell us at support@mockflow.com within 72 hours of finding out, tell affected users as the law requires, and work with us to put it right.

12. Ownership and feedback

We own MockFlow and the API. You own your app and what you build. Neither of us gets the other’s intellectual property under these terms beyond the licence in section 2. If you send us ideas or feedback about the API, we may use them freely, and we appreciate them.

13. Confidentiality

If we share something with you that isn’t public, such as a beta, plans or details of an incident, please keep it confidential and use it only to work with MockFlow, unless we say otherwise.

14. Suspension and ending these terms

You can stop at any time by deleting your keys, tokens and OAuth apps in the developer console.

We may limit, suspend or revoke access, credentials or an app if these terms are broken, if an app puts users, their data or MockFlow at risk, if the law requires it, or if the MockFlow account behind it is closed. When we reasonably can, we’ll contact you first, explain why, and give you time to fix it. When there’s urgent risk to users or the platform, we may act straight away and tell you afterwards.

When these terms end, stop using the API, delete your credentials, and delete the MockFlow content you hold, except what a user has asked you to keep for them. Sections 5, 12, 13, 15, 16 and 18 continue to apply.

15. Disclaimers and liability

We work hard to keep the API reliable, but we can’t promise it will always be available or free of errors. In legal terms:

THE API IS PROVIDED “AS IS” AND “AS AVAILABLE”. TO THE EXTENT THE LAW ALLOWS, MOCKFLOW DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.

TO THE EXTENT THE LAW ALLOWS, MOCKFLOW WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, ARISING FROM THE API OR THESE TERMS. MOCKFLOW’S TOTAL LIABILITY ARISING FROM THE API OR THESE TERMS WILL NOT EXCEED THE GREATER OF THE AMOUNTS YOU PAID MOCKFLOW FOR THE API IN THE 12 MONTHS BEFORE THE CLAIM AND ONE HUNDRED US DOLLARS (US$100).

Nothing in these terms limits liability that the law does not allow to be limited.

16. Indemnity

If someone else brings a claim against MockFlow because of your app, your use of the API, or your breach of these terms, you will defend MockFlow and cover the resulting damages, costs and reasonable legal fees. We’ll tell you about the claim promptly, let you lead the defence, and cooperate with you. You won’t settle a claim in a way that binds MockFlow without our agreement.

17. Changes to these terms

We may update these terms as the API grows. The date at the top of this page shows the edition in force. For changes that matter, we’ll tell you by email or in the developer console at least 30 days before they take effect, unless the change is needed sooner for legal or security reasons. We may ask you to accept a new edition before you register more apps. If you keep using the API after a change takes effect, you accept it; if you don’t agree, you can stop using the API.

18. General

• You and MockFlow are independent. These terms don’t make either of us the other’s partner, agent or employee.
• You may not transfer these terms without our written consent. We may transfer them as part of a merger, acquisition or sale of the business behind MockFlow.
• If part of these terms can’t be enforced, the rest still applies. If we don’t enforce something now, we can still enforce it later.
• These terms, with the Terms of Service and the Privacy Policy, are the whole agreement between us about the API.
• Questions about these terms? Write to support@mockflow.com.