Acceptable Use Policy

This Acceptable Use Policy ("Policy") is part of the Terms of Service and applies to every person and organization that uses the Moatgator platform, including anyone who sends an app to the public Scan without an account. It exists because the same technology that protects a legitimate app could, in the wrong hands, hide a malicious one. Moatgator is provided by GZ Segurança e Defesa Cibernética LTDA, CNPJ 40.988.106/0001-60, Cascavel/PR, Brazil. This is a courtesy translation: the Portuguese version prevails.

1. You must have rights over the app

When you send a package (APK, AAB or IPA) to Scan, ask for a build to be protected, integrate the SDK or authorize the GitHub App to open pull requests (Solve), you represent that:

• you own the app or the code, or develop it for its owner; or
• you have written authorization from the owner to analyze, test or protect that app (for example, a penetration test contract whose scope includes the app); or
• the analysis is allowed by law without authorization, such as for interoperability or good-faith security research, within the limits of Brazilian Laws 9,609/1998 and 9,610/1998.

We may ask you to prove that authorization. Without it, we may refuse the upload or delete the result.

2. What is prohibited

You may not use Moatgator, directly or indirectly, to:

1. Malware and harmful apps: protect, obfuscate, pack or distribute malware, banking trojans, spyware, stalkerware, abusive adware, ransomware, fraud apps, phishing, or apps that mislead users about what they do.
2. Analysis evasion: hide an app's behavior from Google Play or App Store review, antivirus engines or researchers, when that behavior would be rejected or reported if visible.
3. Reverse engineering of third parties without authorization: send to Scan, decompile, modify or repackage other people's or companies' apps without authorization, including to pirate, clone, or bypass payments, licenses or protections.
4. Attacking third parties: use reports, detections or documentation to attack other people's apps, services or users.
5. Rights violations: infringe intellectual property, privacy, trade secrets or other third-party rights, or process personal data without a legal basis.
6. Unnecessary data: send through the SDK, in free-form fields, personal data the platform does not ask for (name, ID number, phone, e-mail, precise location).
7. Illegal activity: any activity prohibited by Brazilian law or the law of the country where the app is distributed.
8. Platform abuse: test Moatgator's security outside the vulnerability disclosure program, run load tests without agreement, bypass limits, quotas or controls, create multiple accounts to multiply the free plan, or resell the service without a partner agreement.
9. Sanctions: use the platform on behalf of a person or entity subject to United Nations Security Council sanctions or other lists that apply to Moatgator.

3. Usage limits

Each plan has limits published on the pricing page (monthly active users, events per minute, retention, AI questions). Scan accepts packages of up to 300 MB and has per-person and per-period limits to keep the service available to everyone. Automation through the API is welcome within those limits. If your usage affects other customers, we may rate-limit it temporarily and will tell you.

4. Customer verification

To reduce the risk described in section 2, we may ask for information before enabling or keeping features: legal name and company registration, domain, store listing, repository and billing identity. Depending on the risk, the account may have limited features until review. Enterprise customers go through contractual due diligence. Decisions are made by a person on our team, are logged and can be reviewed at your request.

5. How to report abuse

If you believe someone is using Moatgator for a prohibited purpose, use the contact form with the subject "Abuse", naming the app (name, package and store) and what you observed. Vulnerabilities in Moatgator itself go through the disclosure program.

6. What we do about violations

Depending on severity, and proportionally, we may:

• ask for clarification and give a deadline to fix;
• remove a result, refuse an upload or block an app;
• limit or suspend the account, and revoke API keys and protection certificates issued for the app;
• close the account and end the contract;
• preserve records and cooperate with Google, Apple, CERTs and competent authorities, within the law and the LGPD.

Where there is serious and current risk to end users (for example, malware being distributed), suspension may be immediate and without notice. In other cases we notify you first and give you a chance to respond. Runtime protection already embedded in legitimate apps is not switched off for non-payment, but it may be switched off in apps that violate section 2.

7. Appeals

You may appeal a measure within 15 days through the contact form. A person other than the one who decided reviews the case and answers within 10 business days.

8. Changes

We may update this Policy to address new abuse or changes in the law. Material changes are announced by e-mail or in the console before they take effect.