Contents
1. Purpose #
The AUP protects users, the Operator, and the integrity of a multi-tenant SaaS product that may connect to Telegram, AI routing, and MCP clients. Violations may result in rate limiting, suspension, termination, or referral to authorities.
Operator: Komishan Nikita Danilovich (Комишан Никита Данилович), self-employed (самозанятый), INN 231142994315. Reports: security@tydy.dev; abuse and support: support@tydy.dev; legal: legal@tydy.dev.
2. Lawful use only #
You may use the Service only for lawful purposes and in compliance with the Terms of Service, this AUP, and applicable law. You must not use the Service to commit or facilitate crime, fraud, money laundering, sanctions evasion, or infringement of intellectual property or privacy rights.
3. Accounts and credentials #
Do not share passwords, session cookies, or MCP personal access tokens. Do not attempt to bypass authentication, CSRF protections, RBAC, or workspace isolation. Do not harvest accounts or probe for existence of private resources beyond normal product use.
Necessary cookies (flowtask_session, flowtask_csrf, tydy_remember_device) must not be stolen, replayed, or distributed.
4. Content standards #
You must not upload or transmit content that is illegal, harmful to minors, grossly deceptive, malware, or that you lack rights to process. Workspace content remains your responsibility, including content arriving through Telegram chats you configure.
5. Telegram integrations #
Connect only chats you are authorized to integrate. Do not use the Service to spam Telegram users, evade Telegram’s terms, or surveil individuals without a lawful basis and appropriate notices inside your organization.
Remember that a Telegram message is not automatically a task; do not misuse AI routing to generate harassing or deceptive task records.
6. AI proposals and Inbox #
Do not attempt to coerce the model or business layer into unauthorized writes. Do not systematically accept proposals you know to be false in order to damage other members’ work. Review Inbox items with care when human confirmation is required.
7. MCP clients #
Grant only the scopes you need. Effective access is scopes ∩ live RBAC; do not attempt to elevate privileges through MCP. Treat OAuth grants and PATs as powerful credentials; revoke unused connections. Do not use MCP to exfiltrate data outside your authorization or to attack the Service.
Token values are shown once where applicable and stored hashed; recovering or guessing others’ tokens is prohibited.
8. Infrastructure abuse #
Prohibited activities include denial-of-service, flooding APIs, credential stuffing, unauthorized vulnerability scanning, introducing malware, mining cryptocurrency on Operator resources, or circumventing rate limits and Security Center controls. Good-faith security research and responsible disclosure coordinated with the Operator via security@tydy.dev are not prohibited by this Policy.
9. Billing and trial abuse #
Do not abuse Free, Pro, or Team plans, optional Pro trials, or payment flows (including fraudulent YooKassa charges, chargeback fraud, or creating accounts solely to reset trial eligibility). Subscriptions are workspace-scoped; do not misrepresent workspace ownership to obtain unpaid entitlements.
Do not bypass payment, interfere with YooKassa, forge payment notifications, or manipulate subscription status, auto-renewal, a saved payment method, or a grace period outside the provided interface.
10. Impersonation and interference #
Do not impersonate the Operator, other users, or third parties. Do not interfere with other customers’ workspaces, feeds, or Telegram-linked conversations.
11. Monitoring and enforcement #
The Operator may monitor for abuse using security logs and automated controls, investigate suspected violations, remove content, revoke MCP tokens, disable Telegram integrations, and cooperate with lawful requests. No claim is made of perfect detection.
12. Reporting #
Report security vulnerabilities to security@tydy.dev, privacy concerns to privacy@tydy.dev, and other AUP violations to support@tydy.dev or legal@tydy.dev. Do not publicly disclose unfixed vulnerabilities in a manner that increases harm.
13. Changes #
The Operator may update this AUP by publishing a new version on tydy.dev. Continued use after the updatedDate constitutes acceptance where permitted by law.