Acceptable Use Policy

This policy is part of the Terms of Service. It applies to every organization, account, app and API key.

Prohibited uses

You must not use Carillon to:

• send notifications to people who have not allowed notifications from your app, or keep sending to people who opted out;
• send unsolicited commercial messages in breach of applicable law;
• send content that is unlawful, fraudulent, deceptive or that impersonates another person or organization, including phishing links or links to malware;
• harass, threaten or incite violence or discrimination against anyone;
• send special categories of personal data, or data about children, in notifications, tags or external identifiers without a lawful basis;
• breach the terms of Apple or Google that apply to your apps, APNs or FCM;
• upload provider credentials you are not authorized to use;
• circumvent rate limits, quotas or abuse protections, or place an unreasonable load on the service;
• probe, scan or test the security of the service, or access data of another organization, without Exostack's prior written permission;
• resell or provide the service to third parties as a standalone push service without a written agreement with Exostack.

Reporting abuse

If you received an abusive notification from an app that uses Carillon, or you believe the service is being misused, write to abuse@carillon.dev.

Include what you can: the app name as it appears on your device, the date and time and your timezone, the device platform, the text of the notification (a screenshot helps), and why you consider it abusive. Do not send your device token or other personal data we do not need.

Exostack reviews each report, may ask the Customer concerned for an explanation, and may suspend the keys, apps or organization involved under the Terms of Service.

To report a security vulnerability, write to support@carillon.dev.

Exposed API keys

Secret keys (carillon_sk_live_…, carillon_sk_test_…) authorize sending, reading traces and managing devices. Carillon shows a secret key once, at creation, and stores only a digest of it, so a lost key cannot be recovered and a leaked one must be replaced.

If a secret key is exposed, for example committed to a repository, shipped in an app or pasted in a ticket:

1. Create a new secret key for the app in the dashboard, under API keys.
2. Deploy the new key to your backend.
3. Revoke the exposed key under API keys. Revocation takes effect immediately: requests made with it are refused.
4. Review the messages sent and the devices changed while the key was exposed, and delete anything that should not exist.
5. Tell us at support@carillon.dev if you see activity you did not initiate.

Mobile keys (carillon_mk_live_…, carillon_mk_test_…) are embedded in your app binaries and are public by design. They can only register and update a device and report its events; they cannot send, list devices or read traces. Revoke a mobile key only when it is being abused: app versions that ship it can no longer register devices or report opens until they update. An app can have several active mobile keys, so you can ship a new one before revoking the old one.

If Exostack learns that one of your secret keys is exposed or is being used for abuse, it may revoke the key to protect you and your users, and will inform your organization's owners and administrators.