Acceptable use policy

Scope

This policy is part of the terms of service. It applies to everyone who uses GROUPSPACE: account holders, workspace members, and anyone calling the API or running the game SDK.

A workspace owner is responsible for their members’ use of their workspace. If you run a community, these rules are yours to enforce inside it before they become ours to enforce against you.

Where these rules and a platform’s rules both apply, follow whichever is stricter. Following ours is never a defence to breaking Roblox’s.

Prohibited conduct

Do not use GROUPSPACE to:

• Harass, threaten, stalk or intimidate anyone. Including with the product’s own features — a stream of fabricated records, a punitive fine loop, or repeated searches of one person’s chat are all harassment carried out with a workspace.
• Dox anyone. Do not store, publish or trade real-world identity data — legal names, addresses, schools, workplaces, phone numbers, photographs — about a platform user. GROUPSPACE is not built to hold it and you may not use it to.
• Break the law, or help anyone else break it.
• Impersonate another person, another community, GROUPSPACE, or a platform.
• Interfere with the service — probing, load-testing without permission, circumventing rate limits, scraping, or degrading it for other customers.
• Circumvent permissions or plan limits, or access a workspace, record or API you were not granted access to.
• Resell or sublicense access to GROUPSPACE, or run it as a service for third parties, without written agreement.
• Automate account creation or credential sharing. Access is issued to named people.
• Send unsolicited bulk messaging through the notification or webhook systems.
• Deceive us about who you are, what your community does, or what a workspace is for.

Prohibited content

Do not upload, store or transmit through GROUPSPACE:

• Child sexual abuse material, or any sexual content involving minors. This is reported to the relevant authorities and the account is terminated immediately, without notice and without a warning stage.
• Content that sexualises, grooms or targets a child.
• Content promoting terrorism, violent extremism, or mass violence.
• Credible threats of violence against a real person.
• Content that encourages self-harm or suicide.
• Hate speech, or content attacking people on the basis of a protected characteristic.
• Real-world personal data of the kind described above.
• Malware, exploit payloads, or credential-stealing tooling.
• Content you have no right to store, including material that infringes someone else’s copyright.
• Regulated financial or health data. GROUPSPACE is not built for it and you must not put it here.

Platform rules we inherit

GROUPSPACE is a third-party application on other companies’ platforms. Their rules bind us, and through us, you. These are not negotiable and no plan unlocks them.

Breaking a platform rule through GROUPSPACE risks our integration for every other customer. It is treated as a serious breach and does not get the usual warning ladder.

Misuse of staff tooling

GROUPSPACE hands community staff real power over their members: a permanent record, a fine, a ban, a searchable chat log. The most likely abuse of this product is not an outside attacker. It is a moderator using it on someone they dislike.

Records

• File records for reasons your community’s own published rules actually cover. A record used to punish someone for something that is not against your rules is misuse of the tool.
• Do not fabricate records, backdate them, or file them to manufacture a paper trail for a decision already taken.
• Do not use records to settle a dispute that has nothing to do with the community — a personal falling-out, an argument in another community, a grudge from a different game.
• Do not use the background-check or flag features to build a blacklist that follows a person into communities that never agreed to it.

Chat search

Chat search is the single most abusable surface in the product, which is why it is permission-gated separately and why every read is written to the audit log with the searcher and the subject.

• Search chat to investigate a specific report or incident. That is what it is for.
• Do not browse a person’s messages out of curiosity, because you find them irritating, or because a friend asked.
• Do not export a conversation to publish it, to embarrass someone, or to hand to a third party outside the process it was gathered for.
• Do not use chat history to monitor members generally. It is an investigative tool, not surveillance infrastructure.

Moderation and the economy

• Do not use bans, fines or payroll withholding as leverage over someone in a matter unrelated to the community.
• Do not use the ledger to run anything resembling a real-money economy, a gambling mechanic, or a scheme that converts workspace currency to real value.

Protecting young players

Many of the people in a Roblox community are children. Everything in this policy applies more strictly where they are involved.

• Do not use GROUPSPACE to collect personal information from a child — through an application form, a record field, a note, or any custom field you create.
• Do not use records, chat or session data to contact a young player outside the community, or to work out who they are in the real world.
• Do not use the product to isolate, pressure or groom a member.
• If you enable chat history, you are storing children’s messages. Grant the permission narrowly, review the audit log, and remove access from anyone who does not need it.

Suspected child endangerment is reported to the relevant authorities and to the platform, and the account is terminated. There is no warning stage for this.

Technical limits

• Respect published rate limits. Do not run several keys to get around one.
• Batch game events into the heartbeat envelope as the SDK does. Do not send one request per event; a busy server will exceed the platform’s own outbound limit long before it reaches ours.
• Use idempotency keys on ingest so a retry does not duplicate a record.
• Keep server keys server-side. A key in client code is a key you have published.
• Do not build a client-side chat relay to capture messages the server cannot see. It is spoofable, it defeats the platform’s filtering, and it is a breach of this policy.
• Do not mirror the entire API into your own database to create a second copy of the data with none of the controls.

Security research

We would rather hear from you than read about it later. Report to security@groupspace.xyz.

Research inside these rules will not be treated as a breach of this policy and we will not pursue you for it. There is no bug bounty at present, so please do not ask about a reward before reporting — we would still like the report.

Reporting a breach

If you believe someone is breaking this policy, tell us. Include the workspace, the people involved, roughly when, and anything that helps us find it in the log.

• Abuse of the product, harassment, or misuse of staff tooling — legal@groupspace.xyz.
• Anything involving a child’s safety — legal@groupspace.xyz, marked urgent. Also report it to the platform.
• Security vulnerabilities — security@groupspace.xyz.
• Concerns about your own data — privacy@groupspace.xyz.

We do not identify reporters to the people they report unless we have to, and we will not act on an anonymous report we cannot verify without checking it first.

Enforcement

We aim to fix a problem rather than punish a customer. The usual ladder runs in order, and we skip steps only where the breach is serious.

Where we skip the ladder

• Child sexual abuse material or child endangerment — immediate termination and report.
• Credible threats of violence against a real person.
• Conduct that puts our platform integrations at risk for every other customer.
• An active attack on the service or on another customer’s data.

Appeals

Write to legal@groupspace.xyz. Tell us what you think we got wrong and what has changed. A person reviews it — not the same person who made the original call where we can avoid it. We will not reverse a decision made on child safety grounds.