Qivuna Bot Developer Terms

Also in עברית. If the versions differ, the English one applies.

Version d1 · in force from 22 October 2026

These terms are an agreement between you and Qivuna ("we"). They apply when you create, operate or receive a bot on Qivuna, in addition to the Qivuna Terms of Use and Privacy Policy. Where these terms are stricter, they apply to your bots.

You accept them in @qivbot before you create your first bot, and when you accept a bot someone transfers to you. When we change them in a way that matters, QivBot asks you to accept the new version before you can create or manage bots again.

1. Who may build bots#

1.1 To create and manage bots, your Qivuna account must be at least 7 days old, protected by 2-step verification with an authenticator app or a 2-step password, active and not suspended, and bot creation must be open to your account. Each account may own 2 bots, or 10 after 30 days as a developer without content strikes; we may change these numbers.

1.2 You are responsible for everything your bots do and for everyone you let operate them, including your hosting providers. Keep your Qivuna account, your bots' tokens, webhook secrets and encryption keys secure.

1.3 If you build a bot for an organisation, you confirm you may bind it to these terms.

2. Your bot's identity#

2.1 A bot's username must end in "bot". Names that are, or look like, Qivuna's own (for example qivbot, qivuna, supportbot, securitybot, including look-alike letters) are reserved. A bot's display name may not contain check marks or words such as "official", "verified", "Qivuna" or their Hebrew forms, unless the bot is verified.

2.2 You must not impersonate Qivuna, QivBot, any Qivuna team member, or any other person, organisation or bot, in a name, picture, description, message or link. QivBot is Qivuna's only official bot.

2.3 We may rename a bot, or reserve a name, that breaks this section. The username of a deleted bot stays reserved for 30 days.

3. Acceptable use#

3.1 The acceptable-use rules of the Terms of Use apply to everything your bot sends, posts, links to or does. In addition, you must not use a bot to:

• send spam or messages people did not ask for, beyond what the platform allows; evade rate limits or the daily cap on unsolicited messages (for example with several bots); or keep messaging someone who stopped or blocked the bot;
• phish: ask anyone for login, verification or SMS codes, passwords, PINs, recovery or seed phrases, or private keys, by any wording or in any language; link to sites that imitate Qivuna or anyone else; or disguise where a button or link leads;
• collect information people did not knowingly give your bot, or collect the content or membership of rooms beyond what your bot needs for the purpose it states;
• get around, test or weaken the platform's protections — privacy mode, rights, rate limits, the content checks, verification, the end-to-end encryption of others — except as allowed under a security research arrangement with us;
• operate bots for someone whose bots we suspended or banned, or create new bots to evade a restriction;
• create Qivuna accounts by automated means, or use the Bot API to control a person's account.

3.2 Content checks refuse some messages automatically (content_blocked) and add a strike to your account, at most one a day per bot. Strikes are a signal for review; repeated or serious violations lead to the measures in section 9.

4. Data your bot receives#

4.1 What you receive. Your bot receives what the platform shows it: messages addressed to it (or, where a public group's admin allowed it and your bot's privacy mode is off, all messages of that group), channel posts, button presses, files in messages it receives, joins and leaves where allowed, and people's names and usernames as members of a shared room see them, under pseudonymous ids that are specific to your developer account. Bots never receive phone numbers.

4.2 Your obligations. For all data your bot receives you must:

• use it only to provide your bot's service as you describe it to people, and to keep that service secure;
• publish a privacy notice, linked from your bot's description or start message, that says who you are, what you collect, why, how long you keep it, who else can access it (including your hosting providers), and how people can ask for access or deletion;
• delete a person's data when they ask, when they stop your bot and you no longer need it, and when you stop operating the bot — except what the law requires you to keep;
• not sell it, not use it to advertise to people across other services, and not share it except as your privacy notice says;
• not try to find out who is behind a pseudonymous id, link ids across developers, or combine data from Qivuna with phone numbers or other identifiers to identify people;
• protect it with appropriate security, and keep files you download only as long as you need them;
• comply with the data-protection laws that apply to you. For the data your bot receives you act on your own behalf, not as our service provider.

4.3 Breaches. If data your bot received, a token, a webhook secret or a bot key is exposed, revoke what is affected at once (QivBot lets you revoke all tokens and the bot's key) and tell us at support@qivuna.com within 72 hours. You are responsible for notifying people and authorities where the law requires it.

5. Tokens, webhooks and security#

5.1 Send your bot's token only in the Authorization header to https://bots.qivuna.com. A token that appears in a URL is revoked automatically. Never share a token, put it in client-side code or a public repository, or give it to anyone who is not operating the bot for you.

5.2 Your webhook endpoint must use HTTPS and verify our signatures. You must not point a webhook at a server you do not control or are not allowed to use.

6. Encrypted bots#

If your bot is end-to-end encrypted:

6.1 Generate its private key on systems you control and keep it there. Never let Qivuna or anyone else generate, hold or propose a key for your bot.

6.2 Before you confirm a key in the app, compare the security code on the confirmation screen with the one your server printed. Treat key alerts from our SDKs as security incidents. If a bot key may be compromised, revoke it in QivBot at once, revoke the bot's tokens, and certify a new key.

6.3 Do not misrepresent the protection. The app tells people that only the bot's developer can read what they send it. You must not claim that nobody, or not even you, can read it, and your privacy notice must say who can (you and anyone with access to your bot's server or keys).

6.4 Use decrypted content only as section 4 allows. Do not try to obtain group keys, other people's messages, or anything people did not send to your bot, and do not try to defeat the checks people's phones make.

7. Rooms and moderation#

7.1 Act in rooms only within the rights admins granted your bot, and only for the purpose they added it for. Do not pressure admins to grant more rights, in particular the right to read all messages.

7.2 Moderation by your bot (deleting, banning, muting, pinning, invite links) must follow the room's rules and its admins' wishes. Reasons you give must be truthful. Every action is logged and shown in the room as the platform decides.

8. The platform#

8.1 The bot platform is offered as it is. We may change the API, limits and features; we try to announce changes in the developer changelog in advance, except where security or the law requires immediate changes.

8.2 We may pause the whole platform, or a part of it, at any time (for example for safety or maintenance). Updates that arrive while it is paused are not delivered later, and waiting updates are kept for 24 hours at most. We do not promise any level of availability.

8.3 The platform is free of charge.

9. Reports, enforcement and appeals#

9.1 People can report bots. A person on our team reviews reports and decides what, if anything, to do. Reports alone never restrict, suspend or otherwise change your bot automatically.

9.2 If you or your bot break these terms or the Terms of Use, or to protect people or the platform, we may — with or without notice — refuse content, add strikes, restrict, suspend or ban a bot, revoke its tokens or invite links, switch off its webhook, remove it from rooms, rename it, remove its verification, transfer a bot whose owner's account was closed, or suspend your developer account (which suspends all your bots). Where the law requires, we report illegal content to the authorities.

9.3 We tell you in QivBot what we did, unless the law or people's safety prevents it. We may not tell you the internal reasons in detail.

9.4 You may appeal any measure by writing to support@qivuna.com from the account that owns the bot within 30 days. A person who was not involved in the original decision reviews the appeal.

10. Verification#

10.1 We may verify a bot (the blue check) at our discretion, based on the criteria published in the developer documentation. Information you give for verification must be true.

10.2 Identity verification happens outside the chat. Never send identity documents to QivBot or any bot. We store the result and your legal name as described in the Privacy Policy.

10.3 Verification is removed when a bot changes owners, is suspended or banned, is renamed by its owner, or when the owner's identity record is cleared; we may also remove it if information you gave proves untrue.

11. Transfers and deletion#

11.1 You may offer a bot to another developer, who must accept within 24 hours and accept these terms. On transfer, tokens are revoked, the webhook is switched off, waiting updates are deleted, verification is removed, rights tied to the previous owner are removed from every room, and for an encrypted bot the previous owner's key is revoked.

11.2 You may delete a bot at any time. It leaves every room and its username stays reserved for 30 days. When you delete your Qivuna account, your bots are deleted too.

12. Content and brand#

12.1 You keep your rights in your bot's content and give us the licence the Terms of Use describe, so we can store, transmit and display it.

12.2 You may say your bot works on Qivuna, but you may not use Qivuna's name, logo or look in a way that suggests we made, endorse or verified your bot when we did not.

13. Liability#

The disclaimers, limitation of liability and indemnity of the Terms of Use apply. In addition, you will cover our reasonable losses and costs from claims that arise from your bot, its content, or your handling of data, to the extent the law allows.

14. Changes and ending#

14.1 We may change these terms. If a change matters, we tell you in QivBot, and you must accept the new version to continue creating or managing bots.

14.2 You may stop at any time by deleting your bots. We may end the bot platform, or your participation, with 30 days' notice, or at once under section 9.

15. Law and contact#

These terms are governed by the same law and courts as the Terms of Use. Contact: support@qivuna.com.