1. About these terms
1.1 Scope. These Developer Terms apply when you use a TopDeck API key or the TopDeck API, register a webhook endpoint, or build or run an app that uses "Log in with TopDeck" (our OAuth sign-in). These terms apply in addition to the Terms of Service, and they control if the two conflict on a matter within their scope. Capitalized terms not defined here have the meaning in the Terms of Service. "API Data" means any data you get through the API, webhooks or Log in with TopDeck.
1.2 Acceptance. You accept these terms by creating or using an API key, a webhook endpoint or a Log in with TopDeck app. If you accept for a business, you confirm you're authorized to bind it, and "you" means that business.
1.3 Organizers and the people they hire. Organizers and Publishers who use the API or webhooks for their own Events are also bound by the Organizer Terms. If an Organizer adds your Account to its Staff so you can work for it (for example, on stream overlays), you act for that Organizer: use its Event data only for that work, and follow Organizer Terms §9.
1.4 Documentation. Our developer documentation sets out technical requirements, usage limits and data formats, and you must follow it. If it conflicts with these terms, these terms control.
2. API keys
2.1 Getting a key. You can create an API key in the developer portal, subject to the limits we set.
2.2 What a key can reach. A key acts as your Account. It can access public Event data (Privacy Policy §4) and profile, Registration and result information about Players, including Discord identifiers where present. For Events where your Account holds a Staff role, it can also access Staff-only data, including Players' contact details. Some endpoints let a key act for Players, for example to register or drop them. Use them only for your own Account, for Players in an Event where your Staff role allows it, or for a Player who has asked you to.
2.3 Keeping keys safe. Keep your key secret and out of browsers, mobile apps and public code. You're responsible for all use of your key; if it leaks, replace it at once. Don't share keys, use someone else's key, or create extra Accounts or keys to get more access or higher limits.
2.4 Creating Events and registering Players. Some features, such as creating Events, require an active Subscription. Register only people who have asked to play in that Event, or whom the Organizer is entering with their permission. Registering an email address that has no Account sends that person an invitation to sign up. Overriding an Event's capacity is the Organizer's decision, not yours.
3. Usage limits
We set usage limits, such as request rates, and may change them at any time. Stay within them and cache responsibly. Higher limits are at our discretion; ask at [email protected].
4. Webhooks
4.1 Setup. You can register webhook endpoints in the developer portal.
4.2 What your endpoints receive. An endpoint receives notifications for every Event where your Account holds any Staff role, for as long as you hold it. If you administer a Publisher's Organized Play Program, you can also opt an endpoint in to every Event of your game. Notifications cover Event activity, such as rounds, results, registrations and drops, and carry Event, pairing, result and standings data, with Player names and identifiers (including Discord identifiers where the Event shows them) and some deck information. They don't include Players' email addresses, payment details or registration location. See the API documentation for the full payload format.
4.3 Your responsibilities. You're responsible for securing every endpoint you register and the data it receives, and for anyone who runs it for you. Use HTTPS, verify each delivery's signature, and keep your signing secret safe, replacing it if it leaks. We may disable any endpoint at any time.
4.4 No guarantee. Delivery, timing and order of webhooks aren't guaranteed, so don't treat them as your only record.
5. Log in with TopDeck
5.1 Approval. Log in with TopDeck apps need our approval. Apply at [email protected], describing your product, its redirect URIs, the scopes you need and your privacy policy. We may approve, limit or refuse any app at our discretion.
5.2 Scopes, consent and privacy. Request only the scopes your app needs. Use the data only as the consent screen and your privacy policy describe. Publish a privacy policy, linked from your app, that explains what you get from TopDeck, how you use, share and keep it, and how Players can have it deleted.
5.3 Security. Follow the security requirements in the documentation. In particular, keep your client secret and Players' tokens on your server, never in a browser, a mobile app or your logs, and revoke a Player's tokens when they disconnect your app.
5.4 Your app. Your app's name, logo and description must be accurate and must not imitate anyone. You're responsible for your app and for supporting its users.
5.5 Deletion. Unless the law requires you to keep it, promptly delete the personal data you received through TopDeck about a Player when the Player disconnects your app or asks you to, when your app's access is revoked, when you learn the Player has deleted their TopDeck Account, or when we ask.
6. Attribution and branding
6.1 Attribution required. Any project that uses the API or webhooks must show a visible credit and link to TopDeck.gg where users see the data. For example:
<p>Data provided by <a href="https://topdeck.gg">TopDeck.gg</a></p>
6.2 Our brand. We give you a limited, revocable, non-exclusive license to use the TopDeck name and logo only for the attribution above and for a "Log in with TopDeck" button. Don't suggest that TopDeck endorses or partners with your project, or use names, logos or domains confusingly similar to ours. If we ask you to change how you use our brand, you must do so.
7. Developer policy
Do:
- Tell your users plainly what you collect and why.
- Report security vulnerabilities to [email protected], and don't disclose them publicly before we've had a reasonable chance to fix them.
Don't:
- Sell, license, rent or otherwise commercialize API Data, give it to data brokers, ad networks or marketing services, or use it for targeted advertising or to profile Players for advertising or marketing.
- Re-identify a Player shown as "Deleted User", combine API Data with other data to identify people who chose not to share details, or compile information about individuals (for example, matching Discord IDs to TopDeck identities) unless a Player has asked your app to do it for them.
- Use API Data to track, surveil, harass, dox or discriminate against anyone, or to make decisions about credit, employment, housing or insurance.
- Knowingly collect personal data of children under 13 (or the higher minimum age where they live) through the Services, or aim a Log in with TopDeck app at them.
- Scrape the Services, get data other than through the documented API, try to reach data your Account isn't entitled to, or probe, scan, load-test or get around the Services' limits or access controls without our written permission.
- Send spam to Players, present unofficial results as official, misrepresent where data came from, or use the API in a way that harms the Services, Organizers or Players or breaks the law or the Community Guidelines.
8. Data you receive
8.1 Your role. You are an independent controller (or the equivalent under local law) of the personal data you receive through the API, webhooks and Log in with TopDeck, and you're responsible for how you use it, including having a lawful basis and complying with privacy laws.
8.2 Keep only what you need. Collect, use and keep API Data only as your app's stated features need it, for only as long as they need it, and honor Players' requests about data you hold. When we ask you to delete data about a Player (for example, after they delete their Account), do so promptly.
8.3 Public Event Records. You may display the public Event data you get through the API, with attribution (§6.1). Privacy Policy §4 lists what is public. When a Player is shown as "Deleted User", update your copy the next time you refresh it.
8.4 Security. Protect API Data with appropriate technical and organizational measures, including encryption in transit and access controls. If we ask, give us the information we reasonably need to confirm you comply with these terms.
9. Security incidents
If API Data or your credentials (API key, webhook secret, client secret or tokens) may have been accessed without authorization, tell us at [email protected] without undue delay. Cooperate with us, and make any notifications the law requires of you. We may rotate or disable affected credentials immediately.
10. Fees
The API, webhooks and Log in with TopDeck are currently free. We may introduce fees or paid tiers, but we won't charge you unless you agree.
11. Changes
11.1 The API. We may change, suspend or discontinue any part of the API, webhooks or Log in with TopDeck, including endpoints, fields, scopes and limits, at any time and with or without notice.
11.2 These terms. We may change these terms. We'll give reasonable notice of material changes before they take effect, except where a change is needed for legal, security or abuse reasons. If you keep using the API, webhooks or Log in with TopDeck after a change takes effect, you accept it.
12. Suspension and termination
12.1 You can stop at any time. Deleting your Account doesn't revoke your API key, webhook endpoints or the access you've given apps, so remove them first, or ask us at [email protected] to delete your key or disable your OAuth client.
12.2 We may suspend, limit or revoke your access to the API, webhooks or Log in with TopDeck at any time and at our discretion, including if you breach these terms, if your use puts Players, Organizers, the Services or others at risk, or if the law requires it. If your Account is restricted, Terms §14 applies.
12.3 When your access ends, stop using the API and promptly delete API Data that contains personal data, unless the law requires you to keep it. §§5.5, 7, 8, 9, 13 and 14 continue after termination.
13. Ownership, feedback and disclaimers
13.1 TopDeck owns the Services, the API and the documentation. You own your app. Feedback you give us is covered by Terms §16.
13.2 THE API, WEBHOOKS, LOG IN WITH TOPDECK AND ALL API DATA ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY AND NON-INFRINGEMENT. WE PROVIDE NO SERVICE LEVEL, UPTIME OR SUPPORT COMMITMENT, AND WE DON'T WARRANT THAT THEY WILL BE AVAILABLE, UNINTERRUPTED OR ERROR-FREE, THAT WEBHOOKS WILL BE DELIVERED, OR THAT API DATA (INCLUDING RESULTS ENTERED BY ORGANIZERS) IS ACCURATE OR COMPLETE.
13.3 TO THE EXTENT THE LAW ALLOWS, TOPDECK'S LIABILITY UNDER THESE TERMS IS EXCLUDED AND LIMITED AS SET OUT IN THE LIMITATION OF LIABILITY IN THE TERMS OF SERVICE (TERMS §22).
14. Indemnity and general
14.1 You will defend, indemnify and hold harmless TopDeck and its officers, employees and agents against third-party claims, and related losses, fines and reasonable legal fees, arising from your app, your handling of API Data, or your breach of these terms or the law. This §14.1 doesn't apply to you if you're a consumer in the EU, EEA or UK.
14.2 The dispute-resolution, governing-law and general terms of the Terms of Service (Terms §§24–27) apply to these terms.
14.3 Contacts: general and API questions, [email protected]; security vulnerabilities and incidents, [email protected]; privacy, [email protected]; legal notices, [email protected], or by post to Eminence Gaming LLC, 651 N. Broad St., Ste. 201, Middletown, DE 19709, USA.