blasts.dev

Blasts.app API Terms of Service

DRAFT — NOT YET IN EFFECT. These Terms are under legal review and are published for preview only. They do not currently bind any party. The operative terms for existing integrators remain their individual agreements with TIPS Marketing Services Corp until a final version is posted with an effective date.

Provider: TIPS Marketing Services Corp (“TIPS,” “we,” “us”)
Service: the Blasts.app APIs, including the Partner API, Client API, SDKs, sandbox keys, documentation, and any successor interfaces (collectively, the “API”)
Version: 1.1 — Draft  ·  Effective Date: [not yet effective]

1. Acceptance and Scope

By requesting, receiving, or using any API credential — including sandbox keys (pk_test_*), organization API keys, employee seat tokens (emp_live_*), or client-lane session tokens — you (“Developer”) agree to these Terms. If you accept on behalf of an entity, you represent that you are authorized to bind that entity.

Use of a single API credential constitutes acceptance. No signature is required.

We may modify these Terms at any time. Material changes take effect 30 days after posting to blasts.dev, except changes required for security, legal compliance, or abuse prevention, which take effect immediately.

2. License Grant — Narrow and Revocable

Subject to these Terms, TIPS grants Developer a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to call the API solely to build and operate an application that interoperates with the Blasts.app service.

This license does not grant, and Developer shall not assert, any right to:

All rights not expressly granted are reserved.

2A. Patent Notice — Patent Pending

2A.1 Notice. The Blasts.app service, including without limitation the screen-blast delivery mechanism, the consent-based recipient inbox, the multi-channel “Find Me” forwarding architecture, and the umbrella municipal delegation model, is the subject of one or more pending United States patent applications filed by TIPS Marketing Services Corp. PATENT PENDING.

2A.2 Actual notice. Developer acknowledges that these Terms constitute actual notice of TIPS's published patent application(s) for purposes of 35 U.S.C. § 154(d). Developer further acknowledges that, should any such application issue as a patent, TIPS may be entitled to seek a reasonable royalty for use of the claimed invention occurring on or after the date of publication of the application, for any party having actual notice thereof.

2A.3 No license. Nothing in these Terms grants Developer any license, express or implied, under any TIPS patent or patent application. The license granted in Section 2 is limited to calling the API as documented and expressly excludes any right to practice, implement, or replicate the claimed subject matter independently of the Blasts.app service.

2A.4 No challenge; no design-around from disclosure. Developer shall not use information obtained through the API, the documentation, or these Terms to design, develop, or file applications directed to substantially similar subject matter.

2A.5 Application numbers. Application numbers and publication references are available on request to support@blasts.app and, once published, may be listed at https://blasts.app/patents.

3. Naming, Trademark, and Attribution — Strict

3.1 Prohibited names. Developer shall not use, register, or apply to register any name, mark, domain, social handle, app-store listing, package name, repository name, or library name that consists of, contains, or is confusingly similar to: “Blasts,” “Blasts.app,” “Screen Blasts,” “Email Blasts,” “Blast Off,” “Save by Giving,” or any TIPS mark, in any language or transliteration.

This prohibition applies to compound and suffixed forms (for example, and without limitation: BlastsKit, BlastsSDK, Blasty, ScreenBlast Pro, Blasts for Mac).

3.2 Required attribution. Any application, library, or documentation that uses the API must display, in a location visible to end users, the phrase “Powered by Blasts.app” with a link to https://blasts.app/. Attribution may not be styled to imply endorsement, partnership, certification, or joint ownership.

3.3 No implied endorsement. Developer shall not state or imply that its application is official, certified, approved, endorsed by, or affiliated with TIPS without a separate written agreement.

3.4 Cure period: none for naming. A violation of Section 3.1 is a material breach permitting immediate credential revocation under Section 11 without notice or cure period.

4. Prohibited Uses — Competitive and Extractive

Developer shall not, directly or through any affiliate, contractor, or agent:

5. Credential Security — Non-Negotiable

5.1 Never embed organization credentials in distributed software. Organization API keys and HMAC signing secrets are server-side credentials only. Developer shall not embed, ship, or otherwise expose them in any client-distributed application (desktop, mobile, browser extension, or otherwise), repository, package, or configuration file accessible to end users.

Applications distributed to end users must use the employee seat token lane (emp_live_*) or the client lane (machine_id + session token) as documented.

5.2 Rotation and compromise. Developer shall rotate credentials on personnel changes and shall notify security@blasts.app within 24 hours of any known or suspected credential compromise.

5.3 No credential sharing. Credentials are issued to Developer and may not be shared across organizations, sold, or transferred, including in a change of control, without TIPS's prior written consent.

5.4 Encryption integrity. Developer shall not attempt to intercept, weaken, downgrade, log, or circumvent the end-to-end encryption model, and shall not transmit decrypted message content to TIPS or to any third party.

5.5 E2EE non-interference. Without limiting Section 5.4, Developer shall not attempt to inspect, proxy, log, decrypt, or weaken the end-to-end encryption envelope (crypto suite v1_p256_aesgcm, “E2EE_SUITE_V1_P256”), nor initiate or facilitate any unauthorized device rebind, device-link takeover, or session-token manipulation, nor attempt to intercept, extract, or exfiltrate any end user's local key pair. Any such attempt is a material breach resulting in immediate permanent credential revocation under Section 11, in addition to all other remedies.

5.6 Automated monitoring and revocation. TIPS employs automated security monitoring. Any detected exposure of an organization API key or HMAC signing secret in a public code repository, client-side web application, distributed binary, or other publicly accessible location may trigger instant, automated revocation of the affected credential and suspension of the associated account, without prior notice. TIPS may additionally, at its discretion, block network sources associated with the exposure. Automated revocation is a security measure, not a waiver of any other remedy.

5.7 Webhook integrity. Developer shall verify the HMAC signature on every webhook delivery before acting on it, shall receive webhooks only over HTTPS, and shall not forge, replay, or spoof webhook events to TIPS, to itself, or to any third party. Developer is responsible for actions its systems take in response to unverified payloads.

6. End-User Consent and Messaging Compliance

6.1 Opt-in required. Developer shall only transmit messages to recipients who have given affirmative, documented consent to receive them through the Blasts.app service. Purchased, scraped, appended, or inferred lists are prohibited.

6.2 Applicable law. Developer is solely responsible for compliance with all laws applicable to its messaging, including without limitation the CAN-SPAM Act, the Telephone Consumer Protection Act (TCPA), state anti-spam and consumer-protection statutes, and any applicable privacy laws. TIPS is not the sender of Developer's messages and does not review message content.

6.3 Prohibited content. Developer shall not transmit content that is unlawful, fraudulent, deceptive, harassing, malware-bearing, phishing, or that violates third-party rights.

6.4 Suppression and revocation. Developer shall honor recipient opt-outs, revocations, and suppression-list entries immediately and shall not attempt to re-add a suppressed recipient.

6.5 No impersonation of TIPS system messages. Developer shall not transmit messages that impersonate, or are styled to be confused with, Blasts.app system communications — including security alerts, device-pairing or rebind notifications, verification-code (OTP) prompts, connect/consent requests, or account-recovery messages. This prohibition protects the account-takeover safeguards built into the service; a violation is a material breach permitting immediate revocation under Section 11 without cure period.

7. Data Protection

7.1 Developer is not the owner of recipient data. Contact records, message content, delivery telemetry, and resident or subscriber data accessed through the API remain the property of the originating account holder.

7.2 Prohibited uses of data. Developer shall not sell, license, transfer, or disclose data obtained through the API to any third party, nor use it for advertising, list-building, data-appending, or any purpose other than operating Developer's application for the account holder who provided it.

7.3 Deletion on termination. Within 30 days of termination or credential revocation, Developer shall permanently delete all data obtained through the API and certify deletion in writing upon request.

7.4 Security standard. Developer shall maintain commercially reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the data handled, including encryption in transit and at rest.

7.5 Breach notification. Developer shall notify security@blasts.app within 24 hours of discovering any unauthorized access to data obtained through the API.

7.6 Annual compliance certification. For holders of organization API keys or employee seat tokens (emp_live_*), TIPS may request, no more than once per twelve-month period, a written self-certification of compliance with these Terms, confirming in particular that no API data, resident or subscriber records, or delivery telemetry have been exported, sold, disclosed, or used to train, fine-tune, or evaluate any machine-learning model. Developer shall return the certification, signed by an authorized officer, within 30 days of request. Failure to certify is grounds for suspension under Section 11.

8. Government and Public-Sector Deployments

Where Developer's application is used by, or on behalf of, a governmental entity:

9. Rate Limits, Quotas, and Fair Use

TIPS publishes rate limits at blasts.dev and may adjust them at any time. TIPS may throttle, queue, or reject requests that, in its sole judgment, degrade service for other users, indicate abuse, or exceed fair use.

Sandbox credentials are for development and testing only and may not be used to serve production traffic or end users.

10. No Warranty; Limitation of Liability

10.1 AS IS. THE API IS PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, OR UNINTERRUPTED OR ERROR-FREE OPERATION.

10.2 No delivery guarantee. TIPS does not warrant that any message will be delivered, delivered within any time period, or received or read by any recipient.

10.3 Cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, TIPS'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE API SHALL NOT EXCEED THE GREATER OF (A) AMOUNTS PAID BY DEVELOPER TO TIPS FOR API ACCESS IN THE THREE (3) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS ($100).

10.4 Exclusions. IN NO EVENT SHALL TIPS BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST DATA, BUSINESS INTERRUPTION, OR PROCUREMENT OF SUBSTITUTE SERVICES, EVEN IF ADVISED OF THE POSSIBILITY.

11. Suspension, Revocation, and Termination — Immediate

11.1 Immediate revocation without notice. TIPS may suspend or permanently revoke any or all credentials immediately and without prior notice if TIPS determines, in its sole and reasonable judgment, that Developer has:

11.2 Termination for convenience. Either party may terminate on 30 days' written notice. TIPS may discontinue the API, or any lane or endpoint, on 90 days' notice, except where a shorter period is required for security or legal reasons.

11.3 No refund on revocation for cause. Amounts prepaid are non-refundable where credentials are revoked under Section 11.1.

11.4 Effect. On termination, Developer shall immediately cease all API use, remove all attribution and TIPS marks, and comply with Section 7.3 (deletion).

11.5 Survival. Sections 2 (reserved rights), 2A, 3, 4, 5.4–5.5, 7 (including 7.6 for certifications requested before termination), 10, 11.3–11.5, 12, 13, 14, and 15.7–15.8 survive termination.

12. Indemnification

Developer shall defend, indemnify, and hold harmless TIPS, its officers, directors, employees, and agents from and against any claim, demand, action, loss, liability, damage, cost, or expense (including reasonable attorneys' fees) arising out of or relating to: (a) Developer's application; (b) Developer's messages or message content; (c) Developer's breach of these Terms; (d) Developer's violation of any law or third-party right, including privacy, publicity, intellectual property, and anti-spam laws; or (e) any claim by an end user or governmental entity relating to Developer's application.

13. Equitable Relief

Developer acknowledges that a breach of Section 3 (naming/trademark), Section 4 (prohibited uses), Section 5 (credential security), or Section 7 (data protection) would cause irreparable harm for which monetary damages are inadequate, and that TIPS is entitled to seek injunctive relief without posting bond, in addition to all other remedies.

In any action to enforce Section 3, 4, 5, or 7, the prevailing party shall be entitled to recover its reasonable attorneys' fees and costs.

14. Governing Law and Venue

These Terms are governed by the laws of the State of New Jersey, without regard to conflict-of-laws principles. The exclusive venue for any dispute is the state and federal courts located in Essex County, New Jersey, and each party consents to personal jurisdiction there.

15. General

15.1 Independent contractors. Nothing creates a partnership, joint venture, agency, or employment relationship.

15.2 Assignment. Developer may not assign these Terms, by operation of law or otherwise, without TIPS's prior written consent. TIPS may assign freely.

15.3 Entire agreement. These Terms, together with the published API documentation and any separately signed agreement, constitute the entire agreement and supersede all prior understandings.

15.4 Severability. If any provision is held unenforceable, it shall be modified to the minimum extent necessary and the remainder shall remain in effect.

15.5 No waiver. Failure to enforce any provision is not a waiver.

15.6 Notices. To TIPS: support@blasts.app. To Developer: the email associated with Developer's API credential.

15.7 Feedback. If Developer provides suggestions, feature requests, bug reports, or other feedback regarding the API or the Blasts.app service, TIPS may use and incorporate that feedback without restriction, attribution, or compensation, and Developer grants TIPS a perpetual, irrevocable, worldwide, royalty-free license to do so.

15.8 Export control and sanctions. Developer represents that it is not located in, organized under the laws of, or ordinarily resident in any jurisdiction subject to comprehensive U.S. sanctions, and is not listed on any U.S. government restricted-party list. Developer shall comply with all applicable export-control and sanctions laws in its use of the API.

Contact: support@blasts.app · https://blasts.app/