API Terms of Service

Noteboxd Developer Platform Last updated: 3 July 2026 Effective: 3 July 2026

1. Agreement to These Terms

These API Terms of Service ("API Terms") govern your access to and use of the Noteboxd Developer Platform, including the Noteboxd API, developer dashboard, API keys, OAuth applications, and related documentation (together, the "API"). The Developer Platform is available at developers.noteboxd.com.

By creating a developer account, generating an API key, registering an OAuth application, or otherwise using the API, you agree to be bound by these API Terms. These API Terms supplement — and do not replace — the Noteboxd Terms of Service, Privacy Policy, and Acceptable Use Policy, all of which are incorporated by reference. Where these API Terms conflict with the general Terms of Service on a matter specific to the API, these API Terms prevail.

If you are accessing the API on behalf of an organisation, you represent that you have authority to bind that organisation, and "you" refers to that organisation.

2. Developer Accounts

2.1 One Account

Your developer account is the same Noteboxd account you use as a consumer. If you are signed in to noteboxd.com, you are signed in to the Developer Platform. You do not create a separate developer login.

2.2 Organisation and Projects

Account-level settings (organisation name, billing, prepaid balance, auto-recharge) apply to your whole developer account. API keys and OAuth applications are organised under Projects, which let you separate credentials and usage by workload or client. You are responsible for all activity under every Project, key, and application in your account.

2.3 Eligibility

You must be at least 18 years old and legally capable of entering into contracts to use the API. You must not use the API if you are barred from doing so under applicable law or a prior termination.

3. API Keys and Credentials

3.1 Key Security Is Your Responsibility

API keys (nb_live_…) and OAuth client secrets (nb_secret_…) are shown to you once, in full, at the time of creation. Noteboxd stores only a hashed form and cannot recover the plaintext. You are solely responsible for:

• Keeping keys and secrets confidential and out of client-side code, public repositories, logs, and screenshots
• Storing credentials in a secrets manager or equivalent secure store
• Rotating and revoking credentials that are exposed, suspected of exposure, or no longer needed
• All usage and charges incurred under your credentials, including usage by third parties who obtain them through your act or omission

3.2 Rotation and Revocation

The dashboard provides key rotation with a configurable grace period (1–72 hours, default 24) so you can migrate without downtime. Revoked keys stop working immediately at the end of any grace period. You must revoke any credential you believe has been compromised and notify us at [email protected].

3.3 No Sharing or Resale of Credentials

You may not sell, sublicense, or transfer your API keys or client secrets, or share them across unrelated products, without our written consent.

4. Acceptable Use

You may use the API to build applications, integrations, and analyses that add value for fragrance enthusiasts and comply with these API Terms. When using the API you must:

• Send accurate, non-forged request headers, including a descriptive User-Agent
• Cache responses reasonably and avoid redundant requests
• Respect the rate limits and pricing applicable to your tier (Section 5)
• Attribute Noteboxd as the data source where you display Noteboxd content, and follow any branding guidance we publish
• Honour user privacy and the scope of consent granted through OAuth (Section 7)

5. Rate Limits, Tiers, and Fair Use

5.1 Tiers

Access is metered by pricing tier. Current tiers and limits:

Tier limits, per-endpoint pricing, and the endpoint catalogue are published on the Developer Platform and may be updated as described in Section 11. Per-call prices vary by endpoint (for example, search and note lookups cost less than batch or enrichment calls).

5.2 Enforcement

When you exceed a rate limit we return HTTP 429 Too Many Requests with a Retry-After header. When your prepaid balance is exhausted and auto-recharge is off or unavailable, we return HTTP 402 Payment Required. You must back off and retry in accordance with these responses rather than retrying aggressively.

5.3 Fair Use

Even within your tier limits, we may throttle, suspend, or contact you if your usage threatens the stability, security, or integrity of the Platform or degrades service for other users.

6. Billing

6.1 Provider

API billing is processed by Polar. By topping up a balance or enabling auto-recharge you authorise Polar to charge your saved payment method for amounts you initiate or that auto-recharge triggers.

6.2 Prepaid Balance and Usage

Paid tiers draw down a prepaid balance as you make billable calls, at the per-endpoint prices published on the Developer Platform. You can view usage, per-endpoint breakdowns, and billing history in the dashboard.

6.3 Auto-Recharge

If you enable auto-recharge, we top up your balance by your configured amount when it falls below your configured threshold, using your saved payment method. You may disable auto-recharge at any time in account settings.

6.4 Non-Refundable; Taxes

Prepaid balances and usage charges are non-refundable except where required by law. Prices are exclusive of taxes; you are responsible for any applicable taxes.

6.5 Pro Allowance

The Pro-included tier grants a monthly API allowance bundled with a Noteboxd Pro subscription. The allowance resets monthly, does not roll over, and has no cash value. If your Pro subscription ends, the associated allowance and tier benefits end.

7. OAuth Applications and User Data

7.1 Scopes and Consent

OAuth applications may only request access to a user's Noteboxd data through the defined scopes, and only with that user's explicit consent. Available scopes are:

• read:cabinet — read the user's fragrance cabinet
• read:wishlist — read the user's wishlist
• read:collections — read the user's collections
• read:reviews — read the user's reviews
• read:wearing — read the user's wearing history
• read:profile — read the user's public profile
• write:wearing — record wearing activity on the user's behalf

7.2 Minimum Necessary Access

You must request only the scopes your application genuinely needs, present an accurate description of your application to users, and use redirect URIs that you control (HTTPS, or http://localhost for development only).

7.3 Handling User Data

User data obtained through the API is subject to the Noteboxd Privacy Policy and applicable data-protection law. You must:

• Use user data only for the purposes disclosed to, and consented to by, the user
• Not sell user data or use it for advertising profiling, surveillance, or resale
• Protect user data with appropriate security controls
• Delete a user's data when they revoke access, when it is no longer needed for the disclosed purpose, or on request, except where retention is required by law
• Provide your own privacy policy to your users covering your handling of their data

7.4 Revocation

Users may revoke your application's access at any time. You must stop accessing their data once access is revoked.

8. Prohibited Uses

You may not, and may not permit any third party to:

• Use the API to build or train a competing fragrance database or a substantially similar service, or to bulk-export or scrape the dataset beyond what a normal application requires
• Circumvent, disable, or interfere with rate limits, billing, authentication, or other protective measures
• Share, pool, or rotate keys to evade limits or metering
• Access data belonging to users who have not granted your application the relevant OAuth scope
• Use the API for unlawful, deceptive, infringing, harassing, or harmful purposes, or in violation of the Acceptable Use Policy
• Misrepresent your identity, your application, or your affiliation with Noteboxd
• Introduce malware or attempt to gain unauthorised access to the Platform or its infrastructure
• Resell or commercially exploit the API except as expressly permitted by these API Terms

Violation may result in immediate suspension or termination of API access and, where appropriate, referral to law enforcement.

9. Intellectual Property and Attribution

Noteboxd retains all rights in the API, the developer dashboard, and — as set out in the general Terms of Service — the selection, arrangement, and presentation of data. Factual fragrance data (names, brands, perfumers, notes) is not claimed as proprietary, but the compiled dataset and its presentation are.

We grant you a limited, non-exclusive, non-transferable, revocable licence to access the API and use API responses solely to operate your application in accordance with these API Terms. You must not remove attribution or imply that Noteboxd endorses your application without our written consent.

10. Service Availability and Changes to the API

We aim for high availability but do not guarantee uninterrupted or error-free API service, except under an Enterprise agreement that expressly provides an SLA. We may add, change, deprecate, or remove endpoints and fields. For material breaking changes we will give reasonable advance notice through the developer documentation, dashboard, or email where practicable. You are responsible for keeping your integration current.

11. Changes to These API Terms

We may update these API Terms from time to time. We will notify you of material changes by email or by prominent notice on the Developer Platform at least 14 days before they take effect. Continued use of the API after changes take effect constitutes acceptance. If you do not accept the changes, you must stop using the API.

12. Suspension and Termination

12.1 By You

You may stop using the API at any time by revoking your keys and applications and, if you wish, deleting your developer data through account settings.

12.2 By Us

We may suspend or terminate your API access, in whole or in part, immediately if you breach these API Terms, the general Terms of Service, or the Acceptable Use Policy; if your usage threatens the Platform or its users; if required by law; or in connection with fraud or abuse. We will give notice where we are permitted to do so, and you may appeal by contacting [email protected].

12.3 Effect of Termination

On termination, your right to access the API ends and your keys and applications stop working. You must cease using and delete cached Noteboxd data and user data obtained through the API, except where retention is required by law. Sections that by their nature should survive (including intellectual property, disclaimers, limitation of liability, indemnity, and outstanding payment obligations) survive termination.

13. Disclaimer of Warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE API IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, OR NON-INFRINGEMENT. We do not warrant that the API will be uninterrupted, error-free, or that fragrance data is accurate, complete, or current. Nothing in these API Terms excludes liability that cannot be excluded under applicable law.

14. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

1. Noteboxd's total liability to you for any claim arising from these API Terms or your use of the API shall not exceed the greater of: (a) the amount you paid to Noteboxd for API access in the 12 months preceding the claim, or (b) US$100.
2. Noteboxd shall not be liable for any indirect, incidental, consequential, special, or punitive damages, including loss of profits, data, or goodwill, even if advised of the possibility of such damages.
3. Noteboxd is not liable for the conduct of your application's end users or for how you use API data.

These limitations apply regardless of the form of action.

15. Indemnity

You agree to indemnify, defend, and hold harmless Noteboxd and its officers, directors, employees, and agents from and against any claims, damages, costs, and expenses (including reasonable legal fees) arising from: (a) your use of the API; (b) your application and its handling of user data; (c) your violation of these API Terms; or (d) your violation of any third party's rights or applicable law.

16. General

Governing law and disputes. Before bringing a formal claim, contact us at [email protected] to resolve disputes informally. Disputes are otherwise handled in accordance with the governing-law and dispute provisions of the general Terms of Service. Nothing removes mandatory consumer-protection rights available under the law of your country or state of residence.

Entire agreement. These API Terms, together with the general Terms of Service, Privacy Policy, and Acceptable Use Policy, constitute the entire agreement between you and Noteboxd regarding the API.

Severability. If any provision is found unenforceable, it will be modified to the minimum extent necessary, or severed, and the remaining provisions will remain in full force.

No waiver. Our failure to enforce any provision is not a waiver of our right to do so later.

Assignment. You may not assign your rights or obligations under these API Terms without our prior written consent. We may assign ours in connection with a merger, acquisition, or sale of assets.

Contact: [email protected]