Staminabar Developer Terms

Effective date: October 17, 2026
Last updated: October 17, 2026

Draft prepared for attorney review. Not legal advice.

These Developer Terms are an agreement between Lynn Allen Holdings, LLC, a Georgia limited liability company doing business as Staminabar ("Staminabar", "we", "us"), and the company or individual that integrates a game, mod, or other software with Staminabar ("Developer", "you"). If you accept on behalf of a company, you confirm that you have authority to bind it, and "you" means that company.

Summary

This summary is for convenience. The numbered sections below control.

What you get. Access to a player's nine game attributes (readiness, rest, exertion, discipline, stamina, power, mobility, balance, constitution) after the player approves your Product in the Staminabar app. You never receive raw health readings, names, emails, or Staminabar user IDs.
How you connect. Only through a server you control (your Product Server). Game clients never hold your Product Secret and never talk to Staminabar directly. Each pairing uses its own ES256 keypair that your Product Server generates and keeps.
What you may do with attributes. Power in-game gameplay features the player asked for. Nothing else.
What you may not do. Advertising, marketing, profiling, selling, sharing, analytics resale, AI training, re-identification, cross-Product correlation, employment/insurance/credit decisions, medical claims, wagering, or public display without the player's separate opt-in.
Revocation is fast. When a player removes your Product, stop using their attributes within 60 seconds of receiving the revocation and purge any stored attributes within 30 days.
Security. Product Secret in a secret manager, private keys encrypted at rest, TLS on your delivery endpoint, and notice to us within 72 hours of a suspected compromise or incident.
Players are adults. Players must be 18 or older. Do not target minors with Staminabar features.
Money. No fees today. Any future fees come only from an Order Form or published pricing with 30 days notice.
We can act quickly. We may suspend your Product or revoke your secrets immediately when players or the platform are at risk.
Law and venue. Georgia law; state or federal courts in Fulton County, Georgia; mutual jury waiver; 30 days of good-faith negotiation first.

1. Definitions

Capitalized terms have these meanings.

1.1 "Organization" means the account record Staminabar creates for you. An Organization owns one or more Products.

1.2 "Product" means a game, mod, plugin, or other software that you register with Staminabar under your Organization and that requests Attributes for Players. Each Product has its own name, publisher name, logo, scopes, delivery endpoint, and verification status as recorded by Staminabar.

1.3 "Product Server" means the server software and infrastructure, controlled by you or operated by Staminabar for you under Section 13, that holds the Product Secret, requests Pairings, generates and stores per-Pairing private keys, receives Deliveries, calls the Staminabar API, and relays Attributes to your Product's game clients.

1.4 "Product Secret" means the secret API credential Staminabar issues to a Product (currently in the form sbs_dev_... or sbs_prod_...). Staminabar shows it once at issuance and stores only a hash of it.

1.5 "Delivery Secret" means the per-Product secret Staminabar uses to sign Deliveries so your Product Server can verify them.

1.6 "Delivery" means a signed message Staminabar sends to your registered delivery endpoint reporting the outcome of a Pairing (completed, denied, or expired) or a Revocation.

1.7 "Pairing" means the brokered consent flow in which your Product Server requests a pairing session from Staminabar, your game client shows the Player a QR code or pairing link, and the Player reviews your Product's verified details in the Staminabar app and chooses Allow or Deny.

1.8 "Connection" means the authorization that results when a Player chooses Allow in a Pairing. A Connection is identified by a client ID and a key ID and is bound to one public key registered by your Product Server. A Connection lasts until it is revoked, expires, or the Player deletes their Staminabar account.

1.9 "Attributes Payload" or "Attributes" means the derived data Staminabar returns for a Connection, consisting only of:

(a) as_of, the date the scores describe;
(b) stale, a flag that is true when the newest scored day is more than 2 days old (Staminabar may change this freshness window under Section 16.3); and
(c) nine attributes: readiness, rest, exertion, discipline, stamina, power, mobility, balance, and constitution, each with six fields: score (0 to 100, or null), tier (peak, good, baseline, low, or depleted), state (scored, pending, or unscorable), trend (improving, declining, stable, or insufficient_data), delta_from_mean (score points relative to that Player's own baseline), and cadence (daily or slow).

Attributes are derived from a Player's health and fitness data. Staminabar and applicable law treat them as consumer health data. Any copy, cache, transformation, or inference you make from Attributes is also treated as Attributes under these Terms.

1.10 "Player" means an individual who has a Staminabar account and who pairs, or is invited to pair, with your Product.

1.11 "Revocation" means the end of a Connection, whether because the Player removed your Product in the Staminabar app, deleted their Staminabar account, the connection key expired without renewal, or Staminabar revoked it under these Terms. A Revocation Delivery is the Delivery that reports it.

1.12 "Documentation" means the technical documentation, integration guides, API references, and rate limit notices Staminabar provides to you, as updated from time to time.

1.13 "Staminabar API" means the Staminabar interfaces your Product Server uses to create pairing sessions, read pairing results, and read Attributes, together with Deliveries.

1.14 "Staminabar Marks" means the Staminabar name, logos, and the "Works with Staminabar" badge, in the forms Staminabar supplies.

1.15 "Order Form" means a written ordering document or agreement signed by both parties that references these Terms.

1.16 "Applicable Law" means all laws and regulations that apply to a party's activities under these Terms, including those listed in Section 9.

1.17 "Security Incident" means any actual or reasonably suspected unauthorized access to, use of, or disclosure of Attributes, a Product Secret, a Delivery Secret, or a per-Pairing private key, or any compromise of a Product Server.

1.18 "Consumer Terms" means the Staminabar Terms of Service (https://staminabar.io/terms), the Staminabar Privacy Policy (https://staminabar.io/privacy), and the Staminabar Consumer Health Data Privacy Policy (https://staminabar.io/consumer-health-data) that govern Players' use of Staminabar.

2. Accepting these Terms

2.1 You accept these Terms by signing an Order Form or onboarding acknowledgment that references them, or by using a Product Secret or the Staminabar API.

2.2 You must be a business, or an individual acting for business or professional purposes, and at least 18 years old. These Terms are not a consumer contract.

2.3 If you and Staminabar sign an Order Form, the Order Form controls over these Terms for the subject it covers (see Section 26.6).

3. Onboarding and access

3.1 Operator-run onboarding. Staminabar currently onboards Developers by hand. There is no self-serve developer portal. Staminabar creates your Organization and each Product, records the Product's display name, publisher name, scopes, and delivery endpoint, sets your logo and catalog listing, and issues your Product Secret and Delivery Secret. Staminabar will tell you if and when a self-serve process replaces this one.

3.2 Review and verification. A Product can run Pairings only after Staminabar marks it verified. Staminabar decides whether to verify a Product in its discretion, may ask for information about your game, your Product Server, your privacy practices, and your security controls, and may decline or withdraw verification at any time.

3.3 Accurate information. You will give Staminabar accurate and current information about your Organization and each Product, including the legal name of the publisher, the delivery endpoint, and a security and privacy contact, and you will tell Staminabar within 10 business days when any of it changes. Players see your Product's name, publisher, and logo on the consent screen exactly as Staminabar records them; they must not mislead Players.

3.4 Scopes. Your access is limited to the scopes Staminabar assigns to your Product. Today the only scope is read access to the Attributes Payload.

3.5 Environments. Staminabar may provide development credentials (sbs_dev_) and production credentials (sbs_prod_). Development environments may be reset, may carry test data, and are not for live Players unless Staminabar agrees in writing.

3.6 Your accounts. You are responsible for everything done with your Product Secret, Delivery Secret, and Product Server, whether or not you authorized it.

4. License to use the Staminabar API

4.1 License. Subject to these Terms, Staminabar grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license during the Term to use the Staminabar API and Documentation solely to integrate your verified Products with Staminabar and to provide Attribute-based gameplay features to Players who have an active Connection.

4.2 Restrictions. You will not, and will not let anyone else:

(a) reverse engineer, decompile, or attempt to derive the methods Staminabar uses to compute Attributes, except to the extent Applicable Law expressly permits despite this restriction;
(b) access the Staminabar API other than through a Product Server, or by any means other than the interfaces described in the Documentation;
(c) build a product whose primary purpose is to replicate or compete with Staminabar using the Staminabar API or Attributes;
(d) resell, sublicense, or provide access to the Staminabar API or Attributes to any third party, except as Section 8.8 allows for subprocessors;
(e) probe, scan, or test the vulnerability of Staminabar systems, except under Section 11.7;
(f) interfere with or disrupt Staminabar services or other Developers' Products; or
(g) use the Staminabar API in violation of Applicable Law or these Terms.

5. Integration requirements

5.1 Brokered flow only. You will integrate only through the brokered Pairing flow described in the Documentation, in which your Product Server, and never a game client, holds the Product Secret, creates pairing sessions, holds per-Pairing private keys, and calls the Staminabar API. A game client, game build, mod file, or other software distributed to Players may communicate only with your Product Server. Staminabar does not support game clients calling the Staminabar API directly.

5.2 Server you control. Your Product Server must run on infrastructure you control and administer (or that Staminabar operates for you under Section 13). You may use a hosting or cloud provider as a subprocessor under Section 8.8, but you remain responsible for the Product Server.

5.3 Per-Pairing keys. For each Pairing, your Product Server must generate a new ES256 (ECDSA P-256) keypair and register only the public key with Staminabar. Private keys must:

(a) be generated on, and never leave, your Product Server;
(b) be encrypted at rest using authenticated encryption with keys kept separate from the encrypted data;
(c) never be sent to game clients, Staminabar, or any third party, and never be written to logs; and
(d) be deleted promptly on Revocation of the related Connection, and in any event within 24 hours.

5.4 Product Secret and Delivery Secret handling. You will:

(a) store the Product Secret and Delivery Secret only in a secret manager or equivalent encrypted secret store with access limited to the Product Server and the personnel who need it;
(b) never place either secret in a game client, game build, mod, installer, configuration file shipped to Players, source code repository, container image, ticket, chat message, or log; and
(c) never share either secret with any third party, other than a subprocessor under Section 8.8 that needs it to run your Product Server.

5.5 Rotation and compromise. If you know or reasonably suspect that a Product Secret, Delivery Secret, or private key has been exposed, you will notify Staminabar at security@staminabar.io without undue delay and in any event within 72 hours, and cooperate with Staminabar to rotate the affected credential. Staminabar will issue a replacement Product Secret and revoke the old one, and may revoke affected Connections. You will also rotate credentials when Staminabar reasonably requests it.

5.6 Signed requests. Your Product Server will sign requests for Attributes with the private key for the relevant Connection in the format the Documentation describes, including a current timestamp and a single-use nonce. You will not reuse nonces, replay requests, or share a key across Connections or Products.

5.7 Deliveries. Your delivery endpoint must use HTTPS with a currently valid certificate and must be the endpoint Staminabar has on record for the Product. You will verify the signature on every Delivery using your Delivery Secret before acting on it, reject Deliveries that fail verification, and treat Deliveries as idempotent because Staminabar may retry them.

5.8 TLS. All communication between your Product Server and your game clients that carries Attributes, pairing links, or pairing codes must use TLS, except for local development on a single machine.

5.9 Honoring Revocation. On receiving a Revocation Delivery, or any response from the Staminabar API indicating that a Connection is revoked, expired, or unauthorized, you will:

(a) stop using that Player's Attributes for live gameplay, stop requesting their Attributes, and remove Attribute-based effects driven by new or cached values, within 60 seconds of receipt;
(b) delete the related private key under Section 5.3(d); and
(c) purge all Attributes you or your subprocessors store for that Connection, including caches, databases, logs, and analytics stores, within 30 days, except for backups that are overwritten in their normal cycle within 35 days and are not restored for any purpose other than disaster recovery.

5.10 Player-held save data. Where your game stores Attribute-derived values only on the Player's own device (for example, in a local save file), that data is under the Player's control and Section 5.9(c) does not require you to reach into the Player's device. You will not collect, upload, or sync that data to your servers or any third party, other than through a cloud-save feature the Player has turned on that stores it solely for that Player's own gameplay, and you will apply Section 5.9(a) to any live effects the next time the game runs.

5.11 Rate limits. You will comply with the rate limits and usage quotas Staminabar sets in the Documentation or communicates to you, will back off when the Staminabar API returns a rate limit response, and will not attempt to circumvent rate limits, including by spreading requests across multiple Product Secrets, Products, IP addresses, or keys. Staminabar may change rate limits on notice, and immediately where needed to protect the service.

5.12 No scraping or workarounds. You will not attempt to obtain Attributes for a Player without a Pairing, keep using a Connection after Revocation, obtain Attributes through any channel other than the Staminabar API, or interfere with the Staminabar consent screen or the Player's ability to Deny or remove access.

5.13 Pairing presentation. You will present pairing QR codes and links only to the Player who requested to connect, only while the pairing session is pending, and will not log, store, or transmit pairing codes or pairing links beyond what the Pairing requires. You will not pre-select, incentivize in a misleading way, or pressure the Player's choice, and will not make your core game unplayable for a Player who chooses Deny or later removes access.

5.14 Changes to your Product. You will tell Staminabar before you change your delivery endpoint, materially change how your Product uses Attributes, or transfer your Product to another publisher. Staminabar may require re-verification.

6. Permitted use of Attributes

6.1 Purpose limitation. You may use Attributes only to provide in-game gameplay features that the Player has chosen to enable by completing a Pairing with your Product, such as adjusting character statistics, buffs, difficulty, or in-game displays of the Player's own Attributes to that Player. This is the "Permitted Purpose".

6.2 Minimum necessary. You will request, process, and retain only the Attributes your gameplay features need, for the shortest time needed. You will not request Attributes more often than your gameplay needs, and in any event not more often than the Documentation allows. Attributes change about once a day.

6.3 Retention. Unless a shorter period applies under these Terms, you will not keep Attributes on your servers longer than needed for the Permitted Purpose and in any event not longer than 30 days after you receive them, except as part of the Player's own game state under Section 5.10. Attribute-derived gameplay outcomes that no longer reveal any Attribute value (for example, an in-game item the Player earned) are not Attributes.

6.4 Disclosure to Players. You will tell Players, in your game or mod and in your privacy policy, before they pair: which features use Attributes, how those features affect gameplay, what you store and for how long, and how to disconnect.

7. Prohibited uses of Attributes

Attributes are derived from consumer health data. Without limiting Section 6, you will not, and will not allow any third party to:

7.1 use Attributes for advertising, marketing, ad targeting, ad measurement, or retargeting, including within your own game;

7.2 sell, rent, lease, license, trade, or otherwise transfer Attributes for money or other valuable consideration, or act as a data broker for Attributes;

7.3 share or disclose Attributes to any third party, except a subprocessor under Section 8.8 or as required by law under Section 8.9;

7.4 use Attributes for profiling or segmentation for any purpose other than the Permitted Purpose, or for analytics that you sell, license, or share with others;

7.5 use Attributes, alone or combined with other data, to make or support decisions about a person's employment, insurance, credit, housing, education, healthcare, benefits, or any other eligibility determination;

7.6 use Attributes to train, fine-tune, evaluate, or improve any artificial intelligence or machine learning model, other than a model that runs solely to deliver that Player's own gameplay and that does not retain Attributes beyond Section 6.3;

7.7 combine Attributes with other data to identify, or attempt to identify, a Player, or to infer a Player's identity, location, or health condition;

7.8 correlate or link a Player's Attributes or Connection identifiers across different Products, Organizations, or developers, or with other datasets, including by using device identifiers, IP addresses, platform account IDs, or timing;

7.9 attempt to obtain, reconstruct, or infer raw health or fitness readings (such as heart rate, heart rate variability, sleep times, body measurements, or distances) from Attributes, or ask Players to provide raw health data in connection with Staminabar features;

7.10 make medical, diagnostic, therapeutic, or health claims about Attributes or your Product's use of them, or present Attributes as a measure of a Player's health, fitness, or medical condition rather than as game attributes;

7.11 display a Player's Attributes, or rankings or comparisons based on them, to anyone other than that Player, including on leaderboards, profiles, social feeds, streams, or multiplayer interfaces, unless the Player has given a separate, specific, revocable opt-in for that display, apart from the Pairing, and can withdraw it at any time;

7.12 use Attributes to discriminate against, harass, shame, or harm any Player; or

7.13 use Attributes in any way that is not described in your disclosures to Players or that violates the Consumer Terms or Applicable Law.

8. Data protection and privacy

8.1 Your privacy policy. You will maintain and follow a privacy policy that is easy for Players to find from your game or mod and that accurately describes what Attributes you receive from Staminabar, how you use them, how long you keep them, who you share them with (your subprocessors), and how Players can disconnect and request deletion. Where Applicable Law requires a consumer health data privacy policy (for example, under the Washington My Health My Data Act or Nevada law), you will publish one.

8.2 Consent. Staminabar obtains each Player's consent to share Attributes with your Product through the Pairing. You will not rely on that consent for any purpose beyond the Permitted Purpose. If Applicable Law requires additional consent for your processing, you will obtain it.

8.3 Player requests. You will honor Player requests to access or delete Attributes you hold, and requests Staminabar forwards to you, within the time Applicable Law requires and in any event within 30 days. You will tell Staminabar at legal@staminabar.io within 10 business days if you receive a Player request that relates to Staminabar's processing.

8.4 Deletion on Staminabar request. If Staminabar notifies you that a Player has deleted their Staminabar account or asked Staminabar to delete their data, you will treat that notice as a Revocation for every Connection belonging to that Player.

8.5 Security of Attributes. You will protect Attributes with administrative, technical, and physical safeguards appropriate to consumer health data, including encryption in transit and at rest, access controls limited to personnel with a need to know, logging of administrative access, and prompt patching of your Product Server.

8.6 Personnel. You will ensure that everyone who can access Attributes or your secrets is bound by confidentiality obligations and trained on these Terms.

8.7 No logging of Attributes. You will not write Attribute values, pairing codes, pairing links, tokens, or secrets to application logs, crash reports, or analytics events.

8.8 Subprocessors. You may use hosting, infrastructure, and security vendors to run your Product Server if each is bound by a written contract with data protection terms at least as protective as these Terms, uses Attributes only to provide services to you, and is not permitted to use Attributes for its own purposes. You are responsible for your subprocessors. On request you will give Staminabar a list of subprocessors that can access Attributes.

8.9 Legal requests. If a government or other third party requests Attributes from you, you will (unless legally prohibited) notify Staminabar promptly, redirect the requester to Staminabar where appropriate, disclose only what is legally required, and seek protective treatment where reasonably available.

8.10 Data Protection Addendum. The Data Protection Addendum in Section 27 forms part of these Terms.

9. Platform and legal compliance

9.1 Applicable Law. You will comply with all Applicable Law in connection with your Products and your use of Attributes, including as applicable:

(a) Section 5 of the FTC Act and the FTC Health Breach Notification Rule (16 C.F.R. Part 318);
(b) state consumer health data laws, including the Washington My Health My Data Act, Nevada consumer health data law, and Connecticut's consumer health data provisions;
(c) state comprehensive privacy laws, including the California Consumer Privacy Act as amended;
(d) the Children's Online Privacy Protection Act and state laws on minors' data;
(e) the EU General Data Protection Regulation, the UK GDPR, and similar laws where they apply to you; and
(f) consumer protection, gambling, and advertising laws.

9.2 Platform and publisher rules. You will comply with the rules of every platform, store, and publisher your Product runs on or is distributed through, including as applicable those of Apple, Google, Valve (Steam), console manufacturers, Bethesda and ZeniMax (including their mod and Creation Kit terms), Mojang and Microsoft (including the Minecraft End User License Agreement and Usage Guidelines), and mod distribution sites. You are solely responsible for confirming that your Product, including any mod, is permitted under those rules, including rules on commercial use, monetization, and use of the underlying game's assets and trademarks.

9.3 Consistency with the Consumer Terms. You will not do anything that would cause Staminabar to breach the Consumer Terms or the promises Staminabar makes to Players, including that Attributes are not used for advertising, not sold, and not shared beyond the game the Player connected. Staminabar may update the Consumer Terms, and will give you notice of changes that affect your obligations.

10. Players, age, fair play, and safety

10.1 Adults only. Staminabar accounts are for people 18 and older. You will not market, design, or promote Staminabar features to anyone under 18, will not knowingly allow a person under 18 to pair with your Product, and will not offer Staminabar features in any product or mode that is directed to children. If you learn that a Player is under 18, you will stop using their Attributes, notify Staminabar at legal@staminabar.io, and purge their Attributes under Section 5.9.

10.2 No accuracy guarantee. Attributes are game attributes computed by Staminabar from data recorded by the Player's devices and apps. Staminabar does not guarantee that Attributes are accurate, complete, current, or comparable between Players, and Attributes are measured against each Player's own baseline. Attributes may be null, stale, pending, or unscorable, and may be affected by device error, missing data, or Player manipulation.

10.3 No competitive or real-money mechanics. Because Attributes are not verified and can be spoofed, you will not use Attributes in:

(a) any wagering, betting, gambling, sweepstakes, contest, or prize mechanic;
(b) any mechanic that awards or withholds real money, cryptocurrency, NFTs, or items with real-world monetary value or that can be traded for it;
(c) ranked, competitive, or esports play, or any multiplayer mechanic where one Player's Attributes affect another Player's outcome, unless Staminabar agrees in writing; or
(d) any mechanic that charges Players money to offset or bypass Attribute effects.

10.4 Opt-in and disclosed. Attribute-based mechanics must be opt-in through the Pairing and clearly disclosed in-game before and after pairing. Players who do not pair, who Deny, or who remove access must be able to keep playing your game without Attribute effects.

10.5 No penalties beyond disclosure. You will not penalize, restrict, or disadvantage a Player based on Attributes beyond the gameplay effects you disclosed in advance. Any Attribute-based penalty must be mild, reversible, and something the Player turned on. Missing, stale, null, or unscorable Attributes must not penalize a Player.

10.6 No unsafe encouragement. You will not design features that encourage Players to exercise beyond their ability, deprive themselves of sleep, ignore pain or fatigue, or otherwise risk their health in order to improve Attributes.

10.7 Your game, your support. You are solely responsible for your Product and for support to your Players for your Product. Staminabar supports Players only for the Staminabar app and service.

11. Security incidents, audits, and cooperation

11.1 Incident notice. You will notify Staminabar at security@staminabar.io without undue delay, and in any event within 72 hours, after you become aware of a Security Incident. Your notice will describe, to the extent known, what happened, the Products, Connections, and data involved, the likely consequences, and what you are doing about it. You will supplement it as you learn more.

11.2 Response. You will promptly contain and remediate each Security Incident, preserve relevant logs and evidence, and cooperate with Staminabar's investigation.

11.3 Notifications. Unless Applicable Law requires otherwise, Staminabar decides whether and how to notify Players, regulators (including the FTC under the Health Breach Notification Rule), and others about a Security Incident involving Attributes. You will not notify Players about a Staminabar-related Security Incident without first consulting Staminabar, except where Applicable Law requires you to do so sooner. You will reimburse Staminabar's reasonable costs of notification and remediation for Security Incidents caused by your breach of these Terms.

11.4 Unauthorized disclosure is an incident. A use or disclosure of Attributes that these Terms do not permit is a Security Incident, even if no system was breached.

11.5 Information and audit. On Staminabar's reasonable request, and no more than once in any 12-month period unless there has been a Security Incident, a regulator requires it, or Staminabar has a good-faith basis to believe you are in breach, you will:

(a) complete a written security and privacy questionnaire;
(b) provide evidence of your controls, such as architecture descriptions, secret storage configuration, retention settings, and any independent audit reports you have; and
(c) allow Staminabar, or an independent auditor bound by confidentiality, to review your compliance with these Terms on 30 days notice, during business hours, in a way that minimizes disruption.
Each party bears its own audit costs, unless the audit reveals a material breach by you, in which case you will reimburse Staminabar's reasonable audit costs.

11.6 Monitoring. Staminabar may monitor use of the Staminabar API, including signals such as repeated presentation of revoked keys, to detect misuse, protect Players, and enforce these Terms.

11.7 Vulnerability reports. If you discover a vulnerability in Staminabar, report it to security@staminabar.io, do not exploit it beyond what is needed to confirm it, do not access Player data, and give Staminabar a reasonable time to fix it before any disclosure.

12. Suspension and revocation by Staminabar

12.1 Immediate action. Staminabar may, without prior notice and without liability, suspend a Product, withdraw its verification, remove it from the catalog, revoke a Product Secret, revoke some or all of its Connections, or limit its API access, if Staminabar reasonably believes that:

(a) you have breached Sections 5, 6, 7, 8, 10, or 11;
(b) a Security Incident has occurred or is likely;
(c) your Product poses a risk to Players, Staminabar, or other Developers;
(d) a platform, publisher, or regulator requires it; or
(e) Applicable Law requires it.

12.2 Notice and restoration. Staminabar will tell you what it did and why as soon as reasonably practicable, unless doing so would create a security risk or violate law, and will restore access once the cause is resolved to Staminabar's reasonable satisfaction.

12.3 Players come first. Players can remove your Product at any time in the Staminabar app. Staminabar may also revoke a Connection at a Player's request.

13. Staminabar-hosted Product Servers

13.1 When this applies. Staminabar may operate a Product Server for a Product, either for Staminabar's own first-party mods or, if Staminabar agrees in an Order Form or in writing, on your behalf ("Hosted Product Server").

13.2 First-party mods. For Products that Staminabar publishes itself, Staminabar is the Developer, and these Terms describe the standards Staminabar applies to its own Product Servers.

13.3 Hosting for you. For a Hosted Product Server operated on your behalf:

(a) Staminabar operates the Product Server infrastructure, stores the Product Secret, Delivery Secret, and per-Pairing private keys, applies Sections 5.3 through 5.11 to that infrastructure, and handles Deliveries and Revocations;
(b) Staminabar acts as your service provider and processor for the Product Server functions, and processes data on the Product Server only to run it for you, to secure it, and to comply with law;
(c) you remain responsible for your game or mod, everything your game client does with Attributes it receives from the Hosted Product Server, your disclosures to Players, your privacy policy, compliance with Sections 6, 7, 9, and 10, and the platform and publisher rules that apply to your Product;
(d) Staminabar may set the host, region, logging, and retention configuration of the Hosted Product Server and will describe them to you on request; and
(e) Staminabar may stop operating a Hosted Product Server on 30 days notice, or immediately under Section 12, and will cooperate reasonably with a transition to a Product Server you operate.

13.4 No change to Player relationship. Hosting a Product Server does not make Staminabar responsible for your game, and does not change Staminabar's own obligations to Players under the Consumer Terms.

14. Branding and catalog

14.1 "Works with Staminabar" license. Subject to these Terms, Staminabar grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license during the Term to use the Staminabar Marks, only in the forms Staminabar supplies and only to truthfully state that a verified Product works with Staminabar. You will follow any brand guidelines Staminabar provides, will not alter the Staminabar Marks, will not combine them with your marks, and will not register or use any confusingly similar name, logo, or domain. All goodwill from your use of the Staminabar Marks goes to Staminabar.

14.2 No endorsement. You will not suggest that Staminabar sponsors, endorses, certifies, or guarantees your Product, its fairness, or its compliance with law, other than the factual statement that it is verified to connect to Staminabar.

14.3 Your logo and listing. You grant Staminabar a non-exclusive, worldwide, royalty-free license during the Term, and for a reasonable wind-down period after, to use, reproduce, resize, and display the name, publisher name, logo, and description you supply for each Product, in the Staminabar app (including consent screens and the game catalog), on staminabar.io, and in materials that list games working with Staminabar. You represent that you have the rights needed to grant this license and that the materials do not infringe anyone's rights. Staminabar decides whether and how a Product appears in its catalog (for example, available, coming soon, or hidden). Logo files must meet Staminabar's published format requirements.

14.4 Third-party game marks. Neither party acquires any right in a third-party game publisher's marks under these Terms. You are responsible for your right to use any game title, asset, or mark in your Product and listing.

14.5 Publicity. Staminabar may identify you as a Developer by name and logo. Any other publicity, such as press releases or case studies, needs both parties' written approval.

15. Fees

15.1 No fees today. Staminabar does not currently charge Developers for access to the Staminabar API.

15.2 Future fees. Staminabar plans to offer tiers, including a free Sandbox tier and paid tiers. Fees will apply to you only (a) under an Order Form you sign, or (b) under pricing Staminabar publishes, with at least 30 days written notice to you before fees start or increase. If you do not agree to new fees, you may stop using the Staminabar API and terminate these Terms before they take effect.

15.3 Payment terms. Unless an Order Form says otherwise: fees are due within 30 days of invoice, are stated and payable in U.S. dollars, and exclude taxes, which you will pay (other than taxes on Staminabar's net income). Staminabar may suspend access for undisputed fees more than 30 days overdue after 10 days written notice.

15.4 Free tiers. Sandbox or other free access may carry lower limits, test data only, and fewer commitments, and Staminabar may change or end it on notice.

16. Service levels, beta status, and changes

16.1 No service levels. Unless an Order Form states service levels, Staminabar provides the Staminabar API without any uptime, support response, or performance commitment.

16.2 Beta. Staminabar is an early-stage service. Some features, environments, and interfaces are labeled beta, preview, or development. They may change, break, or be withdrawn, and may be reset without notice.

16.3 API changes. Staminabar may change the Staminabar API, the Attributes Payload, and the Documentation. For changes that would break a reasonably built integration, Staminabar will aim to give you 90 days notice, and will give at least reasonable notice, except where a shorter period is needed for security, to protect Players, or to comply with law or a platform requirement. Staminabar may add fields or values to the Attributes Payload without notice; your integration must ignore fields it does not recognize and treat unknown enum values safely.

16.4 Scoring changes. Staminabar may change how Attributes are computed at any time. Staminabar does not guarantee that a Player's Attributes will stay the same across scoring versions.

17. Confidentiality

17.1 Definition. "Confidential Information" means non-public information one party ("Discloser") gives the other ("Recipient") that is marked confidential or that a reasonable person would understand to be confidential, including the Documentation not published by Staminabar, secrets, security information, non-public pricing, and product plans. Attributes are governed by Sections 5 through 8, which apply in addition to this Section.

17.2 Exclusions. Confidential Information does not include information that the Recipient can show (a) is or becomes public through no fault of the Recipient, (b) was known to the Recipient without restriction before receipt, (c) is received from a third party without a duty of confidentiality, or (d) is independently developed without use of the Discloser's Confidential Information.

17.3 Obligations. The Recipient will use Confidential Information only to perform under these Terms, will protect it with at least reasonable care, and will disclose it only to its employees, contractors, and advisers who need to know it and are bound by confidentiality obligations at least as protective as these.

17.4 Compelled disclosure. The Recipient may disclose Confidential Information as required by law if it gives the Discloser prompt notice (where legally allowed) and reasonable help to seek protective treatment.

17.5 Duration. These obligations last during the Term and for 3 years after, and for trade secrets and secrets described in Section 5.4, for as long as they remain trade secrets or secrets.

18. Intellectual property and feedback

18.1 Staminabar's property. Staminabar and its licensors own the Staminabar service, the Staminabar API, the Documentation, the Staminabar Marks, the methods and models used to compute Attributes, and all improvements to them. Except for the licenses in these Terms, Staminabar grants you no rights.

18.2 Your property. You and your licensors own your Products, your Product Server code, and your marks. Except for the licenses in these Terms, you grant Staminabar no rights.

18.3 Attributes are not yours to own. Attributes describe Players. As between you and Staminabar, you receive only the limited right to use Attributes under these Terms, and acquire no ownership of them.

18.4 Feedback. If you give Staminabar suggestions or feedback about Staminabar, Staminabar may use them for any purpose without obligation to you. Feedback does not include your Confidential Information or your Product.

18.5 Sample code. Sample code or reference implementations Staminabar provides (including reference Product Server code) are licensed under the terms that accompany them, or if none, under the license in Section 4.1, and are provided as is.

19. Representations and warranties

19.1 Mutual. Each party represents that it is validly organized (or, for an individual, of legal age), has authority to enter into these Terms, and that its performance will not breach any other agreement it is bound by.

19.2 By you. You represent and warrant that:

(a) you have all rights, licenses, and permissions needed for your Products, including from game publishers and platforms;
(b) your Products, your listing materials, and your use of Attributes comply with these Terms and Applicable Law;
(c) your privacy disclosures to Players are accurate and complete;
(d) your Products do not contain malware or code designed to harm Players' devices or collect data the Player has not been told about; and
(e) neither you nor anyone who owns or controls you is a person described in Section 25.

20. Disclaimers

20.1 EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE STAMINABAR API, THE DOCUMENTATION, ATTRIBUTES, HOSTED PRODUCT SERVERS, AND ALL RELATED SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE". STAMINABAR DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND UNINTERRUPTED OR ERROR-FREE OPERATION.

20.2 ATTRIBUTES ARE NOT MEDICAL INFORMATION, ARE NOT A MEDICAL DEVICE OUTPUT, AND ARE NOT INTENDED TO DIAGNOSE, TREAT, CURE, OR PREVENT ANY DISEASE OR CONDITION. STAMINABAR DOES NOT WARRANT THAT ATTRIBUTES ARE ACCURATE, COMPLETE, TIMELY, FREE FROM PLAYER MANIPULATION, OR SUITABLE FOR ANY USE OTHER THAN THE PERMITTED PURPOSE.

20.3 STAMINABAR IS NOT RESPONSIBLE FOR THIRD-PARTY GAMES, PLATFORMS, PUBLISHERS, OR DEVICES, OR FOR THEIR TERMS OR CHANGES.

21. Limitation of liability

21.1 Exclusion of damages. EXCEPT FOR EXCLUDED CLAIMS, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA, ARISING OUT OF OR RELATING TO THESE TERMS, EVEN IF ADVISED OF THEIR POSSIBILITY.

21.2 Cap. EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS WILL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID OR OWED STAMINABAR UNDER THESE TERMS IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE LIABILITY, AND (B) US $100.

21.3 Excluded Claims. "Excluded Claims" means:

(a) your breach of Sections 5, 6, 7, 8, 10.1, or 10.3, or of the Data Protection Addendum in Section 27;
(b) a party's indemnity obligations under Section 22;
(c) a party's breach of Section 17 (Confidentiality);
(d) your infringement or misappropriation of Staminabar's intellectual property, or your breach of Section 4.2;
(e) a party's gross negligence, fraud, or willful misconduct; and
(f) your obligation to pay fees.

21.4 Allocation. The parties agree that these limits reflect a reasonable allocation of risk, and that Staminabar would not provide the Staminabar API without them. These limits apply to the extent permitted by Applicable Law.

22. Indemnification

22.1 By you. You will defend Staminabar, its affiliates, and their members, managers, officers, employees, and agents against any third-party claim, demand, investigation, or proceeding (including by a Player, platform, publisher, or regulator), and pay the resulting damages, fines, penalties, settlements, and reasonable costs and attorneys' fees, to the extent arising out of or relating to:

(a) your Products, Product Server, or game clients, including their content, operation, and compliance with platform and publisher rules;
(b) your collection, use, storage, disclosure, or misuse of Attributes or other Player data, or a Security Incident in systems you or your subprocessors control;
(c) your breach of these Terms or Applicable Law; or
(d) any claim that your Products or the materials you supplied under Section 14.3 infringe or misappropriate a third party's rights.

22.2 By Staminabar. Staminabar will defend you against any third-party claim alleging that the Staminabar API or Staminabar Marks, as provided by Staminabar and used by you in accordance with these Terms, infringe a United States patent, copyright, or trademark, or misappropriate a trade secret, and will pay the resulting damages and settlements Staminabar agrees to. Staminabar has no obligation for claims arising from your modifications, your combination of the Staminabar API with anything Staminabar did not provide, or your breach of these Terms. If such a claim occurs or is likely, Staminabar may modify the Staminabar API to make it non-infringing, obtain a license, or terminate your access. This Section 22.2 states Staminabar's entire liability for infringement claims.

22.3 Process. The indemnified party will give prompt written notice of the claim (a delay excuses the indemnifying party only to the extent it is prejudiced), give the indemnifying party sole control of the defense and settlement, and provide reasonable cooperation at the indemnifying party's expense. The indemnifying party will not settle a claim in a way that imposes obligations or admits fault on the indemnified party's behalf without its written consent, which will not be unreasonably withheld. The indemnified party may join with counsel of its choice at its own expense.

23. Term and termination

23.1 Term. These Terms start when you accept them and continue until terminated ("Term"). Each Order Form has the term stated in it.

23.2 Termination for convenience. Either party may terminate these Terms on 30 days written notice. If an Order Form is in effect, termination for convenience takes effect at the end of the Order Form's term unless the Order Form says otherwise.

23.3 Termination for cause. Either party may terminate these Terms or an Order Form on written notice if the other party materially breaches them and does not cure the breach within 30 days of notice. Staminabar may terminate immediately on notice if you breach Sections 5, 6, 7, 8, 10.1, or 10.3, or if a breach is not capable of cure.

23.4 Termination for law or platform changes. Staminabar may terminate these Terms or stop offering the Staminabar API on notice if Applicable Law, a regulator, or a platform makes continued operation unlawful or commercially impractical.

24. Effect of termination

24.1 On termination or expiration:

(a) all licenses to you end, and Staminabar will revoke your Product Secrets and all Connections for your Products;
(b) you will stop using the Staminabar API, the Staminabar Marks, and Attributes immediately, and in any event within 60 seconds of the revocation of your Connections for live gameplay;
(c) you will delete all private keys immediately and purge all Attributes you and your subprocessors hold within 30 days, subject only to Section 5.9(c)'s backup rule;
(d) within 30 days after termination, an officer or authorized representative of your company will certify in writing to legal@staminabar.io that you have complied with this Section 24;
(e) each party will return or destroy the other's Confidential Information, except as required by law or retained in routine backups, which stay subject to Section 17;
(f) Staminabar will remove your Products from its catalog; and
(g) undisputed fees accrued before termination become due.

24.2 Survival. Sections 1, 5.9, 5.10, 6.3, 7, 8, 11.1 through 11.4 (for Security Incidents discovered within 12 months after termination), 11.5 (for 12 months after termination), 14.4, 15.3 (for fees accrued), 17, 18, 20, 21, 22, 24, 25, 26, and 27 survive termination, and any other provision that by its nature should survive.

25. Export controls and sanctions

Each party will comply with U.S. export control and economic sanctions laws. You represent that you are not, and are not owned or controlled by, a person on a U.S. government restricted party list (including the OFAC Specially Designated Nationals list), and that you are not located in, organized under the laws of, or ordinarily resident in a country or region subject to comprehensive U.S. sanctions. You will not make Attribute-based features available to Players in such countries or regions in violation of those laws.

26. General

26.1 Governing law. These Terms and any dispute arising out of or relating to them are governed by the laws of the State of Georgia, without regard to its conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

26.2 Negotiation first. Before starting any lawsuit, a party will send the other a written notice describing the dispute, and senior representatives of both parties will negotiate in good faith for 30 days after the notice. Either party may skip this step to seek urgent injunctive relief, including to protect Player data, secrets, Confidential Information, or intellectual property, or to stop a breach of Sections 5 through 8.

26.3 Venue. The state and federal courts located in Fulton County, Georgia have exclusive jurisdiction over any dispute arising out of or relating to these Terms, and each party consents to personal jurisdiction and venue there. Either party may seek injunctive relief in any court of competent jurisdiction.

26.4 Jury waiver. EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THESE TERMS.

26.5 Equitable relief. A breach of Sections 5 through 8 or 17 may cause irreparable harm for which damages are inadequate, and the non-breaching party may seek injunctive relief without posting a bond, in addition to other remedies.

26.6 Entire agreement and order of precedence. These Terms, any Order Form, the Data Protection Addendum, and the Documentation make up the entire agreement between the parties about their subject and replace all prior agreements and understandings about it. If they conflict, this order controls: (1) an Order Form, for the subject it covers; (2) the Data Protection Addendum, for data protection matters; (3) these Terms; (4) the Documentation. Terms in your purchase orders or other forms do not apply.

26.7 Changes to these Terms. Staminabar may update these Terms by giving you at least 30 days notice before material changes take effect, except that changes required by law, a platform, or to protect Players may take effect sooner. If you do not agree, you may terminate under Section 23.2 before the change takes effect. Continued use of the Staminabar API after the effective date means you accept the change. Changes do not alter a signed Order Form during its term unless both parties agree.

26.8 Assignment. You may not assign or transfer these Terms, an Order Form, or any Product Secret, by operation of law or otherwise, without Staminabar's prior written consent. Staminabar may assign these Terms to an affiliate or to a successor in a merger, acquisition, or sale of all or substantially all of the assets of the Staminabar business, on notice to you. Any other attempted assignment is void.

26.9 Independent contractors. The parties are independent contractors. These Terms do not create a partnership, joint venture, agency, fiduciary, or employment relationship, and neither party may bind the other.

26.10 Notices. Notices under these Terms must be in writing. Notices to Staminabar go to legal@staminabar.io, with a copy by mail to Lynn Allen Holdings, LLC, 5450 Glenridge Drive, Apt 251, Atlanta, GA 30342, and security notices also go to security@staminabar.io. Notices to you go to the contact email you gave Staminabar during onboarding. Email notices are effective when sent, unless the sender receives a delivery failure. Mailed notices are effective on delivery.

26.11 Force majeure. Neither party is liable for delay or failure to perform (other than payment and your obligations under Sections 5 through 8) caused by events beyond its reasonable control, including outages of third-party cloud providers, internet failures, natural disasters, war, terrorism, labor actions, or government action.

26.12 Waiver and severability. A failure to enforce a provision is not a waiver. If a provision is held unenforceable, it will be enforced to the maximum extent permitted and the rest of these Terms remain in effect.

26.13 No third-party beneficiaries. There are no third-party beneficiaries of these Terms, except that the parties intend Sections 5 through 8 and 10 to protect Players, and Staminabar may enforce them for Players' benefit.

26.14 Government use. If you are a government entity, the Staminabar API and Documentation are commercial items and commercial computer software provided with only the rights in these Terms.

26.15 Interpretation. Headings are for convenience. "Including" means including without limitation. "Days" means calendar days unless stated as business days.

26.16 Counterparts and electronic signature. These Terms and any Order Form may be accepted electronically and signed in counterparts.

27. Data Protection Addendum

27.1 Scope. This Addendum applies to personal data that Staminabar makes available to you through the Staminabar API, which consists of Attributes and Connection identifiers ("Player Data"), and to personal data Staminabar processes on a Hosted Product Server for you.

27.2 Roles when you run your own Product Server.

(a) Staminabar is an independent controller (or business) for the personal data it collects from Players under the Consumer Terms, including the health data it uses to compute Attributes.
(b) When a Player pairs with your Product, Staminabar discloses Player Data to you at the Player's direction and with the Player's consent. For that Player Data you are an independent controller (and, under U.S. state laws, a third party recipient of consumer health data) for the Permitted Purpose only, bound by the restrictions in these Terms.
(c) The parties are not joint controllers. Each party is responsible for its own compliance with Applicable Law, including responding to Player requests about its own processing, and will cooperate reasonably with the other on requests that involve both.
(d) For purposes of the California Consumer Privacy Act and similar state laws, Staminabar does not sell Player Data to you, and you will not sell or share (for cross-context behavioral advertising) Player Data. You certify that you understand and will comply with the restrictions in Sections 6 through 8.

27.3 Roles when Staminabar hosts your Product Server. For a Hosted Product Server operated on your behalf under Section 13.3, Staminabar processes personal data on the Product Server (such as connection records, pairing records, and request logs that may include IP addresses) as your processor or service provider, only on your documented instructions as set out in these Terms and the applicable Order Form, and will:

(a) ensure its personnel are bound by confidentiality;
(b) apply appropriate technical and organizational security measures;
(c) use subprocessors only under written terms at least as protective as this Addendum, and remain responsible for them (Staminabar currently uses Amazon Web Services to host Product Servers, and will give notice before adding a subprocessor for Hosted Product Servers);
(d) assist you with Player requests and with security and impact assessments, taking into account the information available to it;
(e) notify you without undue delay, and within 72 hours, of a Security Incident affecting the Hosted Product Server; and
(f) delete or return that personal data at the end of the hosting services, unless law requires retention.

27.4 Subprocessor flowdown. Any subprocessor you engage that can access Player Data must be bound in writing by data protection obligations at least as protective as those in these Terms, including the prohibitions in Section 7, deletion on Revocation, and security incident notice. You remain liable for your subprocessors' acts and omissions.

27.5 Breach notice. Each party will notify the other without undue delay, and in any event within 72 hours after becoming aware, of a Security Incident affecting Player Data received from or processed for the other party, and will provide the information reasonably needed for the other party to meet its own notification obligations, including under GDPR Article 33, the FTC Health Breach Notification Rule, and state breach laws.

27.6 International transfers. Staminabar processes Player data in the United States. To the extent Player Data relating to Players in the European Economic Area, Switzerland, or the United Kingdom is transferred between the parties to a country that does not have an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, Module One (controller to controller) for transfers under Section 27.2 and Module Three or Module Two as applicable for transfers under Section 27.3, together with the UK International Data Transfer Addendum and Swiss amendments where applicable. For the Standard Contractual Clauses: the optional docking clause applies; the governing law and forum are those of Ireland; the description of transfer is the Player Data described in Section 1.9 for the Permitted Purpose; and the technical and organizational measures are those in Sections 5 and 8.5. If the Standard Contractual Clauses conflict with these Terms, the Standard Contractual Clauses control for the transfer they cover.

27.7 Special category data. The parties acknowledge that Player Data may be health data under GDPR Article 9 and consumer health data under U.S. state law, and that Staminabar relies on each Player's explicit consent given through the Pairing for the disclosure to you. You will not process Player Data on any other legal basis or for any other purpose.

27.8 Records and assistance. Each party will maintain the records Applicable Law requires for its processing of Player Data, and will provide reasonable assistance to the other in responding to regulators about Player Data received under these Terms.

27.9 Deletion. Deletion obligations in Sections 5.9, 8.4, and 24 apply to Player Data and to all copies held by you and your subprocessors.

28. Contact

Lynn Allen Holdings, LLC, d/b/a Staminabar
5450 Glenridge Drive, Apt 251, Atlanta, GA 30342
Legal and notices: legal@staminabar.io
Security reports and incidents: security@staminabar.io