One platform, explicit consent
App surfaces and scopes
A Jotify app can span several products, but every surface and permission must be declared, consented and reviewed.
Install target versus surface
The install target owns consent and lifecycle: user, creator, workspace, website or store. Surfaces describe where approved UI and actions may appear. One app may request several reviewed surfaces without receiving unrestricted platform access.
Sensitive products
Private chat bodies, Meet profiles, identity evidence, precise location, payments and moderation evidence are not general-purpose scopes. They require a separate security, privacy and policy review—or remain unavailable.
- Least privilege by default
- No wildcard scopes
- Re-consent when scopes expand
- Kill switch and immutable audit trail
Distribution
Development installs remain private. Approved versions can later use limited distribution or a reviewed Jotify Apps listing. Paid distribution stays disabled until payment, tax, refund and payout operations are verified.
