Developer Terms

Last updated: 1 November 2026. Draft, to be reviewed before launch.

1. About these terms

These terms apply to anyone who creates an app on Shacks On The Air ("SHOTA") or uses the SHOTA partner API through OAuth (the "API"). By creating an app you agree to them on behalf of yourself and anyone you build the app for. If you don't agree, don't create an app or use the API. Personal API keys for your own scripts and loggers are also covered by sections 4, 9 and 10.

2. Your app and your account

• Everything you tell us about your app must be accurate and kept up to date, including what it does, what data it needs and why.
• You are responsible for your app and for everything done with your credentials. Keep your client secret on your own server; never put it in an app users can download, a web page or a public code repository.
• Keep the access and refresh tokens we issue for each user on your server only, encrypted at rest, and never write them to logs, URLs or error reports. Always store the new refresh token after each refresh.
• If your client secret or any user's tokens may have been exposed, generate a new secret straight away and tell us.
• Each app must be a real product or service. Don't create apps to test the review, to hold names or to get around a decision we have made.

3. Approval and access

• Every app is reviewed by a person before it can connect to anyone's account. We decide whether to approve it and what it may access, and we don't have to give reasons.
• We may change what your app can access, suspend it or revoke it at any time, including apps we have already approved.
• Changes to anything users see about your app, its callback or card URLs, or the permissions it asks for are reviewed before they take effect.

4. Using the API

The official API is the only integration we permit. You must not:

• use any other endpoint or unofficial method to access SHOTA, including the website's own pages and internal requests;
• scrape, crawl or harvest data of any kind from this website by bots, scripts or any other automated means;
• have an app, script or bot submit any form on this website, including signing in, uploading logs or posting spots;
• try to access data your app was not given, or that belongs to users who have not connected your app;
• get around rate limits, share credentials between apps, or use the API to build a competing awards scheme;
• post spots, QSOs or profile changes a user didn't ask for, or that aren't true;
• interfere with, overload or test the security of our systems without our written permission.

5. Users and their data

• Only act for a user who has connected their account to your app, and only within what they agreed to.
• Use their data only to provide the features you described to us and to them. Don't sell it, rent it, share it with others or use it for advertising.
• Your privacy policy must say clearly what your app does with their data, and you must follow it and the data protection laws that apply to you.
• Keep their data secure and only as long as you need it.
• Honour disconnects. When a user disconnects your app (in your app, or from Connected apps on SHOTA), stop using their tokens and delete the SHOTA data you hold for them unless they ask you to keep it. When they disconnect in your app, call DELETE /api/partner/v1/token.
• Tell us promptly about any security incident that affects data you got through the API.

6. Fair play

Shacks On The Air is built so that every operator competes on equal terms, wherever their shack is. Your app must not offer, or help anyone gain, an advantage in SHOTA awards or leaderboards, and must not misrepresent where or how a QSO was made.

7. Our name, branding and logo

You may use the name "Shacks On The Air" or "SHOTA" in plain text to say truthfully that your app works with it, for example "Connect your SHOTA account".

• You may not use the SHOTA logo or other SHOTA branding, artwork or styling in your app, website or marketing.
• You may not put "SHOTA" or "Shacks On The Air" in your app's name, or use a name, logo or design that could be confused with ours.
• You may not present your app as official or endorsed by SHOTA. Our approval is permission to use the API, not an endorsement.

8. Cards

If we let your app show a card on our pages, the card may only show the connected user's own data from your service. It must not advertise other products, ask for payment, donations or subscriptions, ask for passwords or other credentials, or look like it comes from SHOTA. Always verify our signed request and answer only for the user it names. We may switch off your card at any time.

9. Availability and changes

We provide the API as it is, without any promise that it will be available, error free or unchanged. We may change, limit or stop the API, or any part of it, at any time. We'll try to give notice of significant changes.

10. Breaking these terms

If you break these terms we may revoke your app and API keys and block you, without warning.

11. Liability

As far as the law allows, Shacks On The Air is not liable for any loss or damage arising from your use of the API or from our changing, suspending or ending your access. You are responsible for claims made against us arising from your app or from your breaking these terms.

12. Changes to these terms

We may update these terms. The date at the top shows when they last changed. If you keep using the API after a change, you accept the new terms.