FGID Developer Access Agreement

Applicable Platform: FGID (FurryGoods Identity) Developer Platform
Version: First Edition
Publication Date: May 28, 2026
Effective Date: June 7, 2026
Last Updated: May 28, 2026

This FGID Developer Access Agreement (the “Agreement”) is entered into by and between 香港福瑞谷國際貿易有限公司 / HONG KONG FURRYGOODS INTERNATIONAL TRADE LIMITED (“FGID,” “we,” “us,” or “our”) and the individual, company, studio, institution, or other organisation applying to integrate with FGID (the “Developer” or “you”).

By completing registration, checking the acceptance box, creating an application, obtaining a client identifier, calling an Interface, or continuing to use the Developer Platform, the Developer accepts this Agreement.

Article 1 Definitions

1.1 Developer Application

A website, application, client, software program, or service owned, operated, or controlled by the Developer that applies to use FGID login, identity authentication, authorisation, or another Interface.

1.2 Interface

An OAuth 2.0, OpenID Connect, or other standardized authentication interface provided by FGID based on the cooperation arrangement and review outcome, together with user-information, authorisation-management, logout, event-notification, developer-console, SDK, documentation, and other technical capabilities.

1.3 Credentials

A client identifier, client secret, signing key, access token, refresh token, certificate, Webhook secret, or other information used to identify a Developer Application or access an Interface.

1.4 FGID Data

User data, authentication results, tokens, Interface responses, logs, and derived data obtained by the Developer through an FGID Interface, authorisation flow, technical support, or another means.

Article 2 Developer Eligibility

The Developer shall:

1. have the legal capacity and authority to enter into and perform this Agreement;
2. provide true, accurate, and complete identity, organisation, and contact data;
3. hold lawful rights in, or sufficient authorisation for, the Developer Application;
4. designate a contact authorised to handle security, privacy, and technical matters;
5. comply with applicable law in each place where the application is operated or its users are located;
6. not be a sanctioned person, a prohibited transaction counterparty, or otherwise restricted by law; and
7. complete identity, organisation, or domain verification as required by FGID.

FGID may reject an integration application that is high-risk, incomplete, unclear in purpose, or inconsistent with FGID's brand positioning.

Article 3 Application Registration and Review

For each application, the Developer shall submit:

1. the application name, icon, and description;
2. the operator and contact details;
3. the official website, privacy policy, and user agreement;
4. callback URLs, logout URLs, and permitted origin domains;
5. requested permissions and their purposes;
6. the methods for retaining and deleting user data;
7. the security architecture and necessary supporting evidence; and
8. other information required by FGID.

FGID may conduct automated or manual review and require remediation, permission restrictions, test-environment validation, or renewed review.

Approval does not constitute an FGID warranty concerning the application's legality, quality, content, or commercial performance.

Article 4 Technical Integration Requirements

The Developer shall:

1. comply with the current Interface documentation and protocol specifications;
2. use HTTPS and industry-recognized transport encryption;
3. configure callback URLs precisely and not use open redirects;
4. use PKCE or an equivalent safeguard for public clients;
5. use and validate state, nonce, or an equivalent mechanism;
6. validate token signatures, issuer, audience, expiration, and required claims;
7. not embed a confidential client secret in front-end code, a public repository, or a mobile application;
8. encrypt tokens and keys at rest, apply least-privilege access, and rotate them periodically;
9. promptly process revocation, logout, and key-expiration events;
10. implement reasonable request rates, error retries, and caching;
11. not circumvent rate limits, permission controls, or security policies; and
12. complete upgrades within the period stated in a version-change or deprecation notice.

Article 5 Credential Management

The Developer is responsible for its Credentials and requests initiated using them.

The Developer shall not:

1. sell, lease, share, or publicly disclose Credentials;
2. reuse Credentials across unrelated applications;
3. permit an unauthorised third party to call an Interface;
4. forge an FGID response, token, or authentication status;
5. use revoked or test Credentials in a production environment; or
6. collect a third-party account password, Passkey private key, recovery code, or complete session token through a user's device.

After discovering a Credential leak, the Developer shall immediately revoke or rotate the Credential and notify FGID.

Article 6 Permissions and User Consent

The Developer may request only the minimum permissions necessary to implement a clearly specified function.

Before authorisation, the Developer shall clearly disclose:

1. the application operator;
2. the requested data and permissions;
3. the purposes of use;
4. whether data is provided to another person;
5. the retention period or the criteria used to determine it;
6. how a user may withdraw authorisation and delete data; and
7. the application's privacy policy and contact details.

The Developer shall not:

1. bundle multiple unrelated purposes into a single consent;
2. make an optional permission mandatory;
3. obtain authorisation through deception, dark patterns, misleading wording, or other misleading interface designs;
4. impose a retaliatory restriction after a user refuses a non-essential permission; or
5. call an Interface or use data beyond the scope authorised.

Article 7 Restrictions on Use of FGID Data

The Developer may use FGID Data only for a function expressly requested and authorised by the user.

Without lawful authorisation from FGID and the user, the Developer shall not:

1. sell, lease, exchange, or otherwise commercialize FGID Data;
2. share FGID Data for cross-context behavioural advertising, data brokering, or advertising profiles;
3. combine FGID Data with another source to infer a sensitive characteristic unrelated to the service;
4. use authentication Credentials, identity-verification data, or security data for marketing;
5. subject a user to unfair discrimination, credit assessment, employment screening, or insurance decisions;
6. attempt to reverse, link, or identify anonymized data;
7. scrape or download FGID data at scale or establish a directory of FGID users;
8. provide data to an unauthorised third party;
9. use FGID Data to train, fine-tune, or evaluate a general-purpose artificial-intelligence model unless FGID gives written permission and the user expressly authorises the use;
10. use FGID Data to harass, defraud, track, or infringe a user's rights and interests; or
11. retain data longer than necessary for the purpose.

Article 8 Privacy and Data Protection Obligations

The Developer shall:

1. publish a truthful, clear, and readily accessible privacy policy;
2. explain its role as a data user, controller, or processor;
3. rely on a lawful basis for processing;
4. implement data minimization, purpose limitation, and retention limitation;
5. provide channels for access, correction, deletion, withdrawal, and complaints;
6. honor applicable sale-or-sharing opt-outs, GPC signals, and sensitive-data limitation choices;
7. enter into data-protection terms with each processor;
8. handle cross-border transfers as required by law;
9. not require a user to disclose a third-party account password, Passkey private key, recovery code, or other authentication secret to the Developer; and
10. cease processing that is no longer necessary after authorisation is withdrawn or an account is closed.

If the Developer independently determines the purposes and means of processing personal data after obtaining it from FGID, the Developer bears independent responsibility for that processing.

Article 9 User Deletion and Withdrawal of Authorisation

The Developer shall provide user-friendly opt-out, unlinking, and deletion mechanisms.

After receiving a withdrawal of authorisation, an FGID account-closure event, or a deletion request, the Developer shall:

1. cease new Interface calls;
2. revoke or delete the relevant tokens;
3. delete or anonymize FGID Data that is no longer necessary;
4. retain only data necessary for legal, dispute, or security purposes;
5. segregate retained data and restrict its use; and
6. confirm the processing outcome as required by FGID.

The Developer shall not require a user to close the entire FGID Account in order to delete a local account in the Developer Application.

Article 10 Information Security

The Developer shall establish a security program appropriate to the risk, including:

1. access controls and least privilege;
2. encryption in transit and at rest;
3. key and token segregation;
4. secure development, code review, and dependency management;
5. vulnerability scanning and timely remediation;
6. logging, monitoring, and anomaly detection;
7. backups and business continuity;
8. employee confidentiality and security training;
9. supply-chain and processor management; and
10. security-incident response.

If high-risk data or a large number of users is involved, FGID may require an independent security assessment, a penetration-test summary, or evidence of compliance.

Article 11 Security Incidents

If any of the following occurs or is reasonably suspected, the Developer shall immediately take containment measures and notify FGID without undue delay after discovery and, in principle, no later than twenty-four (24) hours:

1. leakage of a client secret, token, or certificate;
2. unauthorised access to, use, disclosure, modification, or deletion of FGID Data;
3. use of the application for phishing, account takeover, or fraud;
4. a vulnerability that may affect FGID or another Integrated Service; or
5. a personal-data breach that must be reported by law.

The notice shall state the incident time, scope of impact, data categories, affected users, measures taken, and contact person. The Developer shall provide continuing updates on the investigation and cooperate in notifying users and regulators.

Without FGID's consent, the Developer shall not misleadingly attribute responsibility to FGID in a public statement, except where disclosure is required by law.

Article 12 Application Content and User Experience

A Developer Application shall not:

1. violate law, commit fraud or infringement, or endanger cybersecurity;
2. impersonate FGID or an official FurryGoods service;
3. use a misleading login button or forged authorisation page;
4. collect a user's third-party account password, Passkey private key, recovery code, or other authentication secret;
5. conceal its operator or privacy policy;
6. use an unreviewed application in a large-scale production environment;
7. use FGID login to distribute malware, spam, or unlawful content;
8. improperly track or market to minors; or
9. violate a prohibited- or restricted-use policy published by FGID.

Article 13 Brand and Intellectual Property

FGID grants the Developer a limited, revocable, non-exclusive, non-transferable license solely to display marks such as “Log in with FGID” in accordance with the brand guidelines.

Without written permission, the Developer shall not:

1. modify an FGID mark or cause confusion;
2. use FGID as the principal name of a company, product, or domain;
3. imply that FGID guarantees, certifies, or invests in the application;
4. register a trademark, domain name, or account confusingly similar to FGID or FurryGoods; or
5. copy the appearance of an FGID authorisation page or Account Center to carry out impersonation.

The Developer retains intellectual-property rights in its application but shall not infringe the rights and interests of FGID or a third party.

Article 14 Monitoring, Audit, and Remediation

For security, quality, and compliance purposes, FGID may:

1. monitor Interface calls and anomalous behavior;
2. inspect public pages, privacy policies, and authorisation flows;
3. require the Developer to provide information or complete a self-assessment;
4. require deletion of data exceeding the authorised scope;
5. limit permissions, request rates, or user scale;
6. require remediation within a specified period; and
7. immediately suspend an application where there is material risk.

The Developer shall reasonably cooperate. FGID does not thereby acquire ownership of the Developer's source code.

Article 15 Fees

The Developer Platform may provide free or paid functions. Paid items, quotas, and settlement rules are governed by the console or a separate agreement.

FGID may adjust prices or quotas and will provide advance notice in accordance with applicable rules. The Developer bears fees arising from third-party infrastructure, networks, SMS, or other services.

Article 16 Suspension and Termination

FGID may suspend an Interface, revoke Credentials, or terminate integration if:

1. the Developer violates this Agreement or developer rules;
2. a security vulnerability or data breach exists;
3. data or permissions are used beyond their authorised scope;
4. the application is unlawful, fraudulent, infringing, or misleading to users;
5. the Developer fails to complete required remediation;
6. Credentials remain unused for an extended period or the application ceases operation;
7. law, a regulator, or a third-party platform so requires;
8. FGID discontinues the relevant Interface or business; or
9. another material risk exists.

FGID may suspend immediately in an emergency. For non-urgent termination, we will, where reasonably practicable, provide notice or a migration period.

After termination, the Developer shall cease using the Interface, delete Credentials, and process FGID Data in accordance with this Agreement.

Article 17 Confidentiality

The Developer shall maintain the confidentiality of non-public Interface materials, test information, security vulnerabilities, business plans, user data, and other information marked confidential or that should reasonably be regarded as confidential.

Where disclosure is required by law, the Developer shall notify FGID in advance to the extent permitted and disclose only what is necessary.

Article 18 Representations, Warranties, and Indemnification

The Developer represents and warrants that its application, data processing, content, and use of the Interfaces are lawful and do not infringe a third party's rights and interests.

If FGID, an affiliate, or a third party suffers a claim, penalty, or reasonable expense as a result of the Developer's breach of this Agreement, unlawful data processing, inadequate security measures, application content, or a dispute with a user, the Developer shall indemnify the affected party to the extent of the Developer's responsibility.

Article 19 Disclaimers and Limitation of Liability

FGID provides the Interfaces “as is” and “as available” and does not warrant that an Interface will be permanently available, error-free, or meet every Developer requirement.

To the extent permitted by applicable law, FGID is not liable for the Developer's indirect loss, loss of profit, loss of goodwill, business interruption, or cost of substitute services.

FGID's aggregate liability to the Developer is limited to the total fees actually paid by the Developer for the relevant Interface during the twelve (12) months preceding the event giving rise to liability. For a free service, the limit is one thousand Hong Kong dollars (HKD 1,000). This limitation does not apply to liability that cannot lawfully be limited.

Article 20 Agreement Updates

FGID may update this Agreement in response to legal, technical, security, or business changes. A material update will be notified through the Developer Console, email, or an announcement.

Continued use of an Interface after an update takes effect constitutes acceptance. If the Developer does not agree, it shall cease integration and process the related data.

Article 21 Governing Law and Dispute Resolution

This Agreement is governed by the laws of the Hong Kong Special Administrative Region.

The parties shall first attempt to resolve a dispute through consultation. If consultation fails, either party may bring proceedings before a court of competent jurisdiction in the Hong Kong Special Administrative Region.

Article 22 Contact Details

• Operator: 香港福瑞谷國際貿易有限公司
• English Name: HONG KONG FURRYGOODS INTERNATIONAL TRADE LIMITED
• Company Registration Number: 80485674
• Official FGID Website: https://id.furrygoods.cc
• Developer Support, Security Incidents, Privacy, and Customer Service: [email protected]
• Customer Service Notice: Telephone support is not provided and fixed customer service hours are not published. We generally provide an initial response within seven (7) business days after receiving complete information.

香港福瑞谷國際貿易有限公司
HONG KONG FURRYGOODS INTERNATIONAL TRADE LIMITED