Terms and Conditions for OFAuth

1. Scope of Service

1.1 OFAuth ("the Service") is provided solely for the purpose of authenticating OnlyFans users for third-party platforms and applications ("Client Platforms").

1.2 The Service may only be used to authenticate OnlyFans accounts of users who have explicitly consented to and authorized such authentication for use with the Client Platform.

2. Prohibited Uses

2.1 Users of the Service, including but not limited to developers, companies, and individuals integrating OFAuth into their platforms ("Clients"), are strictly prohibited from:

• a) Using the Service to access or attempt to access OnlyFans accounts without the express consent and authorization of the account owner.
• b) Employing the Service for any purpose other than authenticating legitimate users of their own platforms who have willingly chosen to connect their OnlyFans accounts.
• c) Utilizing the Service to impersonate, misrepresent, or act on behalf of OnlyFans users without their knowledge and explicit permission.
• d) Attempting to bypass or manipulate the Service's authentication processes for unauthorized access.

2.2 Any use of the Service that does not comply with these terms is strictly prohibited and may result in immediate termination of access to the Service.

3. Client Responsibilities

3.1 Clients integrating OFAuth into their platforms are responsible for:

• a) Obtaining clear and unambiguous consent from their users before initiating the OnlyFans authentication process through OFAuth.
• b) Maintaining accurate records of user consent for authentication purposes.
• c) Immediately revoking authentication access for any user who withdraws their consent or terminates their relationship with the Client Platform.

4. Compliance and Penalties

4.1 OFAuth reserves the right to monitor usage of the Service to ensure compliance with these terms.

4.2 Violation of these terms may result in:

• a) Immediate suspension or termination of access to the Service.
• b) Legal action for breach of contract or misuse of the Service.
• c) Reporting of violations to relevant authorities, including OnlyFans, if applicable.

5. Updates to Terms

5.1 OFAuth reserves the right to update these terms at any time. Continued use of the Service after such updates constitutes acceptance of the new terms.

By using OFAuth, you agree to comply with these terms and conditions in their entirety.

6. Client Consent and Data Access Requirements

6.1 Consent-First Access. Clients may only access, process, or store information that the end user has explicitly consented to share for the specific purpose disclosed at the time of consent. Access must be limited to the minimum data necessary to provide the requested feature or service.

6.2 Clear Disclosure. Prior to linking or access, Clients must disclose in clear and prominent language: (a) what data will be accessed; (b) how it will be used; (c) any actions to be performed on the user's behalf on OnlyFans; and (d) any downstream sharing. Dark patterns and bundled consent are prohibited.

6.3 Granular Scopes. Requested permissions must be granular and accurately reflect the intended use. Clients may not request broad scopes to enable unrelated features, nor use granted scopes for purposes beyond what was disclosed.

6.4 Proof of Consent. Clients must maintain verifiable records of user consent, including the consent timestamp, scope/version, and the disclosure text or UI presented. Clients must produce these records upon OFAuth's request for compliance or audit.

6.5 Revocation and Deletion. Clients must provide an unlink and scope-revocation mechanism and must honor revocation promptly. Upon revocation, Clients must cease access and delete cached data not required by law within a reasonable period, and in all cases within 30 days, unless a shorter period is mandated by applicable law or policy.

6.6 Ongoing Access and Re-Consent. For ongoing or background access, Clients must obtain re-consent upon any material change to data use or at least every 12 months, whichever comes first.

6.7 Security and Audit. Clients must implement appropriate technical and organizational measures to protect accessed data, maintain access logs, and cooperate with reasonable audits by OFAuth to validate compliance with these requirements.

6.8 Prohibited Conduct. Clients may not collect data covertly, circumvent OFAuth consent flows, or retain/repurpose data beyond the disclosed scope. Use of automation to bypass rate limits or security measures is prohibited.

7. Privileged Access Program

7.1 Eligibility and Approval. Certain vetted platforms may be granted limited, privileged access to bypass specific consent dialogs or flows solely to improve user experience, subject to written approval by OFAuth and strict adherence to this Section.

7.2 User Disclosure and Permission. Even where consent dialogs are bypassed, Clients must present clear in-product disclosures and obtain explicit opt-in from end users for each category of access or action (e.g., reading profile data, initiating messages or purchases, managing subscriptions). Users must be able to revoke such permissions at any time.

7.3 Scope Limitation. Privileged access is limited to the scopes expressly approved by OFAuth and may not be extended to additional data or actions without renewed approval.

7.4 Action Relay on User's Behalf. Where Clients relay actions to OnlyFans on a user's behalf, Clients must: (a) obtain permission for the specific action or a clearly defined durable consent; (b) provide conspicuous UI indicating when actions occur; and (c) maintain audit logs sufficient to trace who initiated the action, when, and what was performed.

7.5 Logging and Safeguards. Clients must retain detailed logs for privileged operations (including user identifier, action type, timestamp, and relevant metadata), implement rate limiting, anomaly detection, and abuse monitoring, and promptly disable access upon suspected misuse.

7.6 Suspension/Termination. OFAuth may suspend or terminate privileged access at any time for noncompliance, abuse risk, or platform safety. Section 4 (Compliance and Penalties) applies.

7.7 Legal and Notice Obligations. Clients must promptly notify OFAuth of security incidents or breaches affecting data accessed via OFAuth (within 72 hours where required by law) and comply with applicable user notice and regulatory obligations.