Acceptable Use Policy

NoReplay exists so fans can find live events they want to be at and walk in with a ticket they can trust. The rules below exist to keep that promise honest. Most of them boil down to: don't scam, don't game the system, don't make someone else's night worse.

Using NoReplay (as an attendee, organiser, vendor or developer) you must not:

• Create accounts using false names, identity documents, payment instruments or contact details, or operate accounts on behalf of someone else without their consent.
• Buy, sell or transfer tickets outside the in-app purchase, transfer or resale flows. Side-channel transactions break the rotating-QR guarantee for the recipient.
• List a ticket above the resale cap (default 150% of face value, or the lower organiser-set cap), or attempt to bypass the cap through bundles, fees or side-payments.
• Use bots, scripts or automation to buy tickets, place bids, hold reservations, scrape inventory, or generate accounts. Reasonable, rate-limited API access by registered integrators is fine — see below.
• Place bids you do not intend to honour (shill bidding, bid retraction, payment withholding after winning).
• Duplicate or share a ticket beyond the people it was bought for. The rotating QR is single-screen by design; bringing a screenshot is detectable and will trigger a fail-loud at the door.
• Misrepresent or attempt to impersonate another attendee, organiser or NoReplay staff member.
• Threaten, harass, dox or otherwise harm other users, organiser staff, vendors, artists, or NoReplay staff.
• Post content that is unlawful, fraudulent, obscene, hateful, defamatory, that infringes a third party's rights, or that is otherwise reasonably objectionable.
• Probe, attack or attempt to bypass our security controls, or test our systems for vulnerabilities outside our published responsible-disclosure programme.
• Use NoReplay or its data to send unsolicited marketing, build advertising profiles, or train external machine-learning models without our written consent.

In addition to the rules above, organisers and vendors must:

• Honour the event as listed. Misleading capacities, ticket tiers, line-ups or refund terms are grounds for delisting and can trigger automatic full refunds to attendees.
• Provide accurate VAT, tax-PIN and payout-account information. False remittance information delays payouts and may constitute fraud.
• Not require fans to provide personal data beyond what is necessary for admission, age verification or legitimate operational needs.
• Comply with the Data Processing Addendum when receiving attendee data through the platform.

If you connect to NoReplay programmatically:

• Identify your app with a registered API key.
• Respect rate limits. Distributing requests across multiple keys to evade limits is prohibited.
• Do not store user-level access tokens longer than required to render the current session.
• Use the "sandbox" environment for testing. Production endpoints must not be used for load tests.

We publish a responsible-disclosure programme at security@noreplay.vip. Reports are acknowledged within 3 business days; please do not publicly disclose findings before we have a chance to triage.

Violations of this policy may result in any combination of: invalidation of affected tickets, refusal of admission, suspension or termination of the account, forfeiture of wallet balances tied to fraudulent activity, withholding of organiser/vendor payouts pending investigation, and referral to law enforcement where the conduct is criminal.

Where a sanction is appealable, we provide a written explanation and a contact for review. We aim to be proportionate, but we won't hesitate when the safety of other users or the integrity of the marketplace is at stake.

Saw something off? Tell us at trust@noreplay.vip. For urgent issues during an event, the in-app "Report" button on a listing or profile pages directly into the trust-and-safety queue.