Terms of Use

Effective date: 28 August 2026 · Applies from the moment of publication at ota.aistastudio.ru

1. Definitions

1.1. The Service (Otapush) is the software system available at https://ota.aistastudio.ru: the website, the developer portal, the otapush command-line interface and the server implementation of the Expo Updates Protocol v1, intended for delivering OTA updates to React Native and Expo mobile applications.

1.2. The Operator is Общество с ограниченной ответственностью «СТУДИЯ АИСТА», OGRN 1267800056260, TIN (INN) 7814865711, address: 197706, г. Санкт-Петербург, вн.тер.г. город Сестрорецк, ул. Всеволода Боброва, д. 30, литера А, помещ. 1-Н, офис 13.

1.3. The User is a person who has registered an account in the Service.

1.4. An Account is the User's record in the Service, created from an email address.

1.5. An Application is the User's mobile application registered in the Service. Channels, updates, API keys and a code-signing key pair belong to the Application.

1.6. A Channel is a named release line for updates within an Application (for example, production, staging). Channel state is maintained separately for iOS and Android.

1.7. An Update is a build of JavaScript code and Application assets published by the User.

1.8. An End user is a user of the User's Application whose device requests updates from the Service.

1.9. An API key is the secret with which the command-line interface authenticates to the Service on behalf of an Application.

2. Status of these terms

2.1. These terms constitute an accession agreement (Article 428 of the Russian Civil Code) and govern the use of the Service.

2.2. These terms are accepted by completing registration, signing in to an Account, or actually using the Service (Article 438 of the Russian Civil Code). No paper signature is required.

2.3. Paid services are provided on the terms of the public offer. Where these terms and the offer diverge on payment, plans, refunds or liability, the offer prevails.

2.4. The relations between the parties are governed by the law of the Russian Federation.

3. Subject of these terms

3.1. The Operator grants the User the right to use the Service to publish OTA updates for their Applications and deliver them to End users' devices — within the scope of the selected plan.

3.2. The Service implements the Expo Updates Protocol v1. The native expo-updates client in the User's Application requests an update manifest from the Operator's server and downloads the build and its assets. The technical details are described in the Service documentation, which forms part of these terms insofar as it describes how the Service works.

3.3. The Service records device requests: update checks, downloads and launches of an update. These records produce the statistics shown in the portal and the count of unique devices per calendar month (MAU), which the Service is billed by.

3.4. The Operator is not a party to the relationship between the User and the End users of their Applications.

4. Account

4.1. An Account is created from an email address, a name and a password of at least eight characters. The password is stored only as an irreversible hash.

4.2. Email address confirmation is not implemented in the Service as of this revision: the Account is created immediately. The User undertakes to provide a valid address and retain access to it — legally significant notices and fiscal receipts are sent to it.

4.3. Automatic password recovery is not implemented as of this revision. Account recovery is handled upon a request to privacy@aistastudio.ru sent from the Account's email address.

4.4. The User is responsible for keeping their password and API keys safe and for all actions performed with them. A portal session is valid for 30 days from sign-in.

4.5. One Account belongs to one person. Sharing access to an Account with third parties is not permitted; the User may issue separate API keys to their build systems.

4.6. The Operator may restrict access to an Account if these terms are breached or where the law requires it. The fact and the reason for the restriction are recorded and communicated to the User.

5. Rules of use

5.1. In using the Service, the User undertakes not to:

• violate the law of the Russian Federation or the rights of third parties;
• attempt unauthorised access to the Service, to other users' Applications and data, or to circumvent plan limits and protection mechanisms;
• create load that is excessive compared with ordinary use of the Service, including automated requests made without need;
• publish malicious code through the Service, or code whose purpose is unlawful;
• use the Service to deliver native executable code bypassing the app stores' update mechanisms (section 9);
• resell access to the Service to third parties without the Operator's written consent;
• impersonate another person or organisation.

5.2. The User alone determines the content of the updates they publish and is responsible for having the right to dispose of it. The Operator does not inspect or moderate the content of updates.

5.3. The Operator may suspend delivery of a specific update if it plainly breaches clause 5.1, having notified the User. Such suspension does not extend to the User's other updates.

6. Updates published by the User

6.1. All rights to the content of updates belong to the User. The Operator stores and delivers it solely to provide the Service and acquires no rights to it.

6.2. Publishing an update points the channel of the selected platform at the new build. Rolling a channel back returns it to the previous update; rolling back past the first published update returns devices to the build embedded in the app from the store.

6.3. A rollback applies only to the channel's current update: an attempt to roll back an update that is not the current one is rejected — otherwise the channel would silently skip versions.

6.4. Deleting an Application deletes all of its channels, updates, API keys, stored builds and statistics. End users' devices immediately stop receiving updates and remain on the last build they downloaded. The action is irreversible.

6.5. The Operator recommends that the User keep their own copies of the builds they publish. The Operator's data backup arrangements are not an obligation under these terms.

7. Code-signing keys and API keys

7.1. When an Application is created, the Service generates a code-signing key pair. The private key is stored on the Operator's server and is issued neither to the User nor to third parties; the User embeds the public key and the self-signed certificate into their app build.

7.2. Updates are signed with the Application's private key. Signature verification is performed by the expo-updates client on the End user's device if the User has enabled it in their build.

7.3. An API key is shown once, at creation. The Operator stores only its SHA-256 hash and prefix and cannot show the key again. A lost key must be deleted and replaced.

7.4. The User is responsible for storing the API keys issued to their build systems and other automation, and for revoking them promptly.

8. End users' device data

8.1. End users' devices are identified by the deviceId value that the User's Application itself sets and sends. The Operator neither generates nor validates this identifier and does not link it to the identity of an End user.

8.2. The User should use a stable technical device identifier as the deviceId and should not put direct personal data — email addresses, names, phone numbers — into it.

8.3. With respect to End users' data, the User is the personal data operator; the Operator processes that data on the User's instructions, to the extent necessary to deliver updates and count MAU. Lawfulness of processing, informing End users and responding to their requests are the User's responsibility. See section 5 of the Privacy Policy for details.

8.4. Requests from End users received by the Operator are forwarded to the User as the operator of their personal data.

9. App store policy compliance

9.1. The User is responsible for making sure the OTA updates they ship comply with App Store and Google Play policies. An analysis of the current wording of those policies is provided in the Service documentation — "App store policies on OTA updates"; it is informational and is not legal advice.

9.2. Only interpreted code — JavaScript builds and accompanying assets — may be delivered through the Service. Delivery of native executable code (.dex, .jar, .so and the like) is not supported by the Service and is prohibited by these terms.

9.3. The Operator is not responsible for app store decisions regarding the User's applications, including rejection at review or removal from the store.

10. Plans and paid services

10.1. The Service is available on a free plan with the limits stated on the pricing and billing page.

10.2. Paid plans and the procedures for payment, renewal, withdrawal and refunds are set out in the public offer.

10.3. Exceeding the MAU included in a plan does not suspend update delivery: the server keeps serving update checks, downloads and installs, and the excess is shown in the portal as a warning.

10.4. The limit on the number of Applications is enforced when a new Application is created.

11. Availability of the Service

11.1. The Service is provided "as is". The Operator takes reasonable measures to keep it available, but does not guarantee uninterrupted or error-free operation.

11.2. No service level agreement (SLA) has been concluded or published as of this revision; availability parameters and support response times are agreed in a separate document (clause 9.2 of the public offer).

11.3. The Operator may carry out scheduled maintenance, giving advance notice of work affecting the availability of the Service on the website or by email, except for emergency work.

11.4. The Operator may change the functionality of the Service without depriving the User of the capabilities included in the plan they have paid for during the paid period.

12. Ending use of the Service

12.1. The User may stop using the Service at any time. Applications are deleted by the User in the portal.

12.2. Automatic account deletion in the portal is not implemented as of this revision. Deletion of an Account and the personal data associated with it is carried out upon a request to privacy@aistastudio.ru sent from the Account's email address, in the manner and within the time limits set out in the Privacy Policy.

12.3. Before ending use, the User should make sure that their store-distributed apps do not depend on update delivery by the Service: once an Application is deleted, End users' devices remain on the last build they downloaded.

12.4. If these terms are breached, the Operator may restrict access to the Service until the breach is remedied, or terminate it. In the event of termination the User retains the right to obtain their data.

13. Liability

13.1. The Operator is not liable for the content of the User's updates, for the consequences of installing them on End users' devices, or for the User's decisions about what to ship in an update.

13.2. The Operator does not compensate lost profit or losses caused by downtime of the User's apps and services, except where such limitation is not permitted by law.

13.3. Nothing in these terms limits the Operator's liability where it cannot be limited by law, including liability towards individuals acting as consumers.

13.4. The User shall reimburse the Operator for documented losses arising from third-party claims related to the content of the updates the User publishes or to the User's breach of section 5 of these terms.

14. Personal data

14.1. Users' personal data is processed as set out in the Privacy Policy.

14.2. On registering with the Service, a User who is an individual gives consent to the processing of personal data.

14.3. Cookies and browser local storage are used as described in section 7 of the Privacy Policy. Web analytics is loaded only after the site visitor has explicitly consented.

15. Amendments to these terms

15.1. The Operator may amend these terms. A new revision is published on this page with its effective date; for material changes the Operator additionally notifies Users through the portal interface or by email.

15.2. Continued use of the Service after a new revision takes effect constitutes agreement with it. If the User does not agree, they should stop using the Service and request deletion of their data as described in clause 12.2.

15.3. Previous revisions are provided on request to privacy@aistastudio.ru.

16. Dispute resolution

16.1. Before going to court, a party sends the other party a claim: to the Operator — at privacy@aistastudio.ru or in writing to the address stated in section 17; to the User — at the email address of their Account. The deadline for responding to a claim is 30 calendar days from receipt.

16.2. If no agreement is reached, the dispute is heard by the court at the Operator's location. For disputes involving a User who is a consumer, this rule applies only insofar as it does not conflict with their statutory right to choose the court.

17. Operator details

• Operator: Общество с ограниченной ответственностью «СТУДИЯ АИСТА» (ООО «СТУДИЯ АИСТА»)
• OGRN: 1267800056260
• TIN (INN): 7814865711, KPP: 781401001
• Registered address: 197706, г. Санкт-Петербург, вн.тер.г. город Сестрорецк, ул. Всеволода Боброва, д. 30, литера А, помещ. 1-Н, офис 13
• Service website: https://ota.aistastudio.ru
• Contact address: privacy@aistastudio.ru